Sep  1 04:26:33 nativespace-cdp sshd[810471]: Connection closed by 159.100.136.21 port 58756 [preauth]
Sep  1 04:31:32 nativespace-cdp sshd[811579]: Connection closed by 159.100.136.21 port 40564 [preauth]
Sep  1 04:36:32 nativespace-cdp sshd[812701]: Connection closed by 159.100.136.21 port 50852 [preauth]
Sep  1 04:41:32 nativespace-cdp sshd[815595]: Connection closed by 159.100.136.21 port 60786 [preauth]
Sep  1 04:46:32 nativespace-cdp sshd[816623]: Connection closed by 159.100.136.21 port 42796 [preauth]
Sep  1 04:51:33 nativespace-cdp sshd[817768]: Connection closed by 159.100.136.21 port 52510 [preauth]
Sep  1 04:56:33 nativespace-cdp sshd[819103]: Connection closed by 159.100.136.21 port 34552 [preauth]
Sep  1 04:56:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 04:56:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:56:55 nativespace-cdp sudo[819164]: pam_unix(sudo:session): session closed for user root
Sep  1 04:56:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 04:56:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:56:55 nativespace-cdp sudo[819173]: pam_unix(sudo:session): session closed for user root
Sep  1 04:56:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 04:56:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:00 nativespace-cdp sudo[819188]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=brmrjxl user-2=lakesan1 user-3=atestord user-4=sarafoundation user-5=strathar user-6=wilsonsw user-7=megacards user-8=musorguk user-9=martsblo user-10=ptkxhsbt user-11=dickemery123 user-12=hhdugcor user-13=lbhyisi user-14=magichat user-15=booff user-16=markward user-17=foundation user-18=lbscrmod user-19=maflemin user-20=vantagep user-21=connect9 user-22=athenare user-23=ulsukarm user-24=jarvisin user-25=theblack user-26=hodgesonweb user-27=spectrum user-28=agproduc user-29=still user-30=leereyn1 user-31=stephani user-32=nstriton user-33=brighto1 user-34=oneoarco user-35=battlere user-36=vivienn1 user-37=firstre2 user-38=bedfords user-39=bemadonn user-40=newstoda user-41=belle user-42=ggaaorgu user-43=skyfirec user-44=alexadmin user-45=askhform user-46=stuartge user-47=innovat1 user-48=nativene
Sep  1 04:57:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstres user-50=ultbcrra user-51=seftvta user-52=jonhartl user-53=coursemc user-54=opaiscyx user-55=costestimatorco user-56=clarkass user-57=firstrel user-58=highlegh user-59=southlon user-60=firstred user-61=elecleis user-62=milloyco user-63=gilpin user-64=fetch user-65=carsinyo user-66=putterfi user-67=hubmaster user-68=ianrayne user-69=accooper user-70=thqkgnbz user-71=connectedshoppin user-72=foods user-73=leftie user-74=fortunaz user-75=health2045 user-76=nscdp user-77=putterfc user-78=steakbridieme user-79=firstre5 user-80=donnychicago user-81=philmcph user-82=ctedorgu user-83=lkpier user-84=smrszyqg user-85=isleofwi user-86=barbersh user-87=tigerlet user-88=nomistakes user-89=hidden user-90=ninejimm user-91=reliable user-92=cathski user-93=cambria1 user-94=cwsocial user-95=paulmca1 user-96=pugwash user-97=howardon user-98=hirefootballgame user-99=courseme user-100=eugincou user-101=sibtoncc
Sep  1 04:57:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=asandcoc user-103=zebrapho user-104=bwppodcast user-105=steve user-106=fawcettd user-107=burydropin user-108=nsceres user-109=darkstar user-110=eatspam user-111=beauty user-112=dhyana user-113=nove user-114=boldover user-115=crrtipdl user-116=sosevalu user-117=bakery user-118=what user-119=tstardom user-120=oubpgvbx user-121=nvihkvu user-122=havantho user-123=sketchy user-124=cath user-125=kategilpin user-126=dancinggardener user-127=stagingerris user-128=ladburyp user-129=design user-130=tomandle user-131=jennimil user-132=mcdermos user-133=chrisdal user-134=pars user-135=david user-136=careers user-137=nbhavers user-138=lucy user-139=attlebor user-140=onlycont user-141=branko user-142=hodgsonmail user-143=outdoorc user-144=ranxterc user-145=romaldki feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 04:57:00 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 04:57:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:01 nativespace-cdp sudo[819194]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  1 04:57:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:04 nativespace-cdp sudo[819226]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=onlycont --output=json
Sep  1 04:57:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:05 nativespace-cdp sudo[819232]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  1 04:57:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 04:57:29 nativespace-cdp sudo[819364]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 04:57:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user onlycont --user-current --json
Sep  1 04:57:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:31 nativespace-cdp sudo[819372]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont LangPHP php_get_vhost_versions --output=json
Sep  1 04:57:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:34 nativespace-cdp sudo[819456]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep  1 04:57:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:42 nativespace-cdp sudo[819473]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  1 04:57:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:42 nativespace-cdp sudo[819502]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DomainInfo single_domain_data domain=apexred.com return_https_redirect_status=1 --output=json
Sep  1 04:57:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:45 nativespace-cdp sudo[819517]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep  1 04:57:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:51 nativespace-cdp sudo[819528]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep  1 04:57:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:51 nativespace-cdp sudo[819542]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont Mime list_redirects --output=json
Sep  1 04:57:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:51 nativespace-cdp sudo[819548]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DirectoryPrivacy is_directory_protected dir=/home/onlycont/public_html/wp --output=json
Sep  1 04:57:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:57:55 nativespace-cdp sudo[819619]: pam_unix(sudo:session): session closed for user root
Sep  1 04:57:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  1 04:57:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 04:57:59 nativespace-cdp sudo[819683]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 04:57:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep  1 04:57:59 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep  1 04:57:59 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep  1 04:57:59 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 04:57:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 04:57:59 nativespace-cdp sudo[819690]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 04:57:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  1 04:57:59 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  1 04:57:59 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  1 04:57:59 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 04:57:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 04:58:01 nativespace-cdp sudo[819698]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 04:58:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  1 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  1 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  1 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 04:58:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 04:58:03 nativespace-cdp sudo[819708]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  1 04:58:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 04:58:12 nativespace-cdp sudo[819848]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 04:58:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 04:58:12 nativespace-cdp sudo[819854]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 04:58:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 04:58:12 nativespace-cdp sudo[819860]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  1 04:58:12 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 04:58:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 04:58:12 nativespace-cdp sudo[819866]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 04:58:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  1 04:58:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:58:14 nativespace-cdp sudo[819906]: pam_unix(sudo:session): session closed for user root
Sep  1 04:58:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep  1 04:58:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:58:15 nativespace-cdp sudo[819912]: pam_unix(sudo:session): session closed for user root
Sep  1 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  1 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 04:59:21 nativespace-cdp sudo[820123]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  1 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:59:21 nativespace-cdp sudo[820130]: pam_unix(sudo:session): session closed for user root
Sep  1 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep  1 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:59:22 nativespace-cdp sudo[820134]: pam_unix(sudo:session): session closed for user root
Sep  1 04:59:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep  1 04:59:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:59:23 nativespace-cdp sudo[820139]: pam_unix(sudo:session): session closed for user root
Sep  1 04:59:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  1 04:59:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:59:23 nativespace-cdp sudo[820154]: pam_unix(sudo:session): session closed for user root
Sep  1 04:59:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep  1 04:59:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:59:26 nativespace-cdp sudo[820169]: pam_unix(sudo:session): session closed for user root
Sep  1 04:59:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep  1 04:59:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:59:26 nativespace-cdp sudo[820175]: pam_unix(sudo:session): session closed for user root
Sep  1 04:59:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep  1 04:59:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 04:59:33 nativespace-cdp sudo[820248]: pam_unix(sudo:session): session closed for user root
Sep  1 04:59:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  1 04:59:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 04:59:37 nativespace-cdp sudo[820309]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 04:59:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  1 04:59:37 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  1 04:59:37 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  1 04:59:37 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 04:59:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 04:59:38 nativespace-cdp sudo[820316]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 04:59:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  1 04:59:38 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  1 04:59:38 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  1 04:59:38 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 04:59:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 04:59:55 nativespace-cdp sudo[820323]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:00:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  1 05:00:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:00:12 nativespace-cdp sudo[820714]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:00:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  1 05:00:12 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  1 05:00:12 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  1 05:00:12 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:00:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:00:12 nativespace-cdp sudo[820722]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:00:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  1 05:00:12 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  1 05:00:12 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  1 05:00:12 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:00:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:00:12 nativespace-cdp sudo[820728]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:00:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  1 05:00:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:00:14 nativespace-cdp sudo[820769]: pam_unix(sudo:session): session closed for user root
Sep  1 05:00:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep  1 05:00:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:00:15 nativespace-cdp sudo[820773]: pam_unix(sudo:session): session closed for user root
Sep  1 05:00:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  1 05:00:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 05:00:43 nativespace-cdp sudo[820979]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 05:00:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep  1 05:00:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:00:44 nativespace-cdp sudo[820987]: pam_unix(sudo:session): session closed for user root
Sep  1 05:00:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep  1 05:00:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:00:44 nativespace-cdp sudo[820990]: pam_unix(sudo:session): session closed for user root
Sep  1 05:00:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  1 05:00:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:00:44 nativespace-cdp sudo[820995]: pam_unix(sudo:session): session closed for user root
Sep  1 05:00:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep  1 05:00:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:00:46 nativespace-cdp sudo[821009]: pam_unix(sudo:session): session closed for user root
Sep  1 05:00:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep  1 05:00:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:00:46 nativespace-cdp sudo[821014]: pam_unix(sudo:session): session closed for user root
Sep  1 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep  1 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:00:56 nativespace-cdp sudo[821094]: pam_unix(sudo:session): session closed for user root
Sep  1 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  1 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 05:00:59 nativespace-cdp sudo[821153]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  1 05:00:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  1 05:00:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  1 05:00:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 05:01:00 nativespace-cdp sudo[821159]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  1 05:01:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  1 05:01:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  1 05:01:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 05:01:19 nativespace-cdp sudo[821167]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  1 05:01:19 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  1 05:01:19 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  1 05:01:19 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 05:01:22 nativespace-cdp sudo[821245]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  1 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 05:01:29 nativespace-cdp sudo[821376]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 05:01:29 nativespace-cdp sudo[821382]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 05:01:29 nativespace-cdp sudo[821388]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  1 05:01:29 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 05:01:29 nativespace-cdp sudo[821394]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 05:01:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  1 05:01:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:31 nativespace-cdp sudo[821430]: pam_unix(sudo:session): session closed for user root
Sep  1 05:01:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep  1 05:01:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:33 nativespace-cdp sudo[821436]: pam_unix(sudo:session): session closed for user root
Sep  1 05:01:33 nativespace-cdp sshd[821457]: Connection closed by 159.100.136.21 port 44540 [preauth]
Sep  1 05:01:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep  1 05:01:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:34 nativespace-cdp sudo[821459]: pam_unix(sudo:session): session closed for user root
Sep  1 05:01:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep  1 05:01:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:35 nativespace-cdp sudo[821466]: pam_unix(sudo:session): session closed for user root
Sep  1 05:01:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  1 05:01:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  1 05:01:35 nativespace-cdp sudo[821476]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  1 05:01:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep  1 05:01:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:36 nativespace-cdp sudo[821482]: pam_unix(sudo:session): session closed for user root
Sep  1 05:01:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep  1 05:01:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:36 nativespace-cdp sudo[821487]: pam_unix(sudo:session): session closed for user root
Sep  1 05:01:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  1 05:01:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:36 nativespace-cdp sudo[821492]: pam_unix(sudo:session): session closed for user root
Sep  1 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  1 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:01:54 nativespace-cdp sudo[821588]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  1 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:55 nativespace-cdp sudo[821594]: pam_unix(sudo:session): session closed for user root
Sep  1 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  1 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:55 nativespace-cdp sudo[821598]: pam_unix(sudo:session): session closed for user root
Sep  1 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep  1 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:01:56 nativespace-cdp sudo[821611]: pam_unix(sudo:session): session closed for user root
Sep  1 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep  1 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:02:01 nativespace-cdp sudo[821687]: pam_unix(sudo:session): session closed for user root
Sep  1 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  1 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:02:04 nativespace-cdp sudo[821747]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  1 05:02:04 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  1 05:02:04 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  1 05:02:04 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:02:05 nativespace-cdp sudo[821753]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:02:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  1 05:02:05 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  1 05:02:05 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  1 05:02:05 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:02:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:02:23 nativespace-cdp sudo[821763]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:02:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  1 05:02:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:02:29 nativespace-cdp sudo[821930]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:02:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  1 05:02:29 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  1 05:02:29 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  1 05:02:29 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:02:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:02:29 nativespace-cdp sudo[821937]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:02:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  1 05:02:29 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  1 05:02:29 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  1 05:02:29 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  1 05:02:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 05:02:29 nativespace-cdp sudo[821943]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  1 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:02:32 nativespace-cdp sudo[821977]: pam_unix(sudo:session): session closed for user root
Sep  1 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep  1 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:02:32 nativespace-cdp sudo[821981]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  1 05:03:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  1 05:03:15 nativespace-cdp sudo[822152]: pam_unix(sudo:session): session closed for user fortunaz
Sep  1 05:03:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep  1 05:03:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:16 nativespace-cdp sudo[822158]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep  1 05:03:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:16 nativespace-cdp sudo[822162]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  1 05:03:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:16 nativespace-cdp sudo[822167]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep  1 05:03:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:19 nativespace-cdp sudo[822186]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  1 05:03:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:19 nativespace-cdp sudo[822191]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep  1 05:03:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:24 nativespace-cdp sudo[822257]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=brmrjxl WpToolkitNotification send_admin_auto_updates_notification available_updates_text= available_updates_list= installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep  1 05:03:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:34 nativespace-cdp sudo[822447]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822576]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822582]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822585]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822588]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822591]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822594]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822597]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822600]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822603]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822606]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822609]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822612]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822615]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822618]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822621]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822624]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:43 nativespace-cdp sudo[822628]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822631]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822634]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822637]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822640]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822643]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822646]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822649]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822653]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822656]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822659]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822662]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822665]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822668]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822671]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822674]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822677]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822680]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822684]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822687]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822690]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822693]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822696]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822699]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822702]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822705]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822708]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822711]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822714]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822717]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822720]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822723]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822726]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822729]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:44 nativespace-cdp sudo[822733]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822736]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822739]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822742]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822745]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822748]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822751]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822754]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822757]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822760]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822763]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822766]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822769]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822772]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822775]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822778]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822781]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822784]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822787]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822790]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822793]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822796]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822799]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822802]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822805]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822808]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822811]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822814]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822817]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822820]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822823]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822826]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822829]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:45 nativespace-cdp sudo[822833]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822836]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822839]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822842]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822845]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822848]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822851]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822854]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822857]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822860]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822863]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822866]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822869]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822872]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822875]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822878]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822881]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822884]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822887]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822890]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822893]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822896]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822899]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822902]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822905]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822908]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822911]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822914]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822917]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:46 nativespace-cdp sudo[822922]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822925]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822928]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822931]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822934]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822937]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822940]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822943]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822946]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822949]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822952]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822955]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822958]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822961]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822964]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822967]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822970]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822973]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822976]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822979]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822982]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822985]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822988]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822991]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822994]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[822997]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823000]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823003]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823006]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823009]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823012]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823015]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823019]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823022]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823025]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823028]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823031]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:47 nativespace-cdp sudo[823035]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823038]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823041]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823044]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823047]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823050]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823053]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823056]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823059]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823062]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823066]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823069]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823072]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823076]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823079]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823082]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823085]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823088]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823091]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823094]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823097]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823100]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823103]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823106]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823109]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823112]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823115]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823118]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823121]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823123]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823126]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823129]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823132]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823135]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823138]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823141]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:48 nativespace-cdp sudo[823145]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823148]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823151]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823154]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823157]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823160]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823163]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823166]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823169]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823172]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823175]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823178]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823181]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823184]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823187]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823190]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823193]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823196]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823199]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823202]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823205]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823208]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823211]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823214]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823217]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823220]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823223]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823226]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823229]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823232]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823235]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823238]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823241]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823244]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823247]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823250]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  1 05:03:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:49 nativespace-cdp sudo[823253]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  1 05:03:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:50 nativespace-cdp sudo[823257]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  1 05:03:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:50 nativespace-cdp sudo[823260]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  1 05:03:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:50 nativespace-cdp sudo[823263]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/design/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:50 nativespace-cdp sudo[823266]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/aberdeen-guesthouses.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:50 nativespace-cdp sudo[823269]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/aberdeen-guesthouses.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:50 nativespace-cdp sudo[823272]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/accooper/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:50 nativespace-cdp sudo[823275]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/agproduc/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:51 nativespace-cdp sudo[823279]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/altrincham -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:51 nativespace-cdp sudo[823282]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/wp-content
Sep  1 05:03:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:51 nativespace-cdp sudo[823285]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/wp-config.php
Sep  1 05:03:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:51 nativespace-cdp sudo[823288]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/.wp-toolkit-ignore
Sep  1 05:03:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:51 nativespace-cdp sudo[823291]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/amarawetherall.me.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:51 nativespace-cdp sudo[823294]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/amarawetherall.me.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:51 nativespace-cdp sudo[823297]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html/amcalenan -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:53 nativespace-cdp sudo[823300]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-content
Sep  1 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:53 nativespace-cdp sudo[823309]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-config.php
Sep  1 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:53 nativespace-cdp sudo[823312]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/.wp-toolkit-ignore
Sep  1 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:53 nativespace-cdp sudo[823315]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html/amcalenan -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:53 nativespace-cdp sudo[823318]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-content
Sep  1 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:54 nativespace-cdp sudo[823322]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-config.php
Sep  1 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:54 nativespace-cdp sudo[823325]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/.wp-toolkit-ignore
Sep  1 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:54 nativespace-cdp sudo[823328]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/thqkgnbz/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:54 nativespace-cdp sudo[823331]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/thqkgnbz/public_html/testwp/wp-content
Sep  1 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:54 nativespace-cdp sudo[823334]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/thqkgnbz/public_html/testwp/wp-config.php
Sep  1 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:54 nativespace-cdp sudo[823337]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/thqkgnbz/public_html/testwp/.wp-toolkit-ignore
Sep  1 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:54 nativespace-cdp sudo[823340]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/sinclairmanagement -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:03:54 nativespace-cdp sudo[823343]: pam_unix(sudo:session): session closed for user root
Sep  1 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/onlycont/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:16 nativespace-cdp sudo[823347]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/onlycont/public_html/wp/wp-content
Sep  1 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:16 nativespace-cdp sudo[823418]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/onlycont/public_html/wp/wp-config.php
Sep  1 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:16 nativespace-cdp sudo[823421]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/onlycont/public_html/wp/.wp-toolkit-ignore
Sep  1 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:16 nativespace-cdp sudo[823424]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/asandcoc/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823427]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/asandcoc/public_html/blog/wp-content
Sep  1 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823431]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/asandcoc/public_html/blog/wp-config.php
Sep  1 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823435]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/asandcoc/public_html/blog/.wp-toolkit-ignore
Sep  1 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823438]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/askhform/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823441]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823444]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/athenars.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823447]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/athenars.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823450]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/attlebor/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823453]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/auchendennanltd.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:17 nativespace-cdp sudo[823457]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/auchendennanltd.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:18 nativespace-cdp sudo[823460]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/backinawhile -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:18 nativespace-cdp sudo[823463]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/backinawhile -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:18 nativespace-cdp sudo[823466]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/opaiscyx/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:18 nativespace-cdp sudo[823469]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bwppodcast/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:23 nativespace-cdp sudo[823475]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/bargeton.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:23 nativespace-cdp sudo[823525]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/bargeton.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:23 nativespace-cdp sudo[823528]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/battlere/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:24 nativespace-cdp sudo[823531]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/battlere/public_html/home/wp-content
Sep  1 05:04:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:24 nativespace-cdp sudo[823535]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/battlere/public_html/home/wp-config.php
Sep  1 05:04:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:24 nativespace-cdp sudo[823538]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/battlere/public_html/home/.wp-toolkit-ignore
Sep  1 05:04:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:24 nativespace-cdp sudo[823541]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bedfords/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:25 nativespace-cdp sudo[823544]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bedfords/public_html/wp-content
Sep  1 05:04:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:25 nativespace-cdp sudo[823547]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bedfords/public_html/wp-config.php
Sep  1 05:04:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:25 nativespace-cdp sudo[823550]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bedfords/public_html/.wp-toolkit-ignore
Sep  1 05:04:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:25 nativespace-cdp sudo[823553]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/belle/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:25 nativespace-cdp sudo[823556]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bemadonn/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:25 nativespace-cdp sudo[823559]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brighto1/bhlabour.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:30 nativespace-cdp sudo[823562]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/wp-content
Sep  1 05:04:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:30 nativespace-cdp sudo[823576]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/wp-config.php
Sep  1 05:04:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:30 nativespace-cdp sudo[823579]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/../wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823582]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wp-content
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823585]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823588]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/../wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823591]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823594]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823597]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/.wp-toolkit-ignore
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823600]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brighto1/bhlabour.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823603]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/wp-content
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823606]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823609]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/../wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823612]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wp-content
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823615]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823618]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/../wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823621]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823624]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823627]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/.wp-toolkit-ignore
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823630]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/birmingham -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823633]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/wp-content
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823636]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823639]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/.wp-toolkit-ignore
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823642]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/blackburn -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823645]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/wp-content
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823648]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/wp-config.php
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823651]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/.wp-toolkit-ignore
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:31 nativespace-cdp sudo[823655]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/jalbum/jeremy/public_html/BattleofBritain -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823658]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/boldover-graphic-design.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823661]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-content
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823665]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-config.php
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823668]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/.wp-toolkit-ignore
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823671]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/boldover-graphic-design.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823674]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-content
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823677]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-config.php
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823680]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/.wp-toolkit-ignore
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823683]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823686]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/wp-content
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823690]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/wp-config.php
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823694]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/.wp-toolkit-ignore
Sep  1 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:32 nativespace-cdp sudo[823697]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-content
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823700]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-config.php
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823703]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/.wp-toolkit-ignore
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823706]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/boldver.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823709]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/boldver.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823712]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/bolton -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823715]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/wp-content
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823718]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/wp-config.php
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823722]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/.wp-toolkit-ignore
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823726]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/booff/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823729]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/bramptonabbotts.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823732]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/bramptonabbotts.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823735]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/bridstow-school.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823739]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/bridstow-school.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823742]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brighto1/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823745]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brmrjxl/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:33 nativespace-cdp sudo[823748]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/burnley -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823752]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/wp-content
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823755]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/wp-config.php
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823758]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/.wp-toolkit-ignore
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823761]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/burtonupontrent -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823764]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/wp-content
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823767]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/wp-config.php
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823770]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/.wp-toolkit-ignore
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823773]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/bury -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823776]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/wp-content
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823779]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/wp-config.php
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823782]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/.wp-toolkit-ignore
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823785]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/burydropin/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823788]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cambria1/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823791]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/cambridge -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823794]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/candidacanbefun.co.uk/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823797]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/candidacanbefun.co.uk/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823800]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/crete/wordpress -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823803]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/crete/wordpress -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:34 nativespace-cdp sudo[823807]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/catherinejonesart.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823810]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/catherinejonesart.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823813]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/chale-bay-farm.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823816]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/chale-bay-farm.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823819]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/chale-bay-farm.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823822]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/chale-bay-farm.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823825]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html/channel-capital.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823828]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html/channel-capital.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823831]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823834]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823837]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html/channelcapital.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823840]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html/channelcapital.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823843]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/chorley -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823846]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/wp-content
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823849]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/wp-config.php
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823852]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/.wp-toolkit-ignore
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823855]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/chorleyhandyman.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823858]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/chorleyhandyman.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:35 nativespace-cdp sudo[823861]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823864]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823868]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823871]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823874]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/christchurchfod.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823877]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/christchurchfod.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823880]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/churchdownclub.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823883]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/churchdownclub.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823886]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/churchdownmvc.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823889]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/churchdownmvc.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823892]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/churchdownvillagebowls.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823895]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/churchdownvillagebowls.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823898]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/clark.associates -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823901]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/clark.associates -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:36 nativespace-cdp sudo[823904]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823907]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823911]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/clerks -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823914]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/cmvc.skyfire-designs.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823917]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/code/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823920]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/colingrieve.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823923]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/colingrieve.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823926]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/connect9/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823929]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html/www.coriniumcapital.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823932]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html/www.coriniumcapital.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:37 nativespace-cdp sudo[823935]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/costestimatorco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:43 nativespace-cdp sudo[823938]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/costestimatorco/public_html/wp-content
Sep  1 05:04:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:43 nativespace-cdp sudo[823961]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/costestimatorco/public_html/wp-config.php
Sep  1 05:04:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:43 nativespace-cdp sudo[823964]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/costestimatorco/public_html/.wp-toolkit-ignore
Sep  1 05:04:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:43 nativespace-cdp sudo[823967]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oubpgvbx/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:44 nativespace-cdp sudo[823970]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/coventry -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:44 nativespace-cdp sudo[823974]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/wp-content
Sep  1 05:04:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:44 nativespace-cdp sudo[823977]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/wp-config.php
Sep  1 05:04:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:44 nativespace-cdp sudo[823980]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/.wp-toolkit-ignore
Sep  1 05:04:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:44 nativespace-cdp sudo[823983]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ctedorgu/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:45 nativespace-cdp sudo[823986]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/cvs.media -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:45 nativespace-cdp sudo[823989]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/cvs.media -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:45 nativespace-cdp sudo[823992]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cwsocial/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:46 nativespace-cdp sudo[823995]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/wp-content
Sep  1 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:46 nativespace-cdp sudo[823999]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/wp-config.php
Sep  1 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:46 nativespace-cdp sudo[824002]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/.wp-toolkit-ignore
Sep  1 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:46 nativespace-cdp sudo[824005]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cwsocial/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:46 nativespace-cdp sudo[824008]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/wp-content
Sep  1 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:46 nativespace-cdp sudo[824011]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/wp-config.php
Sep  1 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:46 nativespace-cdp sudo[824014]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/.wp-toolkit-ignore
Sep  1 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:46 nativespace-cdp sudo[824017]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/dancinggardener/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824020]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dancinggardener/public_html/wp-content
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824024]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dancinggardener/public_html/wp-config.php
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824027]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dancinggardener/public_html/.wp-toolkit-ignore
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824030]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/darkstar/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824033]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ddlc.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824036]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ddlc.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824040]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/derby -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824043]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/wp-content
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824046]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/wp-config.php
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824049]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/.wp-toolkit-ignore
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:47 nativespace-cdp sudo[824052]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/dev.boldover.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824055]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/dev.boldover.co.uk/wp-content
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824060]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/dev.boldover.co.uk/wp-config.php
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824063]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/dev.boldover.co.uk/.wp-toolkit-ignore
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824066]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brighto1/dev.brightonhovelabour.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824070]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/martsblo/public_html/wordpress-website-developer.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824073]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/devdev -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824076]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/jalbum/jeremy/public_html/Devon_2012 -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824081]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/dhyana/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824084]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/dhyana/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:48 nativespace-cdp sudo[824087]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/dickemery123/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824090]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dickemery123/public_html/wp/wp-content
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824104]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dickemery123/public_html/wp/wp-config.php
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824107]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dickemery123/public_html/wp/.wp-toolkit-ignore
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824110]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/home/ranxterc/websites/disfigurines -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824113]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/home/ranxterc/websites/disfigurines -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824116]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824119]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824122]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824125]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824128]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824131]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824134]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824137]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824140]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/dogmarket.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824143]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/dogmarket.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824146]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/beauty/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:54 nativespace-cdp sudo[824149]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/carsinyo/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:55 nativespace-cdp sudo[824152]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/clean/wp-content
Sep  1 05:04:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:55 nativespace-cdp sudo[824157]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/clean/wp-config.php
Sep  1 05:04:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:55 nativespace-cdp sudo[824160]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/clean/../wp-config.php
Sep  1 05:04:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:55 nativespace-cdp sudo[824163]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/clean/../wp-includes
Sep  1 05:04:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:55 nativespace-cdp sudo[824166]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/wp-content
Sep  1 05:04:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:55 nativespace-cdp sudo[824169]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/wp-config.php
Sep  1 05:04:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:55 nativespace-cdp sudo[824172]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/.wp-toolkit-ignore
Sep  1 05:04:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:55 nativespace-cdp sudo[824175]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wp-content
Sep  1 05:04:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:55 nativespace-cdp sudo[824178]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wp-config.php
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824181]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/.wp-toolkit-ignore
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824184]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/donnychicago/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824187]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/drutopia.co -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824190]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/drybrookband.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824193]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/drybrookband.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824197]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/drybrookband.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824200]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/drybrookband.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824203]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/dudley -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824207]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/wp-content
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824211]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/wp-config.php
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824214]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/.wp-toolkit-ignore
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:04:56 nativespace-cdp sudo[824218]: pam_unix(sudo:session): session closed for user root
Sep  1 05:04:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/eacha.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:04:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:00 nativespace-cdp sudo[824221]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/eacha.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:00 nativespace-cdp sudo[824232]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/eacha.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:00 nativespace-cdp sudo[824235]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/eatspam/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:00 nativespace-cdp sudo[824238]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cathski/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:00 nativespace-cdp sudo[824241]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/eugincou/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:00 nativespace-cdp sudo[824245]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/fallgame.info -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:00 nativespace-cdp sudo[824248]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/fancydresspiratecostumes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:00 nativespace-cdp sudo[824252]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fawcettd/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:01 nativespace-cdp sudo[824255]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/fellowshipofkilmarnockchurches.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:04 nativespace-cdp sudo[824258]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/fellowshipofkilmarnockchurches.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:04 nativespace-cdp sudo[824367]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fetch/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:04 nativespace-cdp sudo[824370]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824374]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824390]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824394]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824397]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824400]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824403]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824406]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824409]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824412]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824416]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824419]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824422]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824425]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824428]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824431]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824434]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824437]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824440]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824443]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824446]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824449]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824452]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824455]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824458]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824462]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824465]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824468]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824471]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824474]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824477]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824480]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824483]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824486]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/.wp-toolkit-ignore
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824489]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/wp-content
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:09 nativespace-cdp sudo[824492]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/wp-config.php
Sep  1 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824495]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824498]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824501]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824504]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824507]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824510]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824513]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824516]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824519]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824522]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824525]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824528]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824531]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824534]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824537]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824540]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824543]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824546]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824549]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824552]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824555]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824558]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824561]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824564]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824567]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824570]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824573]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824576]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824579]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824582]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824586]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824589]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824592]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824595]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824598]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824601]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824604]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824607]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824610]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/wp-config.php
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824613]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/.wp-toolkit-ignore
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:10 nativespace-cdp sudo[824616]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/wp-content
Sep  1 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824619]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824622]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824625]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824628]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824631]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824634]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824637]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824640]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824643]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824646]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824649]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824652]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824655]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824658]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824661]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824664]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824667]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824670]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824673]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824677]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824680]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824683]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824686]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824689]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824692]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824695]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824698]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824701]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824704]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824707]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824711]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824714]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824717]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824720]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824723]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824726]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824729]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/wp-config.php
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824732]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/.wp-toolkit-ignore
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824735]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/wp-content
Sep  1 05:05:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:11 nativespace-cdp sudo[824738]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824741]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824744]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/wp-content
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824747]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824750]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824753]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/wp-content
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824756]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824759]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824762]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/wp-content
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824765]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824768]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824771]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/wp-content
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824774]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824777]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824780]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/wp-content
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824783]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824786]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824790]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/wp-content
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824793]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824796]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824799]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/wp-content
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824802]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824805]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824808]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/wp-content
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824811]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824814]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824817]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wp-content
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824820]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wp-config.php
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824823]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/.wp-toolkit-ignore
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824827]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstred/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:12 nativespace-cdp sudo[824831]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstres/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824834]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstres/public_html/wp-content
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824837]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstres/public_html/wp-config.php
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824840]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstres/public_html/.wp-toolkit-ignore
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824843]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstrel/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824846]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre2/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824849]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre2/public_html/wp-content
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824853]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre2/public_html/wp-config.php
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824856]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre2/public_html/.wp-toolkit-ignore
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824859]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/fletcherjackson.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824862]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/fletcherjackson -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824865]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/fletcherjackson.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824868]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824872]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/wp-content
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824875]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/wp-config.php
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824878]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/.wp-toolkit-ignore
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824881]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-content
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824884]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-config.php
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824887]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/.wp-toolkit-ignore
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824890]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/forestedgebenefice.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:13 nativespace-cdp sudo[824893]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/forestedgebenefice.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:14 nativespace-cdp sudo[824898]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/forestrc.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:14 nativespace-cdp sudo[824901]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/forestrc.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:14 nativespace-cdp sudo[824904]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cath/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:14 nativespace-cdp sudo[824908]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fortunaz/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:17 nativespace-cdp sudo[824911]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/wp-content
Sep  1 05:05:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:17 nativespace-cdp sudo[824924]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/wp-config.php
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824927]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/.wp-toolkit-ignore
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824930]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fortunaz/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824933]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/wp-content
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824936]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/wp-config.php
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824939]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/.wp-toolkit-ignore
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824942]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/gainford-inventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824945]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/gainford-inventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824948]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/getgotdelivered.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824951]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/getgotdelivered.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824954]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824957]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/asandcoc/public_html/global -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824961]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/martsblo/public_html/gordonandsons.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824964]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/martsblo/public_html/gordonandsons.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824967]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/grantham -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824970]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/wp-content
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824973]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/wp-config.php
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824976]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/.wp-toolkit-ignore
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824979]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/graydimensions.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824982]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/graydimensions.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824985]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/halfanedit -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824988]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/halifax -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824991]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/wp-content
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824994]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/wp-config.php
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[824997]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/.wp-toolkit-ignore
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[825000]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/harryclark.me.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:18 nativespace-cdp sudo[825004]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/harryclark.me.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:19 nativespace-cdp sudo[825007]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/havantho/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:20 nativespace-cdp sudo[825010]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/health2045/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:20 nativespace-cdp sudo[825015]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/health2045/public_html/wp-content
Sep  1 05:05:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:20 nativespace-cdp sudo[825020]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/health2045/public_html/wp-config.php
Sep  1 05:05:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:20 nativespace-cdp sudo[825023]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/health2045/public_html/.wp-toolkit-ignore
Sep  1 05:05:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:20 nativespace-cdp sudo[825026]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/home/ranxterc/websites/hellositex -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:20 nativespace-cdp sudo[825029]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/home/ranxterc/websites/hellositex -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:20 nativespace-cdp sudo[825032]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/help -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:20 nativespace-cdp sudo[825035]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/highlegh/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825038]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hirefootballgame/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825043]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hodgsonmail/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825046]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/homebuyinghelp.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825049]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/homebuyinghelp.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825052]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/mcdermos/public_html/homovision -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825055]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/wp-content
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825058]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/wp-config.php
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825061]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/.wp-toolkit-ignore
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825065]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/howardon/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825068]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/huddersfield -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:23 nativespace-cdp sudo[825073]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/wp-content
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825076]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/wp-config.php
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825085]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/.wp-toolkit-ignore
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825092]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/hyperchro.me -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825096]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/wp-content
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825101]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/wp-config.php
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825104]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/.wp-toolkit-ignore
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825107]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/hyperchrome -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825110]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ianrayne/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825113]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/images -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:24 nativespace-cdp sudo[825116]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/impactconsultancy.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:25 nativespace-cdp sudo[825119]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/impactconsultancy.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:25 nativespace-cdp sudo[825122]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/innovat1/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:25 nativespace-cdp sudo[825125]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/innovat1/public_html/www -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:25 nativespace-cdp sudo[825129]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/innovat1/public_html/www -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:25 nativespace-cdp sudo[825132]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:32 nativespace-cdp sudo[825135]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:05:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:32 nativespace-cdp sudo[825152]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:05:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:32 nativespace-cdp sudo[825155]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:05:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:32 nativespace-cdp sudo[825158]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:05:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:32 nativespace-cdp sudo[825161]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:05:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:32 nativespace-cdp sudo[825164]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:05:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:32 nativespace-cdp sudo[825167]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825170]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825174]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825177]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825180]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825184]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825187]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825190]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825193]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825196]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825199]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825202]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825206]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825209]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825212]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/inventory-pro.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825215]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/inventory-pro.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825218]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/ipadinventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825221]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/ipadinventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:33 nativespace-cdp sudo[825224]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:34 nativespace-cdp sudo[825227]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:05:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:34 nativespace-cdp sudo[825235]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:05:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:34 nativespace-cdp sudo[825238]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:05:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:34 nativespace-cdp sudo[825241]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:05:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:34 nativespace-cdp sudo[825244]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:05:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:34 nativespace-cdp sudo[825247]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:05:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:34 nativespace-cdp sudo[825250]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/irvinekilmarnockpresbytery.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:35 nativespace-cdp sudo[825253]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/irvinekilmarnockpresbytery.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:35 nativespace-cdp sudo[825257]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/isleofwi/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:36 nativespace-cdp sudo[825260]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/isleofwi/public_html/wp-content
Sep  1 05:05:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:36 nativespace-cdp sudo[825264]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/isleofwi/public_html/wp-config.php
Sep  1 05:05:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:36 nativespace-cdp sudo[825267]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/isleofwi/public_html/.wp-toolkit-ignore
Sep  1 05:05:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:36 nativespace-cdp sudo[825270]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/isleofwightguesthouse.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:36 nativespace-cdp sudo[825273]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/isleofwightguesthouse.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:36 nativespace-cdp sudo[825276]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:36 nativespace-cdp sudo[825279]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:36 nativespace-cdp sudo[825282]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/jarvisin/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:36 nativespace-cdp sudo[825285]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/jennimil/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:37 nativespace-cdp sudo[825288]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jennimil/public_html/wp-content
Sep  1 05:05:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:37 nativespace-cdp sudo[825293]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jennimil/public_html/wp-config.php
Sep  1 05:05:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:37 nativespace-cdp sudo[825296]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jennimil/public_html/.wp-toolkit-ignore
Sep  1 05:05:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:37 nativespace-cdp sudo[825299]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/gilpin/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:37 nativespace-cdp sudo[825302]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/jlive.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:37 nativespace-cdp sudo[825305]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/jlive.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:37 nativespace-cdp sudo[825308]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/jonhartl/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:38 nativespace-cdp sudo[825311]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jonhartl/public_html/wp-content
Sep  1 05:05:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:38 nativespace-cdp sudo[825315]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jonhartl/public_html/wp-config.php
Sep  1 05:05:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:38 nativespace-cdp sudo[825318]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jonhartl/public_html/../wp-config.php
Sep  1 05:05:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:38 nativespace-cdp sudo[825321]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/joomla -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:38 nativespace-cdp sudo[825324]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bemadonn/public_html/justbengals.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:38 nativespace-cdp sudo[825327]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bemadonn/public_html/justbengals.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:38 nativespace-cdp sudo[825330]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/kategilpin/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:39 nativespace-cdp sudo[825334]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/katieclark.me.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:39 nativespace-cdp sudo[825341]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/katieclark.me.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:39 nativespace-cdp sudo[825344]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/kess2012.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:40 nativespace-cdp sudo[825347]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/kess2012.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:40 nativespace-cdp sudo[825352]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/kidderminster -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:40 nativespace-cdp sudo[825355]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/wp-content
Sep  1 05:05:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:40 nativespace-cdp sudo[825358]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/wp-config.php
Sep  1 05:05:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:40 nativespace-cdp sudo[825361]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/.wp-toolkit-ignore
Sep  1 05:05:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:40 nativespace-cdp sudo[825364]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/seftvta/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:41 nativespace-cdp sudo[825367]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/jalbum/jeremy/public_html/Koro -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:41 nativespace-cdp sudo[825372]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ladburyp/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825375]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/old/wp-content
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825445]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/old/wp-config.php
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825448]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/old/.wp-toolkit-ignore
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825452]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/wp-content
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825456]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/wp-config.php
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825459]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/.wp-toolkit-ignore
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825466]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/wp-content
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825470]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/wp-config.php
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825474]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/.wp-toolkit-ignore
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825480]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lakesan1/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825485]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbscrmod/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825493]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825500]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ledburyfoodbank.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825508]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ledburyfoodbank.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825511]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/leereyn1/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:44 nativespace-cdp sudo[825514]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825517]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825523]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825526]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825529]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825532]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825535]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825538]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825541]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825544]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825547]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825550]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825553]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825556]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825559]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825562]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825566]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825569]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825572]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825575]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825578]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825581]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  1 05:05:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:47 nativespace-cdp sudo[825584]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  1 05:05:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:48 nativespace-cdp sudo[825587]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  1 05:05:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:48 nativespace-cdp sudo[825590]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/legotest -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825593]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legotest/wp-content
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825603]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legotest/wp-config.php
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825606]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legotest/.wp-toolkit-ignore
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825609]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/leicester -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825612]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/wp-content
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825616]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/wp-config.php
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825619]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/.wp-toolkit-ignore
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825622]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/leigh -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825625]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/wp-content
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825628]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/wp-config.php
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825631]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/.wp-toolkit-ignore
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825634]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/leyland -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825637]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/wp-content
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825640]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/wp-config.php
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825643]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/.wp-toolkit-ignore
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825646]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/lichfield -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825649]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/wp-content
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825652]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/wp-config.php
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825655]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/.wp-toolkit-ignore
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:50 nativespace-cdp sudo[825658]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lkpier/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825661]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lkpier/public_html/wp-content
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825667]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lkpier/public_html/wp-config.php
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825670]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lkpier/public_html/.wp-toolkit-ignore
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825673]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oubpgvbx/public_html/link -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825676]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/live -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825679]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-services.co.uk/live -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825682]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeinventories.co.uk/live -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825685]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/lochard.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825688]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/lochard.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825691]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/lochard.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825694]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/lochard.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:51 nativespace-cdp sudo[825697]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:52 nativespace-cdp sudo[825700]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/wp-content
Sep  1 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:52 nativespace-cdp sudo[825704]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/wp-config.php
Sep  1 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:52 nativespace-cdp sudo[825707]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/.wp-toolkit-ignore
Sep  1 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:52 nativespace-cdp sudo[825710]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:52 nativespace-cdp sudo[825713]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/wp-content
Sep  1 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:52 nativespace-cdp sudo[825716]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/wp-config.php
Sep  1 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:52 nativespace-cdp sudo[825719]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/.wp-toolkit-ignore
Sep  1 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:52 nativespace-cdp sudo[825722]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/loudounchurch.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:53 nativespace-cdp sudo[825726]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/loudounchurch.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:53 nativespace-cdp sudo[825733]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/loughborough -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:53 nativespace-cdp sudo[825737]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/wp-content
Sep  1 05:05:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:53 nativespace-cdp sudo[825740]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/wp-config.php
Sep  1 05:05:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:53 nativespace-cdp sudo[825743]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/.wp-toolkit-ignore
Sep  1 05:05:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:53 nativespace-cdp sudo[825746]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/legorobotclub/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825749]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/wp-content
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825761]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/wp-config.php
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825764]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/.wp-toolkit-ignore
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825767]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/macclesfield -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825770]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/wp-content
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825773]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/wp-config.php
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825776]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/.wp-toolkit-ignore
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825779]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/maflemin/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825782]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/magichat/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825785]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/manchester -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825791]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/wp-content
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825803]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/wp-config.php
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825820]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/.wp-toolkit-ignore
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825835]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/mansfield -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825844]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/wp-content
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825847]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/wp-config.php
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825850]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/.wp-toolkit-ignore
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825853]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/david/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825857]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/markward/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825860]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/martsblo/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:56 nativespace-cdp sudo[825863]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/mcdermos/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825867]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/wp-content
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825870]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/wp-config.php
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825873]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/.wp-toolkit-ignore
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825876]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision_bak/wp-content
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825879]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision_bak/wp-config.php
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825882]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision_bak/../wp-config.php
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825885]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision_bak/../wp-includes
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825888]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sam/wp-content
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825891]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sam/wp-config.php
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825894]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sam/../wp-config.php
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825897]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sam/../wp-includes
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825901]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/samco/wp-content
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825904]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/samco/wp-config.php
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825907]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/samco/.wp-toolkit-ignore
Sep  1 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:57 nativespace-cdp sudo[825910]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-content
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825914]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-config.php
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825917]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/.wp-toolkit-ignore
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825920]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/wp-content
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825923]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/wp-config.php
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825926]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/.wp-toolkit-ignore
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825929]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/mcleanforth.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825932]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/mcleanforth.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825935]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/media/mediapeople.tv -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825938]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/megacards/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825941]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/middleeast-training.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825944]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/middleeast-training.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825947]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/midlands -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825950]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/wp-content
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825953]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/wp-config.php
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825956]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/.wp-toolkit-ignore
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:58 nativespace-cdp sudo[825959]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:59 nativespace-cdp sudo[825962]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/wp-content
Sep  1 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:59 nativespace-cdp sudo[825967]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/wp-config.php
Sep  1 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:59 nativespace-cdp sudo[825970]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/.wp-toolkit-ignore
Sep  1 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:59 nativespace-cdp sudo[825973]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/wp-content
Sep  1 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:59 nativespace-cdp sudo[825976]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/wp-config.php
Sep  1 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:59 nativespace-cdp sudo[825981]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/.wp-toolkit-ignore
Sep  1 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:59 nativespace-cdp sudo[825984]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/missfoxglove.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:59 nativespace-cdp sudo[825988]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/modelsofdiversity.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:05:59 nativespace-cdp sudo[825991]: pam_unix(sudo:session): session closed for user root
Sep  1 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/modelsofdiversity.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:00 nativespace-cdp sudo[825994]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/mod2 -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[825998]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/modelsofdiversity.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826005]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/modelsofdiversity.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826008]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/mod2 -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826011]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/monmouthmt.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826014]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/monmouthmt.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826017]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/stagingerris/public_html/montel.stagingerris.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826020]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html/moonmousecreative.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826023]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html/moonmousecreative.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826026]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/moraycoastescapes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826029]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/moraycoastescapes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826036]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/jalbum/jeremy/public_html/MP40 -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826046]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/martsblo/public_html/mrgreensuniverse.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:01 nativespace-cdp sudo[826049]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/muchbirchparish.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:02 nativespace-cdp sudo[826052]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/muchbirchparish.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:02 nativespace-cdp sudo[826055]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/musorguk/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:03 nativespace-cdp sudo[826059]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/musorguk/public_html/teapot/wp-content
Sep  1 05:06:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:03 nativespace-cdp sudo[826066]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/musorguk/public_html/teapot/wp-config.php
Sep  1 05:06:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:03 nativespace-cdp sudo[826069]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/musorguk/public_html/teapot/.wp-toolkit-ignore
Sep  1 05:06:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:03 nativespace-cdp sudo[826072]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/my -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:03 nativespace-cdp sudo[826075]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nativene/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:03 nativespace-cdp sudo[826078]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nstriton/public_html/nativespace-triton.ns-triton.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:03 nativespace-cdp sudo[826082]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:07 nativespace-cdp sudo[826085]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/ndpwesthampstead.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:07 nativespace-cdp sudo[826095]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/ndpwesthampstead.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:07 nativespace-cdp sudo[826098]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/newnhamstpetersschool.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:07 nativespace-cdp sudo[826101]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/newnhamstpetersschool.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:07 nativespace-cdp sudo[826104]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/newstoda/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:08 nativespace-cdp sudo[826107]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/newstoda/public_html/wp-content
Sep  1 05:06:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:08 nativespace-cdp sudo[826114]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/newstoda/public_html/wp-config.php
Sep  1 05:06:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:08 nativespace-cdp sudo[826117]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/newstoda/public_html/.wp-toolkit-ignore
Sep  1 05:06:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:08 nativespace-cdp sudo[826120]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ninejimm/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:09 nativespace-cdp sudo[826123]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ninejimm/public_html/wordpress/wp-content
Sep  1 05:06:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:09 nativespace-cdp sudo[826131]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ninejimm/public_html/wordpress/wp-config.php
Sep  1 05:06:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:09 nativespace-cdp sudo[826134]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ninejimm/public_html/wordpress/.wp-toolkit-ignore
Sep  1 05:06:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:09 nativespace-cdp sudo[826137]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nomistakes/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826140]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/northshoresoftware.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826166]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/northshoresoftware.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826169]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/northwest -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826172]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/wp-content
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826175]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/wp-config.php
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826178]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/.wp-toolkit-ignore
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826181]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/nottingham -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826184]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/wp-content
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826187]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/wp-config.php
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826190]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/.wp-toolkit-ignore
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:21 nativespace-cdp sudo[826193]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nove/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826196]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nove/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826200]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nscdp/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826203]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nsceres/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826206]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nstriton/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826209]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/nuedesign.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826212]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/nuedesign.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826215]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/nuneaton -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826218]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/wp-content
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826221]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/wp-config.php
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826224]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/.wp-toolkit-ignore
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826227]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/oddleberry.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826230]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/wp-content
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826233]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/wp-config.php
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826236]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/.wp-toolkit-ignore
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826239]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/oldham -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826242]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/wp-content
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826245]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/wp-config.php
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826248]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/.wp-toolkit-ignore
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:22 nativespace-cdp sudo[826251]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826254]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826258]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826261]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826264]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826267]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826270]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826273]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/onlycont/onlycontents.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826276]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/onlycont/onlycontents.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826279]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/outdoorc/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826282]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/outdoorc/public_html/wp-content
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826285]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/outdoorc/public_html/wp-config.php
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826288]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/outdoorc/public_html/.wp-toolkit-ignore
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826291]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/oxfraud -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826294]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/oxfraud2 -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:23 nativespace-cdp sudo[826297]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/foods/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:25 nativespace-cdp sudo[826300]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pars/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:26 nativespace-cdp sudo[826311]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/alexadmin/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:26 nativespace-cdp sudo[826317]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826320]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-content
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826331]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-config.php
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826334]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/.wp-toolkit-ignore
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826337]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/mausblack.co.uk/wp-content
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826340]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/mausblack.co.uk/wp-config.php
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826343]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/mausblack.co.uk/.wp-toolkit-ignore
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826346]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/pmc-working/wp-content
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826349]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/pmc-working/wp-config.php
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826352]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/pmc-working/.wp-toolkit-ignore
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826355]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/sibylnutmeg/wp-content
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826358]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/sibylnutmeg/wp-config.php
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826361]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/sibylnutmeg/.wp-toolkit-ignore
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826364]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/test_cushion/wp-content
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826367]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/test_cushion/wp-config.php
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826370]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/test_cushion/.wp-toolkit-ignore
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826373]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-content
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826376]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-config.php
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826379]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/.wp-toolkit-ignore
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826382]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/wp-content
Sep  1 05:06:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:31 nativespace-cdp sudo[826385]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/wp-config.php
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826388]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/.wp-toolkit-ignore
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826391]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/rubbishchristmas/wp-content
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826394]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/rubbishchristmas/wp-config.php
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826397]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/rubbishchristmas/.wp-toolkit-ignore
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826400]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/philmcph/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826403]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/philmcph/public_html/wp-content
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826406]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/philmcph/public_html/wp-config.php
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826409]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/philmcph/public_html/.wp-toolkit-ignore
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826413]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/photos.leadbetter.cc -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826416]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/photos.leadbetter.cc -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826419]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/php -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:32 nativespace-cdp sudo[826422]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826425]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826430]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826433]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826436]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826439]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826442]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826445]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sshd[826450]: Connection closed by 159.100.136.21 port 54832 [preauth]
Sep  1 05:06:33 nativespace-cdp sudo[826448]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826454]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826457]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826460]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826463]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826466]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:33 nativespace-cdp sudo[826469]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826472]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826477]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826480]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826483]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826486]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826490]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826493]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-ne.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826496]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-services.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826499]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826502]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826506]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826509]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826512]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826515]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826518]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:34 nativespace-cdp sudo[826521]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826524]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826527]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826530]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826533]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826536]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826539]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826542]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-services.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826545]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe.pro -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826548]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe.pro -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826551]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe.services -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826554]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826557]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826560]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826563]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe.services -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826566]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826570]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826573]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826576]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/www.pinstripefranchise.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826579]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/www.pinstripefranchise.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:35 nativespace-cdp sudo[826582]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeinventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826585]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826589]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826593]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826596]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826599]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826602]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826605]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826608]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826611]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826616]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:36 nativespace-cdp sudo[826619]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826622]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826625]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826628]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826631]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeinventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826634]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeoffice.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826637]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeoffice.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826640]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826643]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826646]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826649]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826652]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826655]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826658]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:37 nativespace-cdp sudo[826661]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826664]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826668]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826671]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826674]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826677]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826680]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826683]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826686]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826689]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826692]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826695]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826698]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826701]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826704]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeutilities.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826707]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeutilities.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:38 nativespace-cdp sudo[826711]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/fancydresspiratecostumes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826714]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-ne.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826717]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/portfolio -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826720]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/privatelandlordservices.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826723]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/privatelandlordservices.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826726]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826729]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/emma.care -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826733]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/emma.care -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826736]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ralphbarnes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826739]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ralphbarnes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826742]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/randomclub.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826745]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/randomclub.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826748]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826752]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826755]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/redcaffeine.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826758]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/redcaffeine.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826761]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/redziller.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826764]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/redziller.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826767]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/reliable/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:39 nativespace-cdp sudo[826770]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ptkxhsbt/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:43 nativespace-cdp sudo[826773]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826785]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/rhinoinstalls.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826791]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/rhinoinstalls.net -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826794]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/rhinoinstalls.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826797]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/rhinoinstalls.net -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826800]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ultbcrra/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826803]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ulsukarm/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826806]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ulsukarm/public_html/wp-content
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826809]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/rochdale -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826812]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/wp-content
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826815]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/wp-config.php
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826818]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/.wp-toolkit-ignore
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826821]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/romaldki/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:45 nativespace-cdp sudo[826824]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ulsukarm/rtadevelopment.robert-taylor.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826827]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ulsukarm/rtadevelopment.robert-taylor.co.uk/wp-content
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826832]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ulsukarm/rtadevelopment.robert-taylor.co.uk/wp-config.php
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826835]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ulsukarm/rtadevelopment.robert-taylor.co.uk/.wp-toolkit-ignore
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826838]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/rugby -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826841]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/wp-content
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826844]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/wp-config.php
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826847]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/.wp-toolkit-ignore
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826850]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/sale -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826853]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/wp-content
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826856]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/wp-config.php
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826859]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/.wp-toolkit-ignore
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826862]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/salford -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826865]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/wp-content
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826868]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/wp-config.php
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826871]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/.wp-toolkit-ignore
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826874]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/mcdermos/public_html/sams -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826877]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-content
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826880]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-config.php
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826883]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/.wp-toolkit-ignore
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826886]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/branko/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:46 nativespace-cdp sudo[826889]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sarafoundation/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:50 nativespace-cdp sudo[826892]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/zebrapho/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:50 nativespace-cdp sudo[826903]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/savethealliance.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:50 nativespace-cdp sudo[826906]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/savethealliance.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:50 nativespace-cdp sudo[826909]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/schlossrothenburg.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:50 nativespace-cdp sudo[826912]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/schlossrothenburg.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826915]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/smrszyqg/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826918]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/severnvaledeanery.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826922]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/severnvaledeanery.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826925]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/severnwyema.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826928]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/severnwyema.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826931]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/shiningpyramid.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826934]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/shiningpyramid.org -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826937]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826940]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/sibtoncc -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826943]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/sibtoncc -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826946]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/sinclairmanagement -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826949]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/sindencox-art.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826952]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/sindencox-art.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826955]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sketchy/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:51 nativespace-cdp sudo[826959]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826962]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/skyfire-designs.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826965]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/skyfire-designs.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826968]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/smitrod.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826971]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/smitrod.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826974]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/solihull -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826977]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/wp-content
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826980]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/wp-config.php
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826983]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/.wp-toolkit-ignore
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826986]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ptkxhsbt/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826989]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hodgesonweb/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826992]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/mcdermos/public_html/sams/wp -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826995]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-content
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[826999]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-config.php
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[827002]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/.wp-toolkit-ignore
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:52 nativespace-cdp sudo[827005]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sosevalu/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:53 nativespace-cdp sudo[827008]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/southlon/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:53 nativespace-cdp sudo[827011]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/southwestbrassbandassociation.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:53 nativespace-cdp sudo[827014]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/southwestbrassbandassociation.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:53 nativespace-cdp sudo[827017]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/spectrum/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:53 nativespace-cdp sudo[827020]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/spectrum/public_html/blog/wp-content
Sep  1 05:06:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:53 nativespace-cdp sudo[827024]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/spectrum/public_html/blog/wp-config.php
Sep  1 05:06:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:53 nativespace-cdp sudo[827027]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/spectrum/public_html/blog/.wp-toolkit-ignore
Sep  1 05:06:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:53 nativespace-cdp sudo[827030]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/stafford -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:54 nativespace-cdp sudo[827033]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/wp-content
Sep  1 05:06:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:54 nativespace-cdp sudo[827036]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/wp-config.php
Sep  1 05:06:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:54 nativespace-cdp sudo[827039]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/.wp-toolkit-ignore
Sep  1 05:06:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:54 nativespace-cdp sudo[827042]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/legorobotclub/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:54 nativespace-cdp sudo[827045]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/wp-content
Sep  1 05:06:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:54 nativespace-cdp sudo[827048]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/wp-config.php
Sep  1 05:06:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:54 nativespace-cdp sudo[827051]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/.wp-toolkit-ignore
Sep  1 05:06:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:54 nativespace-cdp sudo[827054]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/stagingerris/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:56 nativespace-cdp sudo[827057]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/starwigs_2.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:56 nativespace-cdp sudo[827065]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/starwigs_2.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:56 nativespace-cdp sudo[827068]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/careers/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:06:56 nativespace-cdp sudo[827071]: pam_unix(sudo:session): session closed for user root
Sep  1 05:06:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bakery/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:06:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827074]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/careers/wp-content
Sep  1 05:07:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827084]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/careers/wp-config.php
Sep  1 05:07:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827087]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/careers/.wp-toolkit-ignore
Sep  1 05:07:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827091]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-content/themes/lcars/ctemp/steakbridie.careers/wp-content
Sep  1 05:07:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827095]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-content/themes/lcars/ctemp/steakbridie.careers/wp-config.php
Sep  1 05:07:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827098]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-content/themes/lcars/ctemp/steakbridie.careers/../wp-config.php
Sep  1 05:07:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827101]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-content
Sep  1 05:07:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827104]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-config.php
Sep  1 05:07:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827107]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/.wp-toolkit-ignore
Sep  1 05:07:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:00 nativespace-cdp sudo[827110]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/steakbridieme/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:01 nativespace-cdp sudo[827113]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lucy/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:01 nativespace-cdp sudo[827117]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/steve/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:01 nativespace-cdp sudo[827120]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/steve/public_html/wp-content
Sep  1 05:07:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:01 nativespace-cdp sudo[827124]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/steve/public_html/wp-config.php
Sep  1 05:07:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:01 nativespace-cdp sudo[827127]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/steve/public_html/.wp-toolkit-ignore
Sep  1 05:07:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:01 nativespace-cdp sudo[827130]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/foundation/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827133]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/foundation/public_html/wp-content
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827155]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/foundation/public_html/wp-config.php
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827158]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/foundation/public_html/.wp-toolkit-ignore
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827161]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hubmaster/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827164]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827167]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/stmichaelmitcheldean.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827171]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/stmichaelmitcheldean.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827175]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/stockport -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827178]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/wp-content
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827181]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/wp-config.php
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827184]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/.wp-toolkit-ignore
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827187]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/stoke -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827190]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/wp-content
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827193]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/wp-config.php
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827196]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/.wp-toolkit-ignore
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827199]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/store -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827202]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827205]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/strathard.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827210]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/strathard.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827213]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/stroud-deanery.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827216]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/stroud-deanery.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827219]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/stuartge/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:04 nativespace-cdp sudo[827222]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/sturgessbarns/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:05 nativespace-cdp sudo[827225]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/sturgessbarns/public_html/wp-content
Sep  1 05:07:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:05 nativespace-cdp sudo[827229]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/sturgessbarns/public_html/wp-config.php
Sep  1 05:07:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:05 nativespace-cdp sudo[827232]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/sturgessbarns/public_html/.wp-toolkit-ignore
Sep  1 05:07:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:05 nativespace-cdp sudo[827235]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/sturgessbarns.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:06 nativespace-cdp sudo[827238]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/wp-content
Sep  1 05:07:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:06 nativespace-cdp sudo[827243]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/wp-config.php
Sep  1 05:07:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:06 nativespace-cdp sudo[827246]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/.wp-toolkit-ignore
Sep  1 05:07:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:06 nativespace-cdp sudo[827249]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/sturgessbarns.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827252]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/wp-content
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827255]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/wp-config.php
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827258]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/.wp-toolkit-ignore
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827261]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/superbstuff.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827264]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/superbstuff.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827267]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/havantho/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827270]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/suttoncoldfield -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827273]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/wp-content
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827276]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/wp-config.php
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827279]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/.wp-toolkit-ignore
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827282]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/swbba.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827285]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/swbba.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827288]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/tamworth -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827291]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/wp-content
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827294]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/wp-config.php
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827297]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/.wp-toolkit-ignore
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827300]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/tdcc-online.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827303]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/tdcc-online.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827306]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/tenancy-deposit-scheme-scotland.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827309]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827312]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827316]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  1 05:07:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:07 nativespace-cdp sudo[827319]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827322]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827325]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827328]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827331]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/telford -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827334]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/wp-content
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827337]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/wp-config.php
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827340]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/.wp-toolkit-ignore
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827343]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/temperaturemonitor.info -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827346]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/temperaturemonitor.info -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827349]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/tenancy-deposit-scheme-scotland.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827352]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/ranxtertest -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827355]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/seftvta/public_html/test -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827358]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oubpgvbx/public_html/testlink -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827362]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/atestord/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827365]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/theblack/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827368]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/thedogmarket.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827371]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/thedogmarket.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827374]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/Thegooddogshop.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827377]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/Thegooddogshop.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827380]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/thegooddogshop.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827383]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/thegooddogshop.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827386]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hidden/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827389]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/hidden/public_html/wp-content
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827392]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/hidden/public_html/wp-config.php
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827395]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/hidden/public_html/../wp-config.php
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827398]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/seftvta/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:08 nativespace-cdp sudo[827401]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/leftie/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827405]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/leftie/public_html/wp-content
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827408]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/leftie/public_html/wp-config.php
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827411]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/leftie/public_html/../wp-config.php
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827414]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/thelordslarder.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827418]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/thelordslarder.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827421]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/thenorthseashore.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827424]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/thenorthseashore.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827427]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/thesevernforum.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827430]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/thesevernforum.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827434]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/still/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827437]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tigerlet/tigerestates.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827440]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tigerlet/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827443]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tigerlet/public_html/tigermanagement.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827446]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tigerlet/public_html/tigermetre.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827449]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tomandle/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827452]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/touchinventories.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827455]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/touchinventories.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827458]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/touchis.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827461]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/touchis.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827464]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/traddad -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827467]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827470]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827474]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827478]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/traddad -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827481]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827484]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827487]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:09 nativespace-cdp sudo[827491]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/trafford -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827494]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/wp-content
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827497]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/wp-config.php
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827500]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/.wp-toolkit-ignore
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827503]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/training-middleeast.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827506]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/training-middleeast.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827509]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html/traversingthehinterland.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827512]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-content
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827515]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-config.php
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827518]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/.wp-toolkit-ignore
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827521]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html/traversingthehinterland.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827524]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-content
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827527]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-config.php
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827530]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/.wp-toolkit-ignore
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:10 nativespace-cdp sudo[827533]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fortunaz/trendytiles.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:17 nativespace-cdp sudo[827536]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/wp-content
Sep  1 05:07:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:17 nativespace-cdp sudo[827557]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/wp-config.php
Sep  1 05:07:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:17 nativespace-cdp sudo[827560]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/.wp-toolkit-ignore
Sep  1 05:07:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:17 nativespace-cdp sudo[827563]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fortunaz/trendytiles.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:17 nativespace-cdp sudo[827566]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/wp-content
Sep  1 05:07:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:17 nativespace-cdp sudo[827569]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/wp-config.php
Sep  1 05:07:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:17 nativespace-cdp sudo[827572]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/.wp-toolkit-ignore
Sep  1 05:07:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:17 nativespace-cdp sudo[827575]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/trixietrapp -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827578]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/trixietrapp/wp-content
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827581]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/trixietrapp/wp-config.php
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827584]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/trixietrapp/.wp-toolkit-ignore
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827587]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/ukdrivingroads.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827590]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/ukdrivingroads.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827594]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/ranxter-upload -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827597]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/users -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827600]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vantagep/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827603]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827606]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/walkden -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827609]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/wp-content
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827612]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/wp-config.php
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827615]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/.wp-toolkit-ignore
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:18 nativespace-cdp sudo[827618]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/crrtipdl/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:24 nativespace-cdp sudo[827621]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/crrtipdl/public_html/wp-content
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827644]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/crrtipdl/public_html/wp-config.php
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827647]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/crrtipdl/public_html/.wp-toolkit-ignore
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827650]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/walsall -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827654]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/wp-content
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827657]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/wp-config.php
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827660]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/.wp-toolkit-ignore
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827663]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/warrington -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827666]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/wp-content
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827670]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/wp-config.php
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827673]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/.wp-toolkit-ignore
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827676]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/carsinyo/public_html/wavs.co -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827679]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/wp-content
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827682]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/wp-config.php
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827685]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/.wp-toolkit-ignore
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827688]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/webba.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827691]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/webba.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:25 nativespace-cdp sudo[827694]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827697]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lbhyisi/public_html/redziller.co.uk 2fe6b75f-1b22-45ab-928d-6683b177d2fe55/blog/wp-content
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827704]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lbhyisi/public_html/redziller.co.uk 2fe6b75f-1b22-45ab-928d-6683b177d2fe55/blog/wp-config.php
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827707]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lbhyisi/public_html/redziller.co.uk 2fe6b75f-1b22-45ab-928d-6683b177d2fe55/blog/.wp-toolkit-ignore
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827710]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/werefoxproductions.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827713]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/wp-content
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827716]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/wp-config.php
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827719]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/.wp-toolkit-ignore
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827722]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/werefoxproductions.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827725]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/wp-content
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827728]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/wp-config.php
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827731]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/.wp-toolkit-ignore
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:26 nativespace-cdp sudo[827734]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/what/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827737]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/widnes -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827740]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/wp-content
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827743]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/wp-config.php
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827746]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/.wp-toolkit-ignore
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827749]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/wigan -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827753]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/wp-content
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827756]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/wp-config.php
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827759]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/.wp-toolkit-ignore
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827762]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/wilsonleo.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827765]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/wilsonleo.com -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827768]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827771]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827774]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/outdoorc/public_html/windkatcowls.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827777]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/windwhistlewarren.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827780]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/windwhistlewarren.org.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827783]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/winsfordhouseproduce.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827786]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/winsfordhouseproduce.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827789]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/wolverhampton -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827792]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/wp-content
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827795]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/wp-config.php
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827798]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/.wp-toolkit-ignore
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827801]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/worcester -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827804]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/wp-content
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827807]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/wp-config.php
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827810]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/.wp-toolkit-ignore
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827813]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/martsblo/public_html/wordpress-website-developer.co.uk -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827816]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/zebrapho/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827819]: pam_unix(sudo:session): session closed for user root
Sep  1 05:07:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/zebrapho/public_html -type d -name wp-includes -printf '%h\0'
Sep  1 05:07:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:07:27 nativespace-cdp sudo[827822]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:54 nativespace-cdp sudo[828296]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:54 nativespace-cdp sudo[828299]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:54 nativespace-cdp sudo[828302]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:54 nativespace-cdp sudo[828308]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:57 nativespace-cdp sudo[828311]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 05:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:57 nativespace-cdp sudo[828320]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 05:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:57 nativespace-cdp sudo[828323]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 05:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:57 nativespace-cdp sudo[828326]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 05:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:57 nativespace-cdp sudo[828329]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 05:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:57 nativespace-cdp sudo[828332]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 05:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:57 nativespace-cdp sudo[828337]: pam_unix(sudo:session): session closed for user root
Sep  1 05:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 05:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:09:59 nativespace-cdp sudo[828344]: pam_unix(sudo:session): session closed for user root
Sep  1 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:10:00 nativespace-cdp sudo[828351]: pam_unix(sudo:session): session closed for user root
Sep  1 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=still user-2=agproduc user-3=leereyn1 user-4=stephani user-5=jarvisin user-6=hodgesonweb user-7=theblack user-8=spectrum user-9=ulsukarm user-10=booff user-11=markward user-12=foundation user-13=maflemin user-14=lbscrmod user-15=athenare user-16=connect9 user-17=vantagep user-18=lbhyisi user-19=hhdugcor user-20=magichat user-21=martsblo user-22=ptkxhsbt user-23=dickemery123 user-24=wilsonsw user-25=musorguk user-26=megacards user-27=brmrjxl user-28=lakesan1 user-29=sarafoundation user-30=atestord user-31=strathar user-32=ianrayne user-33=accooper user-34=thqkgnbz user-35=connectedshoppin user-36=elecleis user-37=milloyco user-38=gilpin user-39=carsinyo user-40=fetch user-41=hubmaster user-42=putterfi user-43=costestimatorco user-44=firstrel user-45=clarkass user-46=southlon user-47=highlegh
Sep  1 05:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=firstred user-49=firstres user-50=jonhartl user-51=seftvta user-52=ultbcrra user-53=coursemc user-54=opaiscyx user-55=askhform user-56=stuartge user-57=innovat1 user-58=nativene user-59=alexadmin user-60=skyfirec user-61=bedfords user-62=bemadonn user-63=ggaaorgu user-64=belle user-65=newstoda user-66=brighto1 user-67=nstriton user-68=battlere user-69=oneoarco user-70=firstre2 user-71=vivienn1 user-72=eatspam user-73=darkstar user-74=beauty user-75=dhyana user-76=burydropin user-77=fawcettd user-78=nsceres user-79=zebrapho user-80=bwppodcast user-81=steve user-82=sibtoncc user-83=asandcoc user-84=hirefootballgame user-85=courseme user-86=eugincou user-87=reliable user-88=ninejimm user-89=cathski user-90=cambria1 user-91=paulmca1 user-92=pugwash user-93=howardon user-94=cwsocial user-95=isleofwi user-96=smrszyqg user-97=barbersh user-98=tigerlet user-99=hidden user-100=nomistakes user-101=health2045
Sep  1 05:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=fortunaz user-103=leftie user-104=foods user-105=putterfc user-106=nscdp user-107=ctedorgu user-108=philmcph user-109=firstre5 user-110=steakbridieme user-111=donnychicago user-112=lkpier user-113=branko user-114=ranxterc user-115=outdoorc user-116=hodgsonmail user-117=romaldki user-118=attlebor user-119=lucy user-120=onlycont user-121=mcdermos user-122=chrisdal user-123=careers user-124=nbhavers user-125=david user-126=pars user-127=tomandle user-128=jennimil user-129=kategilpin user-130=ladburyp user-131=dancinggardener user-132=stagingerris user-133=design user-134=what user-135=oubpgvbx user-136=tstardom user-137=nvihkvu user-138=sketchy user-139=cath user-140=havantho user-141=sosevalu user-142=crrtipdl user-143=bakery user-144=nove user-145=boldover feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 05:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:10:01 nativespace-cdp sudo[828355]: pam_unix(sudo:session): session closed for user root
Sep  1 05:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 05:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:10:01 nativespace-cdp sudo[828436]: pam_unix(sudo:session): session closed for user root
Sep  1 05:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FTQxELlNV2BdvoAy.~
Sep  1 05:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:10:01 nativespace-cdp sudo[828443]: pam_unix(sudo:session): session closed for user root
Sep  1 05:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FTQxELlNV2BdvoAy.~'
Sep  1 05:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:10:02 nativespace-cdp sudo[828452]: pam_unix(sudo:session): session closed for user root
Sep  1 05:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FTQxELlNV2BdvoAy.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 05:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:10:02 nativespace-cdp sudo[828457]: pam_unix(sudo:session): session closed for user root
Sep  1 05:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 05:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:10:02 nativespace-cdp sudo[828461]: pam_unix(sudo:session): session closed for user root
Sep  1 05:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 05:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:10:07 nativespace-cdp sudo[828515]: pam_unix(sudo:session): session closed for user root
Sep  1 05:10:13 nativespace-cdp sshd[828534]: Invalid user bitrix from 89.183.192.90 port 50491
Sep  1 05:10:13 nativespace-cdp sshd[828534]: input_userauth_request: invalid user bitrix [preauth]
Sep  1 05:10:13 nativespace-cdp sshd[828534]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:10:13 nativespace-cdp sshd[828534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.183.192.90
Sep  1 05:10:14 nativespace-cdp sshd[828534]: Failed password for invalid user bitrix from 89.183.192.90 port 50491 ssh2
Sep  1 05:10:14 nativespace-cdp sshd[828534]: Received disconnect from 89.183.192.90 port 50491:11: Bye Bye [preauth]
Sep  1 05:10:14 nativespace-cdp sshd[828534]: Disconnected from 89.183.192.90 port 50491 [preauth]
Sep  1 05:11:33 nativespace-cdp sshd[828858]: Connection closed by 159.100.136.21 port 36590 [preauth]
Sep  1 05:11:46 nativespace-cdp sshd[828895]: Invalid user pypo from 141.95.162.177 port 46234
Sep  1 05:11:46 nativespace-cdp sshd[828895]: input_userauth_request: invalid user pypo [preauth]
Sep  1 05:11:46 nativespace-cdp sshd[828895]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:11:46 nativespace-cdp sshd[828895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.95.162.177
Sep  1 05:11:48 nativespace-cdp sshd[828895]: Failed password for invalid user pypo from 141.95.162.177 port 46234 ssh2
Sep  1 05:11:48 nativespace-cdp sshd[828895]: Received disconnect from 141.95.162.177 port 46234:11: Bye Bye [preauth]
Sep  1 05:11:48 nativespace-cdp sshd[828895]: Disconnected from 141.95.162.177 port 46234 [preauth]
Sep  1 05:12:12 nativespace-cdp sshd[829130]: Invalid user pypo from 168.167.228.123 port 15669
Sep  1 05:12:12 nativespace-cdp sshd[829130]: input_userauth_request: invalid user pypo [preauth]
Sep  1 05:12:12 nativespace-cdp sshd[829130]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:12:12 nativespace-cdp sshd[829130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.167.228.123
Sep  1 05:12:15 nativespace-cdp sshd[829130]: Failed password for invalid user pypo from 168.167.228.123 port 15669 ssh2
Sep  1 05:12:15 nativespace-cdp sshd[829130]: Received disconnect from 168.167.228.123 port 15669:11: Bye Bye [preauth]
Sep  1 05:12:15 nativespace-cdp sshd[829130]: Disconnected from 168.167.228.123 port 15669 [preauth]
Sep  1 05:13:03 nativespace-cdp sshd[829257]: Invalid user tv from 171.244.37.97 port 57606
Sep  1 05:13:03 nativespace-cdp sshd[829257]: input_userauth_request: invalid user tv [preauth]
Sep  1 05:13:03 nativespace-cdp sshd[829257]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:13:03 nativespace-cdp sshd[829257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.37.97
Sep  1 05:13:04 nativespace-cdp sshd[829257]: Failed password for invalid user tv from 171.244.37.97 port 57606 ssh2
Sep  1 05:13:05 nativespace-cdp sshd[829257]: Received disconnect from 171.244.37.97 port 57606:11: Bye Bye [preauth]
Sep  1 05:13:05 nativespace-cdp sshd[829257]: Disconnected from 171.244.37.97 port 57606 [preauth]
Sep  1 05:14:59 nativespace-cdp sshd[829531]: Invalid user zcx from 141.95.162.177 port 44502
Sep  1 05:14:59 nativespace-cdp sshd[829531]: input_userauth_request: invalid user zcx [preauth]
Sep  1 05:14:59 nativespace-cdp sshd[829531]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:14:59 nativespace-cdp sshd[829531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.95.162.177
Sep  1 05:15:01 nativespace-cdp sshd[829531]: Failed password for invalid user zcx from 141.95.162.177 port 44502 ssh2
Sep  1 05:15:01 nativespace-cdp sshd[829531]: Received disconnect from 141.95.162.177 port 44502:11: Bye Bye [preauth]
Sep  1 05:15:01 nativespace-cdp sshd[829531]: Disconnected from 141.95.162.177 port 44502 [preauth]
Sep  1 05:15:13 nativespace-cdp sshd[829697]: Invalid user dreambox from 89.183.192.90 port 22570
Sep  1 05:15:13 nativespace-cdp sshd[829697]: input_userauth_request: invalid user dreambox [preauth]
Sep  1 05:15:13 nativespace-cdp sshd[829697]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:15:13 nativespace-cdp sshd[829697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.183.192.90
Sep  1 05:15:16 nativespace-cdp sshd[829697]: Failed password for invalid user dreambox from 89.183.192.90 port 22570 ssh2
Sep  1 05:15:16 nativespace-cdp sshd[829697]: Received disconnect from 89.183.192.90 port 22570:11: Bye Bye [preauth]
Sep  1 05:15:16 nativespace-cdp sshd[829697]: Disconnected from 89.183.192.90 port 22570 [preauth]
Sep  1 05:15:35 nativespace-cdp sshd[829752]: Invalid user testuser from 168.167.228.123 port 15670
Sep  1 05:15:35 nativespace-cdp sshd[829752]: input_userauth_request: invalid user testuser [preauth]
Sep  1 05:15:35 nativespace-cdp sshd[829752]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:15:35 nativespace-cdp sshd[829752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.167.228.123
Sep  1 05:15:37 nativespace-cdp sshd[829752]: Failed password for invalid user testuser from 168.167.228.123 port 15670 ssh2
Sep  1 05:15:37 nativespace-cdp sshd[829752]: Received disconnect from 168.167.228.123 port 15670:11: Bye Bye [preauth]
Sep  1 05:15:37 nativespace-cdp sshd[829752]: Disconnected from 168.167.228.123 port 15670 [preauth]
Sep  1 05:15:43 nativespace-cdp sshd[829815]: Invalid user kafka from 141.95.162.177 port 60064
Sep  1 05:15:43 nativespace-cdp sshd[829815]: input_userauth_request: invalid user kafka [preauth]
Sep  1 05:15:43 nativespace-cdp sshd[829815]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:15:43 nativespace-cdp sshd[829815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.95.162.177
Sep  1 05:15:45 nativespace-cdp sshd[829815]: Failed password for invalid user kafka from 141.95.162.177 port 60064 ssh2
Sep  1 05:15:45 nativespace-cdp sshd[829815]: Received disconnect from 141.95.162.177 port 60064:11: Bye Bye [preauth]
Sep  1 05:15:45 nativespace-cdp sshd[829815]: Disconnected from 141.95.162.177 port 60064 [preauth]
Sep  1 05:16:23 nativespace-cdp sshd[830030]: Invalid user k8s from 171.244.37.97 port 47876
Sep  1 05:16:23 nativespace-cdp sshd[830030]: input_userauth_request: invalid user k8s [preauth]
Sep  1 05:16:23 nativespace-cdp sshd[830030]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:16:23 nativespace-cdp sshd[830030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.37.97
Sep  1 05:16:25 nativespace-cdp sshd[830037]: Invalid user k8s from 89.183.192.90 port 55011
Sep  1 05:16:25 nativespace-cdp sshd[830037]: input_userauth_request: invalid user k8s [preauth]
Sep  1 05:16:25 nativespace-cdp sshd[830037]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:16:25 nativespace-cdp sshd[830037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.183.192.90
Sep  1 05:16:25 nativespace-cdp sshd[830030]: Failed password for invalid user k8s from 171.244.37.97 port 47876 ssh2
Sep  1 05:16:25 nativespace-cdp sshd[830030]: Received disconnect from 171.244.37.97 port 47876:11: Bye Bye [preauth]
Sep  1 05:16:25 nativespace-cdp sshd[830030]: Disconnected from 171.244.37.97 port 47876 [preauth]
Sep  1 05:16:27 nativespace-cdp sshd[830037]: Failed password for invalid user k8s from 89.183.192.90 port 55011 ssh2
Sep  1 05:16:27 nativespace-cdp sshd[830037]: Received disconnect from 89.183.192.90 port 55011:11: Bye Bye [preauth]
Sep  1 05:16:27 nativespace-cdp sshd[830037]: Disconnected from 89.183.192.90 port 55011 [preauth]
Sep  1 05:16:29 nativespace-cdp sshd[830051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.167.228.123  user=root
Sep  1 05:16:29 nativespace-cdp sshd[830051]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 05:16:31 nativespace-cdp sshd[830051]: Failed password for root from 168.167.228.123 port 15671 ssh2
Sep  1 05:16:33 nativespace-cdp sshd[830117]: Connection closed by 159.100.136.21 port 46322 [preauth]
Sep  1 05:17:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 05:17:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 05:17:01 nativespace-cdp sudo[830188]: pam_unix(sudo:session): session closed for user root
Sep  1 05:17:18 nativespace-cdp sshd[830264]: Invalid user shang from 171.244.37.97 port 41992
Sep  1 05:17:18 nativespace-cdp sshd[830264]: input_userauth_request: invalid user shang [preauth]
Sep  1 05:17:18 nativespace-cdp sshd[830264]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:17:18 nativespace-cdp sshd[830264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.37.97
Sep  1 05:17:20 nativespace-cdp sshd[830264]: Failed password for invalid user shang from 171.244.37.97 port 41992 ssh2
Sep  1 05:17:20 nativespace-cdp sshd[830264]: Received disconnect from 171.244.37.97 port 41992:11: Bye Bye [preauth]
Sep  1 05:17:20 nativespace-cdp sshd[830264]: Disconnected from 171.244.37.97 port 41992 [preauth]
Sep  1 05:21:33 nativespace-cdp sshd[831240]: Connection closed by 159.100.136.21 port 56280 [preauth]
Sep  1 05:26:27 nativespace-cdp sshd[832479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.74.5.177  user=root
Sep  1 05:26:27 nativespace-cdp sshd[832479]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 05:26:29 nativespace-cdp sshd[832479]: Failed password for root from 185.74.5.177 port 40822 ssh2
Sep  1 05:26:29 nativespace-cdp sshd[832479]: Received disconnect from 185.74.5.177 port 40822:11: Bye Bye [preauth]
Sep  1 05:26:29 nativespace-cdp sshd[832479]: Disconnected from 185.74.5.177 port 40822 [preauth]
Sep  1 05:26:33 nativespace-cdp sshd[832492]: Connection closed by 159.100.136.21 port 38314 [preauth]
Sep  1 05:29:01 nativespace-cdp sshd[832877]: Invalid user limao from 124.62.232.81 port 60494
Sep  1 05:29:01 nativespace-cdp sshd[832877]: input_userauth_request: invalid user limao [preauth]
Sep  1 05:29:01 nativespace-cdp sshd[832877]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:29:01 nativespace-cdp sshd[832877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.62.232.81
Sep  1 05:29:02 nativespace-cdp sshd[832877]: Failed password for invalid user limao from 124.62.232.81 port 60494 ssh2
Sep  1 05:29:02 nativespace-cdp sshd[832877]: Received disconnect from 124.62.232.81 port 60494:11: Bye Bye [preauth]
Sep  1 05:29:02 nativespace-cdp sshd[832877]: Disconnected from 124.62.232.81 port 60494 [preauth]
Sep  1 05:31:33 nativespace-cdp sshd[833568]: Connection closed by 159.100.136.21 port 48362 [preauth]
Sep  1 05:34:24 nativespace-cdp sshd[834034]: Invalid user anonymous from 179.33.186.151 port 59073
Sep  1 05:34:24 nativespace-cdp sshd[834034]: input_userauth_request: invalid user anonymous [preauth]
Sep  1 05:34:24 nativespace-cdp sshd[834034]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:34:24 nativespace-cdp sshd[834034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.33.186.151
Sep  1 05:34:25 nativespace-cdp sshd[834034]: Failed password for invalid user anonymous from 179.33.186.151 port 59073 ssh2
Sep  1 05:34:25 nativespace-cdp sshd[834034]: Received disconnect from 179.33.186.151 port 59073:11: Bye Bye [preauth]
Sep  1 05:34:25 nativespace-cdp sshd[834034]: Disconnected from 179.33.186.151 port 59073 [preauth]
Sep  1 05:34:38 nativespace-cdp sshd[834069]: Invalid user Andrea from 124.62.232.81 port 34414
Sep  1 05:34:38 nativespace-cdp sshd[834069]: input_userauth_request: invalid user Andrea [preauth]
Sep  1 05:34:38 nativespace-cdp sshd[834069]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:34:38 nativespace-cdp sshd[834069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.62.232.81
Sep  1 05:34:40 nativespace-cdp sshd[834069]: Failed password for invalid user Andrea from 124.62.232.81 port 34414 ssh2
Sep  1 05:34:41 nativespace-cdp sshd[834069]: Received disconnect from 124.62.232.81 port 34414:11: Bye Bye [preauth]
Sep  1 05:34:41 nativespace-cdp sshd[834069]: Disconnected from 124.62.232.81 port 34414 [preauth]
Sep  1 05:34:52 nativespace-cdp sshd[834103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.74.5.177  user=root
Sep  1 05:34:52 nativespace-cdp sshd[834103]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 05:34:54 nativespace-cdp sshd[834103]: Failed password for root from 185.74.5.177 port 41486 ssh2
Sep  1 05:34:54 nativespace-cdp sshd[834103]: Received disconnect from 185.74.5.177 port 41486:11: Bye Bye [preauth]
Sep  1 05:34:54 nativespace-cdp sshd[834103]: Disconnected from 185.74.5.177 port 41486 [preauth]
Sep  1 05:35:09 nativespace-cdp su: pam_unix(su:session): session opened for user dickemery123 by (uid=0)
Sep  1 05:35:09 nativespace-cdp su[834284]: pam_unix(su:session): session closed for user dickemery123
Sep  1 05:35:24 nativespace-cdp sshd[834351]: Invalid user servis from 179.33.186.151 port 63712
Sep  1 05:35:24 nativespace-cdp sshd[834351]: input_userauth_request: invalid user servis [preauth]
Sep  1 05:35:24 nativespace-cdp sshd[834351]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:35:24 nativespace-cdp sshd[834351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.33.186.151
Sep  1 05:35:25 nativespace-cdp sshd[834351]: Failed password for invalid user servis from 179.33.186.151 port 63712 ssh2
Sep  1 05:35:25 nativespace-cdp sshd[834351]: Received disconnect from 179.33.186.151 port 63712:11: Bye Bye [preauth]
Sep  1 05:35:25 nativespace-cdp sshd[834351]: Disconnected from 179.33.186.151 port 63712 [preauth]
Sep  1 05:35:30 nativespace-cdp sshd[834374]: Invalid user developer from 124.62.232.81 port 39986
Sep  1 05:35:30 nativespace-cdp sshd[834374]: input_userauth_request: invalid user developer [preauth]
Sep  1 05:35:30 nativespace-cdp sshd[834374]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:35:30 nativespace-cdp sshd[834374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.62.232.81
Sep  1 05:35:31 nativespace-cdp sshd[834374]: Failed password for invalid user developer from 124.62.232.81 port 39986 ssh2
Sep  1 05:35:31 nativespace-cdp sshd[834374]: Received disconnect from 124.62.232.81 port 39986:11: Bye Bye [preauth]
Sep  1 05:35:31 nativespace-cdp sshd[834374]: Disconnected from 124.62.232.81 port 39986 [preauth]
Sep  1 05:35:37 nativespace-cdp sshd[834482]: Invalid user ne from 185.74.5.177 port 54924
Sep  1 05:35:37 nativespace-cdp sshd[834482]: input_userauth_request: invalid user ne [preauth]
Sep  1 05:35:37 nativespace-cdp sshd[834482]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:35:37 nativespace-cdp sshd[834482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.74.5.177
Sep  1 05:35:39 nativespace-cdp sshd[834482]: Failed password for invalid user ne from 185.74.5.177 port 54924 ssh2
Sep  1 05:35:39 nativespace-cdp sshd[834482]: Received disconnect from 185.74.5.177 port 54924:11: Bye Bye [preauth]
Sep  1 05:35:39 nativespace-cdp sshd[834482]: Disconnected from 185.74.5.177 port 54924 [preauth]
Sep  1 05:36:29 nativespace-cdp sshd[834813]: Invalid user sammy from 179.33.186.151 port 9529
Sep  1 05:36:29 nativespace-cdp sshd[834813]: input_userauth_request: invalid user sammy [preauth]
Sep  1 05:36:29 nativespace-cdp sshd[834813]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 05:36:29 nativespace-cdp sshd[834813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.33.186.151
Sep  1 05:36:31 nativespace-cdp sshd[834813]: Failed password for invalid user sammy from 179.33.186.151 port 9529 ssh2
Sep  1 05:36:31 nativespace-cdp sshd[834813]: Received disconnect from 179.33.186.151 port 9529:11: Bye Bye [preauth]
Sep  1 05:36:31 nativespace-cdp sshd[834813]: Disconnected from 179.33.186.151 port 9529 [preauth]
Sep  1 05:36:33 nativespace-cdp sshd[834851]: Connection closed by 159.100.136.21 port 58570 [preauth]
Sep  1 05:41:33 nativespace-cdp sshd[836168]: Connection closed by 159.100.136.21 port 40310 [preauth]
Sep  1 05:46:33 nativespace-cdp sshd[837218]: Connection closed by 159.100.136.21 port 50526 [preauth]
Sep  1 05:51:33 nativespace-cdp sshd[838250]: Connection closed by 159.100.136.21 port 60496 [preauth]
Sep  1 05:56:33 nativespace-cdp sshd[839448]: Connection closed by 159.100.136.21 port 42536 [preauth]
Sep  1 06:01:33 nativespace-cdp sshd[840639]: Connection closed by 159.100.136.21 port 52510 [preauth]
Sep  1 06:06:33 nativespace-cdp sshd[841650]: Connection closed by 159.100.136.21 port 34598 [preauth]
Sep  1 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:50 nativespace-cdp sudo[842260]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:50 nativespace-cdp sudo[842272]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:50 nativespace-cdp sudo[842277]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:50 nativespace-cdp sudo[842336]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 06:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:53 nativespace-cdp sudo[842351]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:53 nativespace-cdp sudo[842494]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:53 nativespace-cdp sudo[842499]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:53 nativespace-cdp sudo[842503]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:53 nativespace-cdp sudo[842508]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:53 nativespace-cdp sudo[842513]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:53 nativespace-cdp sudo[842519]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:55 nativespace-cdp sudo[842529]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:55 nativespace-cdp sudo[842536]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=fortunaz user-2=health2045 user-3=foods user-4=leftie user-5=putterfc user-6=nscdp user-7=ctedorgu user-8=philmcph user-9=steakbridieme user-10=firstre5 user-11=donnychicago user-12=lkpier user-13=isleofwi user-14=smrszyqg user-15=tigerlet user-16=barbersh user-17=hidden user-18=nomistakes user-19=ninejimm user-20=reliable user-21=cambria1 user-22=cathski user-23=pugwash user-24=howardon user-25=paulmca1 user-26=cwsocial user-27=hirefootballgame user-28=courseme user-29=eugincou user-30=sibtoncc user-31=asandcoc user-32=zebrapho user-33=bwppodcast user-34=steve user-35=burydropin user-36=fawcettd user-37=nsceres user-38=eatspam user-39=darkstar user-40=beauty user-41=dhyana user-42=nove user-43=boldover user-44=sosevalu user-45=crrtipdl user-46=bakery user-47=what user-48=oubpgvbx
Sep  1 06:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=tstardom user-50=nvihkvu user-51=sketchy user-52=cath user-53=havantho user-54=kategilpin user-55=ladburyp user-56=dancinggardener user-57=stagingerris user-58=design user-59=tomandle user-60=jennimil user-61=mcdermos user-62=chrisdal user-63=nbhavers user-64=careers user-65=pars user-66=david user-67=attlebor user-68=lucy user-69=onlycont user-70=branko user-71=outdoorc user-72=hodgsonmail user-73=ranxterc user-74=romaldki user-75=lakesan1 user-76=brmrjxl user-77=sarafoundation user-78=atestord user-79=strathar user-80=wilsonsw user-81=musorguk user-82=megacards user-83=martsblo user-84=ptkxhsbt user-85=dickemery123 user-86=lbhyisi user-87=hhdugcor user-88=magichat user-89=booff user-90=markward user-91=foundation user-92=maflemin user-93=lbscrmod user-94=athenare user-95=connect9 user-96=vantagep user-97=ulsukarm user-98=jarvisin user-99=hodgesonweb user-100=theblack user-101=spectrum user-102=still
Sep  1 06:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=agproduc user-104=leereyn1 user-105=stephani user-106=brighto1 user-107=nstriton user-108=battlere user-109=oneoarco user-110=firstre2 user-111=vivienn1 user-112=bedfords user-113=bemadonn user-114=ggaaorgu user-115=belle user-116=newstoda user-117=alexadmin user-118=skyfirec user-119=stuartge user-120=askhform user-121=innovat1 user-122=nativene user-123=firstres user-124=seftvta user-125=jonhartl user-126=ultbcrra user-127=coursemc user-128=opaiscyx user-129=costestimatorco user-130=firstrel user-131=clarkass user-132=southlon user-133=highlegh user-134=firstred user-135=elecleis user-136=gilpin user-137=milloyco user-138=carsinyo user-139=fetch user-140=hubmaster user-141=putterfi user-142=ianrayne user-143=accooper user-144=thqkgnbz user-145=connectedshoppin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 06:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:56 nativespace-cdp sudo[842543]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:56 nativespace-cdp sudo[842549]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-w47luYqTqZO5PoHm.~
Sep  1 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:56 nativespace-cdp sudo[842555]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-w47luYqTqZO5PoHm.~'
Sep  1 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:56 nativespace-cdp sudo[842559]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-w47luYqTqZO5PoHm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:56 nativespace-cdp sudo[842566]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:56 nativespace-cdp sudo[842571]: pam_unix(sudo:session): session closed for user root
Sep  1 06:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 06:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 06:09:58 nativespace-cdp sudo[842593]: pam_unix(sudo:session): session closed for user root
Sep  1 06:11:33 nativespace-cdp sshd[843088]: Connection closed by 159.100.136.21 port 44596 [preauth]
Sep  1 06:12:41 nativespace-cdp sshd[843254]: Invalid user odin from 159.203.110.93 port 48962
Sep  1 06:12:41 nativespace-cdp sshd[843254]: input_userauth_request: invalid user odin [preauth]
Sep  1 06:12:41 nativespace-cdp sshd[843254]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 06:12:41 nativespace-cdp sshd[843254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.110.93
Sep  1 06:12:44 nativespace-cdp sshd[843254]: Failed password for invalid user odin from 159.203.110.93 port 48962 ssh2
Sep  1 06:12:44 nativespace-cdp sshd[843254]: Received disconnect from 159.203.110.93 port 48962:11: Bye Bye [preauth]
Sep  1 06:12:44 nativespace-cdp sshd[843254]: Disconnected from 159.203.110.93 port 48962 [preauth]
Sep  1 06:14:03 nativespace-cdp sshd[843460]: Invalid user cye from 69.49.245.160 port 36704
Sep  1 06:14:03 nativespace-cdp sshd[843460]: input_userauth_request: invalid user cye [preauth]
Sep  1 06:14:03 nativespace-cdp sshd[843460]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 06:14:03 nativespace-cdp sshd[843460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.49.245.160
Sep  1 06:14:05 nativespace-cdp sshd[843460]: Failed password for invalid user cye from 69.49.245.160 port 36704 ssh2
Sep  1 06:14:05 nativespace-cdp sshd[843460]: Received disconnect from 69.49.245.160 port 36704:11: Bye Bye [preauth]
Sep  1 06:14:05 nativespace-cdp sshd[843460]: Disconnected from 69.49.245.160 port 36704 [preauth]
Sep  1 06:15:52 nativespace-cdp sshd[843923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.49.245.160  user=root
Sep  1 06:15:52 nativespace-cdp sshd[843923]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 06:15:54 nativespace-cdp sshd[843923]: Failed password for root from 69.49.245.160 port 52686 ssh2
Sep  1 06:15:54 nativespace-cdp sshd[843923]: Received disconnect from 69.49.245.160 port 52686:11: Bye Bye [preauth]
Sep  1 06:15:54 nativespace-cdp sshd[843923]: Disconnected from 69.49.245.160 port 52686 [preauth]
Sep  1 06:16:11 nativespace-cdp sshd[844118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.110.93  user=root
Sep  1 06:16:11 nativespace-cdp sshd[844118]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 06:16:14 nativespace-cdp sshd[844118]: Failed password for root from 159.203.110.93 port 54790 ssh2
Sep  1 06:16:14 nativespace-cdp sshd[844118]: Received disconnect from 159.203.110.93 port 54790:11: Bye Bye [preauth]
Sep  1 06:16:14 nativespace-cdp sshd[844118]: Disconnected from 159.203.110.93 port 54790 [preauth]
Sep  1 06:16:33 nativespace-cdp sshd[844174]: Connection closed by 159.100.136.21 port 54784 [preauth]
Sep  1 06:16:37 nativespace-cdp sshd[844181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.49.245.160  user=root
Sep  1 06:16:37 nativespace-cdp sshd[844181]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 06:16:38 nativespace-cdp sshd[844181]: Failed password for root from 69.49.245.160 port 46808 ssh2
Sep  1 06:16:38 nativespace-cdp sshd[844181]: Received disconnect from 69.49.245.160 port 46808:11: Bye Bye [preauth]
Sep  1 06:16:38 nativespace-cdp sshd[844181]: Disconnected from 69.49.245.160 port 46808 [preauth]
Sep  1 06:17:55 nativespace-cdp sshd[844392]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.110.93  user=root
Sep  1 06:17:55 nativespace-cdp sshd[844392]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 06:17:57 nativespace-cdp sshd[844392]: Failed password for root from 159.203.110.93 port 39636 ssh2
Sep  1 06:17:57 nativespace-cdp sshd[844392]: Received disconnect from 159.203.110.93 port 39636:11: Bye Bye [preauth]
Sep  1 06:17:57 nativespace-cdp sshd[844392]: Disconnected from 159.203.110.93 port 39636 [preauth]
Sep  1 06:19:46 nativespace-cdp sshd[844688]: Did not receive identification string from 199.45.154.135 port 33900
Sep  1 06:20:05 nativespace-cdp sshd[844699]: Connection closed by 199.45.154.135 port 40276 [preauth]
Sep  1 06:21:33 nativespace-cdp sshd[845214]: Connection closed by 159.100.136.21 port 36534 [preauth]
Sep  1 06:26:33 nativespace-cdp sshd[846459]: Connection closed by 159.100.136.21 port 46782 [preauth]
Sep  1 06:31:33 nativespace-cdp sshd[847604]: Connection closed by 159.100.136.21 port 56816 [preauth]
Sep  1 06:36:33 nativespace-cdp sshd[848677]: Connection closed by 159.100.136.21 port 38868 [preauth]
Sep  1 06:41:33 nativespace-cdp sshd[850131]: Connection closed by 159.100.136.21 port 48820 [preauth]
Sep  1 06:46:33 nativespace-cdp sshd[851122]: Connection closed by 159.100.136.21 port 59038 [preauth]
Sep  1 06:51:33 nativespace-cdp sshd[852218]: Connection closed by 159.100.136.21 port 40806 [preauth]
Sep  1 06:56:33 nativespace-cdp sshd[853449]: Connection closed by 159.100.136.21 port 50412 [preauth]
Sep  1 07:01:33 nativespace-cdp sshd[854576]: Connection closed by 159.100.136.21 port 60400 [preauth]
Sep  1 07:06:33 nativespace-cdp sshd[855704]: Connection closed by 159.100.136.21 port 42504 [preauth]
Sep  1 07:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 07:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:55 nativespace-cdp sudo[856531]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 07:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:55 nativespace-cdp sudo[856535]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 07:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:56 nativespace-cdp sudo[856540]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 07:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:56 nativespace-cdp sudo[856546]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 07:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:59 nativespace-cdp sudo[856552]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 07:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:59 nativespace-cdp sudo[856567]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 07:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:59 nativespace-cdp sudo[856572]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 07:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:59 nativespace-cdp sudo[856577]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 07:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:59 nativespace-cdp sudo[856582]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 07:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:59 nativespace-cdp sudo[856588]: pam_unix(sudo:session): session closed for user root
Sep  1 07:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 07:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:09:59 nativespace-cdp sudo[856593]: pam_unix(sudo:session): session closed for user root
Sep  1 07:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 07:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:10:02 nativespace-cdp sudo[856691]: pam_unix(sudo:session): session closed for user root
Sep  1 07:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 07:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:10:02 nativespace-cdp sudo[856703]: pam_unix(sudo:session): session closed for user root
Sep  1 07:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tstardom user-2=oubpgvbx user-3=what user-4=sketchy user-5=cath user-6=havantho user-7=nvihkvu user-8=ladburyp user-9=stagingerris user-10=dancinggardener user-11=kategilpin user-12=design user-13=nove user-14=boldover user-15=bakery user-16=sosevalu user-17=crrtipdl user-18=attlebor user-19=lucy user-20=onlycont user-21=outdoorc user-22=hodgsonmail user-23=ranxterc user-24=branko user-25=romaldki user-26=tomandle user-27=jennimil user-28=chrisdal user-29=mcdermos user-30=nbhavers user-31=careers user-32=david user-33=pars user-34=cathski user-35=cambria1 user-36=reliable user-37=ninejimm user-38=howardon user-39=pugwash user-40=paulmca1 user-41=cwsocial user-42=hirefootballgame user-43=eugincou user-44=courseme user-45=putterfc user-46=nscdp user-47=health2045 user-48=fortunaz user-49=foods
Sep  1 07:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=leftie user-51=lkpier user-52=philmcph user-53=ctedorgu user-54=donnychicago user-55=firstre5 user-56=steakbridieme user-57=isleofwi user-58=smrszyqg user-59=hidden user-60=nomistakes user-61=tigerlet user-62=barbersh user-63=burydropin user-64=fawcettd user-65=nsceres user-66=beauty user-67=eatspam user-68=darkstar user-69=dhyana user-70=sibtoncc user-71=asandcoc user-72=bwppodcast user-73=zebrapho user-74=steve user-75=alexadmin user-76=skyfirec user-77=innovat1 user-78=askhform user-79=stuartge user-80=nativene user-81=brighto1 user-82=nstriton user-83=firstre2 user-84=vivienn1 user-85=battlere user-86=oneoarco user-87=bedfords user-88=belle user-89=ggaaorgu user-90=newstoda user-91=bemadonn user-92=gilpin user-93=milloyco user-94=elecleis user-95=hubmaster user-96=putterfi user-97=carsinyo user-98=fetch user-99=accooper user-100=ianrayne user-101=connectedshoppin user-102=thqkgnbz user-103=seftvta
Sep  1 07:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=jonhartl user-105=ultbcrra user-106=firstres user-107=opaiscyx user-108=coursemc user-109=firstrel user-110=clarkass user-111=costestimatorco user-112=firstred user-113=southlon user-114=highlegh user-115=martsblo user-116=dickemery123 user-117=ptkxhsbt user-118=lbhyisi user-119=hhdugcor user-120=magichat user-121=brmrjxl user-122=lakesan1 user-123=strathar user-124=sarafoundation user-125=atestord user-126=wilsonsw user-127=musorguk user-128=megacards user-129=jarvisin user-130=spectrum user-131=theblack user-132=hodgesonweb user-133=still user-134=agproduc user-135=stephani user-136=leereyn1 user-137=markward user-138=foundation user-139=booff user-140=connect9 user-141=athenare user-142=vantagep user-143=maflemin user-144=lbscrmod user-145=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 07:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 07:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:10:04 nativespace-cdp sudo[856725]: pam_unix(sudo:session): session closed for user root
Sep  1 07:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 07:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:10:05 nativespace-cdp sudo[856742]: pam_unix(sudo:session): session closed for user root
Sep  1 07:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oio6ZBFGaqx6DF7z.~
Sep  1 07:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:10:05 nativespace-cdp sudo[856745]: pam_unix(sudo:session): session closed for user root
Sep  1 07:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oio6ZBFGaqx6DF7z.~'
Sep  1 07:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:10:05 nativespace-cdp sudo[856748]: pam_unix(sudo:session): session closed for user root
Sep  1 07:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oio6ZBFGaqx6DF7z.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 07:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:10:05 nativespace-cdp sudo[856752]: pam_unix(sudo:session): session closed for user root
Sep  1 07:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 07:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:10:05 nativespace-cdp sudo[856755]: pam_unix(sudo:session): session closed for user root
Sep  1 07:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 07:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:10:07 nativespace-cdp sudo[856776]: pam_unix(sudo:session): session closed for user root
Sep  1 07:11:33 nativespace-cdp sshd[857152]: Connection closed by 159.100.136.21 port 52500 [preauth]
Sep  1 07:16:33 nativespace-cdp sshd[858219]: Connection closed by 159.100.136.21 port 34250 [preauth]
Sep  1 07:21:33 nativespace-cdp sshd[859342]: Connection closed by 159.100.136.21 port 44216 [preauth]
Sep  1 07:26:33 nativespace-cdp sshd[860660]: Connection closed by 159.100.136.21 port 54496 [preauth]
Sep  1 07:31:33 nativespace-cdp sshd[861918]: Connection closed by 159.100.136.21 port 36208 [preauth]
Sep  1 07:36:33 nativespace-cdp sshd[862975]: Connection closed by 159.100.136.21 port 46510 [preauth]
Sep  1 07:41:33 nativespace-cdp sshd[864280]: Connection closed by 159.100.136.21 port 56490 [preauth]
Sep  1 07:44:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c cpapi2 --user=martsblo Locale get_user_locale --output=json
Sep  1 07:44:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:37 nativespace-cdp sudo[865026]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 07:44:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:37 nativespace-cdp sudo[865034]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 07:44:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:37 nativespace-cdp sudo[865041]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 07:44:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:38 nativespace-cdp sudo[865047]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=hodgesonweb user-3=theblack user-4=spectrum user-5=still user-6=agproduc user-7=leereyn1 user-8=stephani user-9=booff user-10=markward user-11=foundation user-12=maflemin user-13=lbscrmod user-14=athenare user-15=connect9 user-16=vantagep user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=lbhyisi user-22=hhdugcor user-23=magichat user-24=lakesan1 user-25=brmrjxl user-26=sarafoundation user-27=atestord user-28=strathar user-29=wilsonsw user-30=musorguk user-31=megacards user-32=elecleis user-33=gilpin user-34=milloyco user-35=carsinyo user-36=fetch user-37=putterfi user-38=hubmaster user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=seftvta user-45=jonhartl user-46=ultbcrra user-47=coursemc
Sep  1 07:44:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=opaiscyx user-49=costestimatorco user-50=firstrel user-51=clarkass user-52=southlon user-53=highlegh user-54=firstred user-55=alexadmin user-56=skyfirec user-57=stuartge user-58=askhform user-59=innovat1 user-60=nativene user-61=brighto1 user-62=nstriton user-63=battlere user-64=oneoarco user-65=firstre2 user-66=vivienn1 user-67=bedfords user-68=bemadonn user-69=ggaaorgu user-70=belle user-71=newstoda user-72=burydropin user-73=fawcettd user-74=nsceres user-75=eatspam user-76=darkstar user-77=beauty user-78=dhyana user-79=asandcoc user-80=sibtoncc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=reliable user-85=ninejimm user-86=cathski user-87=cambria1 user-88=paulmca1 user-89=howardon user-90=pugwash user-91=cwsocial user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=fortunaz user-96=health2045 user-97=leftie user-98=foods user-99=putterfc user-100=nscdp user-101=philmcph
Sep  1 07:44:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ctedorgu user-103=firstre5 user-104=donnychicago user-105=steakbridieme user-106=lkpier user-107=isleofwi user-108=smrszyqg user-109=tigerlet user-110=barbersh user-111=hidden user-112=nomistakes user-113=attlebor user-114=lucy user-115=onlycont user-116=branko user-117=hodgsonmail user-118=outdoorc user-119=ranxterc user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=careers user-126=nbhavers user-127=pars user-128=david user-129=what user-130=oubpgvbx user-131=tstardom user-132=nvihkvu user-133=sketchy user-134=cath user-135=havantho user-136=kategilpin user-137=ladburyp user-138=dancinggardener user-139=stagingerris user-140=design user-141=nove user-142=boldover user-143=sosevalu user-144=crrtipdl user-145=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 07:44:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 07:44:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:39 nativespace-cdp sudo[865056]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 07:44:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:40 nativespace-cdp sudo[865077]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 07:44:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:40 nativespace-cdp sudo[865084]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c cpapi2 --user=martsblo Locale get_user_locale --output=json
Sep  1 07:44:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:49 nativespace-cdp sudo[865113]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 07:44:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:49 nativespace-cdp sudo[865119]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 07:44:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:49 nativespace-cdp sudo[865126]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c cpapi2 --user=martsblo Locale get_user_locale --output=json
Sep  1 07:44:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:51 nativespace-cdp sudo[865155]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 07:44:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:52 nativespace-cdp sudo[865161]: pam_unix(sudo:session): session closed for user root
Sep  1 07:44:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 07:44:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 07:44:52 nativespace-cdp sudo[865168]: pam_unix(sudo:session): session closed for user root
Sep  1 07:46:33 nativespace-cdp sshd[865766]: Connection closed by 159.100.136.21 port 38506 [preauth]
Sep  1 07:51:33 nativespace-cdp sshd[866870]: Connection closed by 159.100.136.21 port 48488 [preauth]
Sep  1 07:56:33 nativespace-cdp sshd[867953]: Connection closed by 159.100.136.21 port 58780 [preauth]
Sep  1 08:01:33 nativespace-cdp sshd[869373]: Connection closed by 159.100.136.21 port 40552 [preauth]
Sep  1 08:06:33 nativespace-cdp sshd[870591]: Connection closed by 159.100.136.21 port 50854 [preauth]
Sep  1 08:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 08:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:50 nativespace-cdp sudo[871332]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 08:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 08:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:50 nativespace-cdp sudo[871344]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 08:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:51 nativespace-cdp sudo[871349]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 08:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:51 nativespace-cdp sudo[871411]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 08:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:55 nativespace-cdp sudo[871422]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 08:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:55 nativespace-cdp sudo[871578]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 08:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:55 nativespace-cdp sudo[871583]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 08:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:55 nativespace-cdp sudo[871587]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 08:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:55 nativespace-cdp sudo[871592]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 08:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:55 nativespace-cdp sudo[871597]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 08:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:55 nativespace-cdp sudo[871603]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 08:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:57 nativespace-cdp sudo[871616]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 08:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:58 nativespace-cdp sudo[871622]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=wilsonsw user-2=musorguk user-3=megacards user-4=brmrjxl user-5=lakesan1 user-6=strathar user-7=sarafoundation user-8=atestord user-9=lbhyisi user-10=hhdugcor user-11=magichat user-12=martsblo user-13=dickemery123 user-14=ptkxhsbt user-15=ulsukarm user-16=booff user-17=markward user-18=foundation user-19=athenare user-20=connect9 user-21=vantagep user-22=maflemin user-23=lbscrmod user-24=still user-25=agproduc user-26=stephani user-27=leereyn1 user-28=jarvisin user-29=spectrum user-30=hodgesonweb user-31=theblack user-32=bedfords user-33=ggaaorgu user-34=belle user-35=newstoda user-36=bemadonn user-37=brighto1 user-38=nstriton user-39=firstre2 user-40=vivienn1 user-41=battlere user-42=oneoarco user-43=innovat1 user-44=askhform user-45=stuartge user-46=nativene user-47=skyfirec user-48=alexadmin
Sep  1 08:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=clarkass user-50=firstrel user-51=costestimatorco user-52=firstred user-53=southlon user-54=highlegh user-55=jonhartl user-56=seftvta user-57=ultbcrra user-58=firstres user-59=opaiscyx user-60=coursemc user-61=accooper user-62=ianrayne user-63=connectedshoppin user-64=thqkgnbz user-65=milloyco user-66=gilpin user-67=elecleis user-68=putterfi user-69=hubmaster user-70=carsinyo user-71=fetch user-72=smrszyqg user-73=isleofwi user-74=hidden user-75=nomistakes user-76=barbersh user-77=tigerlet user-78=putterfc user-79=nscdp user-80=health2045 user-81=fortunaz user-82=leftie user-83=foods user-84=lkpier user-85=philmcph user-86=ctedorgu user-87=firstre5 user-88=donnychicago user-89=steakbridieme user-90=hirefootballgame user-91=eugincou user-92=courseme user-93=cambria1 user-94=cathski user-95=ninejimm user-96=reliable user-97=pugwash user-98=paulmca1 user-99=howardon user-100=cwsocial user-101=bwppodcast
Sep  1 08:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=zebrapho user-103=steve user-104=asandcoc user-105=sibtoncc user-106=beauty user-107=eatspam user-108=darkstar user-109=dhyana user-110=burydropin user-111=fawcettd user-112=nsceres user-113=bakery user-114=sosevalu user-115=crrtipdl user-116=nove user-117=boldover user-118=ladburyp user-119=stagingerris user-120=dancinggardener user-121=kategilpin user-122=design user-123=oubpgvbx user-124=tstardom user-125=what user-126=sketchy user-127=cath user-128=havantho user-129=nvihkvu user-130=chrisdal user-131=mcdermos user-132=nbhavers user-133=careers user-134=david user-135=pars user-136=tomandle user-137=jennimil user-138=outdoorc user-139=hodgsonmail user-140=ranxterc user-141=branko user-142=romaldki user-143=attlebor user-144=lucy user-145=onlycont feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 08:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 08:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:58 nativespace-cdp sudo[871629]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:59 nativespace-cdp sudo[871636]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-o2XF0It27hfr14jw.~
Sep  1 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:59 nativespace-cdp sudo[871644]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-o2XF0It27hfr14jw.~'
Sep  1 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:59 nativespace-cdp sudo[871648]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-o2XF0It27hfr14jw.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:59 nativespace-cdp sudo[871654]: pam_unix(sudo:session): session closed for user root
Sep  1 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:09:59 nativespace-cdp sudo[871659]: pam_unix(sudo:session): session closed for user root
Sep  1 08:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 08:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 08:10:01 nativespace-cdp sudo[871680]: pam_unix(sudo:session): session closed for user root
Sep  1 08:11:33 nativespace-cdp sshd[872149]: Connection closed by 159.100.136.21 port 60838 [preauth]
Sep  1 08:16:33 nativespace-cdp sshd[873352]: Connection closed by 159.100.136.21 port 42816 [preauth]
Sep  1 08:21:33 nativespace-cdp sshd[874515]: Connection closed by 159.100.136.21 port 52786 [preauth]
Sep  1 08:26:33 nativespace-cdp sshd[875858]: Connection closed by 159.100.136.21 port 34808 [preauth]
Sep  1 08:31:33 nativespace-cdp sshd[877045]: Connection closed by 159.100.136.21 port 44854 [preauth]
Sep  1 08:36:33 nativespace-cdp sshd[878239]: Connection closed by 159.100.136.21 port 55118 [preauth]
Sep  1 08:41:33 nativespace-cdp sshd[879593]: Connection closed by 159.100.136.21 port 36866 [preauth]
Sep  1 08:46:33 nativespace-cdp sshd[880674]: Connection closed by 159.100.136.21 port 47086 [preauth]
Sep  1 08:51:33 nativespace-cdp sshd[881803]: Connection closed by 159.100.136.21 port 57064 [preauth]
Sep  1 08:56:33 nativespace-cdp sshd[883116]: Connection closed by 159.100.136.21 port 39118 [preauth]
Sep  1 09:01:33 nativespace-cdp sshd[884428]: Connection closed by 159.100.136.21 port 49096 [preauth]
Sep  1 09:06:33 nativespace-cdp sshd[885638]: Connection closed by 159.100.136.21 port 59406 [preauth]
Sep  1 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:09:56 nativespace-cdp sudo[886333]: pam_unix(sudo:session): session closed for user root
Sep  1 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:09:56 nativespace-cdp sudo[886338]: pam_unix(sudo:session): session closed for user root
Sep  1 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:09:58 nativespace-cdp sudo[886343]: pam_unix(sudo:session): session closed for user root
Sep  1 09:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 09:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:09:58 nativespace-cdp sudo[886350]: pam_unix(sudo:session): session closed for user root
Sep  1 09:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 09:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:00 nativespace-cdp sshd[886362]: Invalid user santos from 98.184.108.60 port 48670
Sep  1 09:10:00 nativespace-cdp sshd[886362]: input_userauth_request: invalid user santos [preauth]
Sep  1 09:10:00 nativespace-cdp sshd[886362]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 09:10:00 nativespace-cdp sshd[886362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.184.108.60
Sep  1 09:10:02 nativespace-cdp sudo[886356]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:02 nativespace-cdp sshd[886362]: Failed password for invalid user santos from 98.184.108.60 port 48670 ssh2
Sep  1 09:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 09:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:02 nativespace-cdp sudo[886529]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:02 nativespace-cdp sshd[886362]: Received disconnect from 98.184.108.60 port 48670:11: Bye Bye [preauth]
Sep  1 09:10:02 nativespace-cdp sshd[886362]: Disconnected from 98.184.108.60 port 48670 [preauth]
Sep  1 09:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 09:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:02 nativespace-cdp sudo[886533]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 09:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:02 nativespace-cdp sudo[886536]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 09:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:02 nativespace-cdp sudo[886543]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 09:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:02 nativespace-cdp sudo[886546]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 09:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:02 nativespace-cdp sudo[886553]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 09:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:05 nativespace-cdp sudo[886569]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 09:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:06 nativespace-cdp sudo[886576]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=reliable user-2=ninejimm user-3=cambria1 user-4=cathski user-5=cwsocial user-6=paulmca1 user-7=howardon user-8=pugwash user-9=hirefootballgame user-10=courseme user-11=eugincou user-12=leftie user-13=foods user-14=fortunaz user-15=health2045 user-16=nscdp user-17=putterfc user-18=steakbridieme user-19=firstre5 user-20=donnychicago user-21=ctedorgu user-22=philmcph user-23=lkpier user-24=smrszyqg user-25=isleofwi user-26=barbersh user-27=tigerlet user-28=nomistakes user-29=hidden user-30=fawcettd user-31=burydropin user-32=nsceres user-33=darkstar user-34=eatspam user-35=beauty user-36=dhyana user-37=sibtoncc user-38=asandcoc user-39=zebrapho user-40=bwppodcast user-41=steve user-42=what user-43=tstardom user-44=oubpgvbx user-45=nvihkvu user-46=havantho user-47=sketchy user-48=cath
Sep  1 09:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=kategilpin user-50=stagingerris user-51=dancinggardener user-52=ladburyp user-53=design user-54=nove user-55=boldover user-56=crrtipdl user-57=sosevalu user-58=bakery user-59=lucy user-60=attlebor user-61=onlycont user-62=branko user-63=ranxterc user-64=outdoorc user-65=hodgsonmail user-66=romaldki user-67=tomandle user-68=jennimil user-69=mcdermos user-70=chrisdal user-71=david user-72=pars user-73=nbhavers user-74=careers user-75=martsblo user-76=ptkxhsbt user-77=dickemery123 user-78=hhdugcor user-79=lbhyisi user-80=magichat user-81=brmrjxl user-82=lakesan1 user-83=atestord user-84=sarafoundation user-85=strathar user-86=wilsonsw user-87=megacards user-88=musorguk user-89=jarvisin user-90=hodgesonweb user-91=theblack user-92=spectrum user-93=agproduc user-94=still user-95=leereyn1 user-96=stephani user-97=foundation user-98=markward user-99=booff user-100=lbscrmod user-101=maflemin user-102=vantagep
Sep  1 09:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=connect9 user-104=athenare user-105=ulsukarm user-106=alexadmin user-107=skyfirec user-108=askhform user-109=stuartge user-110=innovat1 user-111=nativene user-112=nstriton user-113=brighto1 user-114=oneoarco user-115=battlere user-116=vivienn1 user-117=firstre2 user-118=bedfords user-119=bemadonn user-120=newstoda user-121=belle user-122=ggaaorgu user-123=elecleis user-124=milloyco user-125=gilpin user-126=fetch user-127=carsinyo user-128=hubmaster user-129=putterfi user-130=ianrayne user-131=accooper user-132=thqkgnbz user-133=connectedshoppin user-134=firstres user-135=ultbcrra user-136=jonhartl user-137=seftvta user-138=opaiscyx user-139=coursemc user-140=costestimatorco user-141=firstrel user-142=clarkass user-143=highlegh user-144=southlon user-145=firstred feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 09:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 09:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:08 nativespace-cdp sudo[886586]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:09 nativespace-cdp sudo[886596]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-m4In2mzuvgZwPyya.~
Sep  1 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:09 nativespace-cdp sudo[886603]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-m4In2mzuvgZwPyya.~'
Sep  1 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:09 nativespace-cdp sudo[886608]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-m4In2mzuvgZwPyya.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:09 nativespace-cdp sudo[886614]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:09 nativespace-cdp sudo[886619]: pam_unix(sudo:session): session closed for user root
Sep  1 09:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 09:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:10:11 nativespace-cdp sudo[886644]: pam_unix(sudo:session): session closed for user root
Sep  1 09:11:33 nativespace-cdp sshd[886905]: Connection closed by 159.100.136.21 port 41154 [preauth]
Sep  1 09:15:11 nativespace-cdp sshd[887946]: Invalid user Unknown from 190.145.202.166 port 47493
Sep  1 09:15:11 nativespace-cdp sshd[887946]: input_userauth_request: invalid user Unknown [preauth]
Sep  1 09:15:11 nativespace-cdp sshd[887946]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 09:15:11 nativespace-cdp sshd[887946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.145.202.166
Sep  1 09:15:13 nativespace-cdp sshd[887946]: Failed password for invalid user Unknown from 190.145.202.166 port 47493 ssh2
Sep  1 09:15:14 nativespace-cdp sshd[887946]: Received disconnect from 190.145.202.166 port 47493:11: Bye Bye [preauth]
Sep  1 09:15:14 nativespace-cdp sshd[887946]: Disconnected from 190.145.202.166 port 47493 [preauth]
Sep  1 09:16:34 nativespace-cdp sshd[888271]: Connection closed by 159.100.136.21 port 51376 [preauth]
Sep  1 09:17:43 nativespace-cdp sshd[888615]: Invalid user yiyuan from 98.184.108.60 port 52514
Sep  1 09:17:43 nativespace-cdp sshd[888615]: input_userauth_request: invalid user yiyuan [preauth]
Sep  1 09:17:43 nativespace-cdp sshd[888615]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 09:17:43 nativespace-cdp sshd[888615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.184.108.60
Sep  1 09:17:46 nativespace-cdp sshd[888615]: Failed password for invalid user yiyuan from 98.184.108.60 port 52514 ssh2
Sep  1 09:17:46 nativespace-cdp sshd[888615]: Received disconnect from 98.184.108.60 port 52514:11: Bye Bye [preauth]
Sep  1 09:17:46 nativespace-cdp sshd[888615]: Disconnected from 98.184.108.60 port 52514 [preauth]
Sep  1 09:18:27 nativespace-cdp sshd[888741]: Invalid user devil from 98.184.108.60 port 46380
Sep  1 09:18:27 nativespace-cdp sshd[888741]: input_userauth_request: invalid user devil [preauth]
Sep  1 09:18:27 nativespace-cdp sshd[888741]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 09:18:27 nativespace-cdp sshd[888741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.184.108.60
Sep  1 09:18:28 nativespace-cdp sshd[888741]: Failed password for invalid user devil from 98.184.108.60 port 46380 ssh2
Sep  1 09:18:28 nativespace-cdp sshd[888741]: Received disconnect from 98.184.108.60 port 46380:11: Bye Bye [preauth]
Sep  1 09:18:28 nativespace-cdp sshd[888741]: Disconnected from 98.184.108.60 port 46380 [preauth]
Sep  1 09:21:33 nativespace-cdp sshd[889532]: Connection closed by 159.100.136.21 port 33086 [preauth]
Sep  1 09:24:16 nativespace-cdp sshd[890119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.145.202.166  user=root
Sep  1 09:24:16 nativespace-cdp sshd[890119]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 09:24:18 nativespace-cdp sshd[890119]: Failed password for root from 190.145.202.166 port 33739 ssh2
Sep  1 09:24:18 nativespace-cdp sshd[890119]: Received disconnect from 190.145.202.166 port 33739:11: Bye Bye [preauth]
Sep  1 09:24:18 nativespace-cdp sshd[890119]: Disconnected from 190.145.202.166 port 33739 [preauth]
Sep  1 09:25:48 nativespace-cdp sshd[890786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.145.202.166  user=root
Sep  1 09:25:48 nativespace-cdp sshd[890786]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 09:25:50 nativespace-cdp sshd[890786]: Failed password for root from 190.145.202.166 port 49458 ssh2
Sep  1 09:25:50 nativespace-cdp sshd[890786]: Received disconnect from 190.145.202.166 port 49458:11: Bye Bye [preauth]
Sep  1 09:25:50 nativespace-cdp sshd[890786]: Disconnected from 190.145.202.166 port 49458 [preauth]
Sep  1 09:26:33 nativespace-cdp sshd[890935]: Connection closed by 159.100.136.21 port 43360 [preauth]
Sep  1 09:31:33 nativespace-cdp sshd[892199]: Connection closed by 159.100.136.21 port 53406 [preauth]
Sep  1 09:36:33 nativespace-cdp sshd[893392]: Connection closed by 159.100.136.21 port 35454 [preauth]
Sep  1 09:41:33 nativespace-cdp sshd[894832]: Connection closed by 159.100.136.21 port 45420 [preauth]
Sep  1 09:46:33 nativespace-cdp sshd[896016]: Connection closed by 159.100.136.21 port 55614 [preauth]
Sep  1 09:51:33 nativespace-cdp sshd[897111]: Connection closed by 159.100.136.21 port 37378 [preauth]
Sep  1 09:55:51 nativespace-cdp sshd[898178]: Accepted publickey for root from 185.67.178.249 port 60174 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  1 09:55:51 nativespace-cdp sshd[898178]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  1 09:56:13 nativespace-cdp sshd[898276]: Accepted publickey for root from 185.67.178.249 port 45470 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  1 09:56:13 nativespace-cdp sshd[898276]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  1 09:56:33 nativespace-cdp sshd[898392]: Connection closed by 159.100.136.21 port 47652 [preauth]
Sep  1 09:57:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 09:57:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:17 nativespace-cdp sudo[898856]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 09:57:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:17 nativespace-cdp sudo[898861]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/martsblo/dev.martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898865]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/martsblo/dev.martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898868]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/martsblo/dev.martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898871]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/martsblo/gordonandsons.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898874]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/martsblo/gordonandsons.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898877]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/martsblo/gordonandsons.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898881]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/martsblo/gordonandsons.martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898885]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/martsblo/gordonandsons.martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898888]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/martsblo/gordonandsons.martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898891]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/martsblo/martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898894]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/martsblo/martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898898]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/martsblo/martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898902]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/martsblo/mrgreensuniverse.martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898905]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/martsblo/mrgreensuniverse.martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898908]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/martsblo/mrgreensuniverse.martsblog.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898911]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/martsblo/wordpress-website-developer.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898914]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/martsblo/wordpress-website-developer.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898917]: pam_unix(sudo:session): session closed for user root
Sep  1 09:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/martsblo/wordpress-website-developer.co.uk/wp-toolkit.conf
Sep  1 09:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 09:57:18 nativespace-cdp sudo[898920]: pam_unix(sudo:session): session closed for user root
Sep  1 10:01:33 nativespace-cdp sshd[900285]: Connection closed by 159.100.136.21 port 57634 [preauth]
Sep  1 10:06:33 nativespace-cdp sshd[901509]: Connection closed by 159.100.136.21 port 39710 [preauth]
Sep  1 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:09:59 nativespace-cdp sudo[902499]: pam_unix(sudo:session): session closed for user root
Sep  1 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:09:59 nativespace-cdp sudo[902502]: pam_unix(sudo:session): session closed for user root
Sep  1 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:01 nativespace-cdp sudo[902506]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 10:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:01 nativespace-cdp sudo[902595]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 10:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:06 nativespace-cdp sudo[902603]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:06 nativespace-cdp sudo[902653]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:06 nativespace-cdp sudo[902656]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:06 nativespace-cdp sudo[902659]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:06 nativespace-cdp sudo[902662]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:06 nativespace-cdp sudo[902665]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 10:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:07 nativespace-cdp sudo[902668]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 10:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:10 nativespace-cdp sudo[902683]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 10:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:11 nativespace-cdp sudo[902688]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hhdugcor user-2=lbhyisi user-3=magichat user-4=martsblo user-5=dickemery123 user-6=ptkxhsbt user-7=wilsonsw user-8=megacards user-9=musorguk user-10=lakesan1 user-11=brmrjxl user-12=strathar user-13=atestord user-14=sarafoundation user-15=agproduc user-16=still user-17=stephani user-18=leereyn1 user-19=jarvisin user-20=spectrum user-21=theblack user-22=hodgesonweb user-23=ulsukarm user-24=markward user-25=booff user-26=foundation user-27=vantagep user-28=athenare user-29=connect9 user-30=lbscrmod user-31=maflemin user-32=innovat1 user-33=askhform user-34=stuartge user-35=nativene user-36=skyfirec user-37=alexadmin user-38=bedfords user-39=newstoda user-40=belle user-41=ggaaorgu user-42=bemadonn user-43=nstriton user-44=brighto1 user-45=vivienn1 user-46=firstre2 user-47=oneoarco user-48=battlere
Sep  1 10:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=accooper user-50=ianrayne user-51=connectedshoppin user-52=thqkgnbz user-53=milloyco user-54=gilpin user-55=elecleis user-56=putterfi user-57=hubmaster user-58=fetch user-59=carsinyo user-60=clarkass user-61=firstrel user-62=costestimatorco user-63=firstred user-64=highlegh user-65=southlon user-66=ultbcrra user-67=jonhartl user-68=seftvta user-69=firstres user-70=opaiscyx user-71=coursemc user-72=hirefootballgame user-73=eugincou user-74=courseme user-75=cambria1 user-76=cathski user-77=ninejimm user-78=reliable user-79=cwsocial user-80=howardon user-81=paulmca1 user-82=pugwash user-83=smrszyqg user-84=isleofwi user-85=nomistakes user-86=hidden user-87=barbersh user-88=tigerlet user-89=nscdp user-90=putterfc user-91=foods user-92=leftie user-93=health2045 user-94=fortunaz user-95=lkpier user-96=donnychicago user-97=firstre5 user-98=steakbridieme user-99=philmcph user-100=ctedorgu user-101=beauty
Sep  1 10:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=darkstar user-103=eatspam user-104=dhyana user-105=fawcettd user-106=burydropin user-107=nsceres user-108=bwppodcast user-109=zebrapho user-110=steve user-111=asandcoc user-112=sibtoncc user-113=dancinggardener user-114=stagingerris user-115=ladburyp user-116=kategilpin user-117=design user-118=tstardom user-119=oubpgvbx user-120=what user-121=havantho user-122=sketchy user-123=cath user-124=nvihkvu user-125=bakery user-126=crrtipdl user-127=sosevalu user-128=nove user-129=boldover user-130=hodgsonmail user-131=ranxterc user-132=outdoorc user-133=branko user-134=romaldki user-135=lucy user-136=attlebor user-137=onlycont user-138=chrisdal user-139=mcdermos user-140=pars user-141=david user-142=nbhavers user-143=careers user-144=tomandle user-145=jennimil feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 10:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 10:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:12 nativespace-cdp sudo[902695]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 10:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:13 nativespace-cdp sudo[902705]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nT3Rp4gWbqaDqcTn.~
Sep  1 10:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:13 nativespace-cdp sudo[902709]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nT3Rp4gWbqaDqcTn.~'
Sep  1 10:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:13 nativespace-cdp sudo[902713]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nT3Rp4gWbqaDqcTn.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 10:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:13 nativespace-cdp sudo[902717]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 10:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:13 nativespace-cdp sudo[902720]: pam_unix(sudo:session): session closed for user root
Sep  1 10:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 10:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 10:10:14 nativespace-cdp sudo[902740]: pam_unix(sudo:session): session closed for user root
Sep  1 10:11:33 nativespace-cdp sshd[903042]: Connection closed by 159.100.136.21 port 49690 [preauth]
Sep  1 10:16:33 nativespace-cdp sshd[904180]: Connection closed by 159.100.136.21 port 59918 [preauth]
Sep  1 10:21:33 nativespace-cdp sshd[905365]: Connection closed by 159.100.136.21 port 41626 [preauth]
Sep  1 10:26:33 nativespace-cdp sshd[906808]: Connection closed by 159.100.136.21 port 51898 [preauth]
Sep  1 10:31:33 nativespace-cdp sshd[908228]: Connection closed by 159.100.136.21 port 33700 [preauth]
Sep  1 10:36:33 nativespace-cdp sshd[909394]: Connection closed by 159.100.136.21 port 43978 [preauth]
Sep  1 10:41:33 nativespace-cdp sshd[910780]: Connection closed by 159.100.136.21 port 53962 [preauth]
Sep  1 10:46:33 nativespace-cdp sshd[912159]: Connection closed by 159.100.136.21 port 35920 [preauth]
Sep  1 10:51:33 nativespace-cdp sshd[913281]: Connection closed by 159.100.136.21 port 45934 [preauth]
Sep  1 10:56:33 nativespace-cdp sshd[914533]: Connection closed by 159.100.136.21 port 56178 [preauth]
Sep  1 11:01:33 nativespace-cdp sshd[915989]: Connection closed by 159.100.136.21 port 37934 [preauth]
Sep  1 11:04:08 nativespace-cdp sshd[898178]: Received disconnect from 185.67.178.249 port 60174:11: Normal Shutdown
Sep  1 11:04:08 nativespace-cdp sshd[898178]: Disconnected from 185.67.178.249 port 60174
Sep  1 11:04:08 nativespace-cdp sshd[898178]: pam_unix(sshd:session): session closed for user root
Sep  1 11:04:09 nativespace-cdp sshd[898276]: Received disconnect from 185.67.178.249 port 45470:11: Normal Shutdown
Sep  1 11:04:09 nativespace-cdp sshd[898276]: Disconnected from 185.67.178.249 port 45470
Sep  1 11:04:09 nativespace-cdp sshd[898276]: pam_unix(sshd:session): session closed for user root
Sep  1 11:06:33 nativespace-cdp sshd[917157]: Connection closed by 159.100.136.21 port 48258 [preauth]
Sep  1 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:09:58 nativespace-cdp sudo[918073]: pam_unix(sudo:session): session closed for user root
Sep  1 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:09:58 nativespace-cdp sudo[918078]: pam_unix(sudo:session): session closed for user root
Sep  1 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:00 nativespace-cdp sudo[918083]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 11:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:00 nativespace-cdp sudo[918093]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 11:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:05 nativespace-cdp sudo[918099]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 11:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:05 nativespace-cdp sudo[918233]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 11:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:06 nativespace-cdp sudo[918237]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 11:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:06 nativespace-cdp sudo[918240]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 11:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:06 nativespace-cdp sudo[918243]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 11:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:06 nativespace-cdp sudo[918246]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 11:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:06 nativespace-cdp sudo[918249]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:08 nativespace-cdp sudo[918260]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:11 nativespace-cdp sudo[918265]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=boldover user-2=nove user-3=crrtipdl user-4=sosevalu user-5=bakery user-6=nvihkvu user-7=havantho user-8=sketchy user-9=cath user-10=what user-11=tstardom user-12=oubpgvbx user-13=design user-14=kategilpin user-15=dancinggardener user-16=stagingerris user-17=ladburyp user-18=jennimil user-19=tomandle user-20=pars user-21=david user-22=nbhavers user-23=careers user-24=mcdermos user-25=chrisdal user-26=onlycont user-27=lucy user-28=attlebor user-29=romaldki user-30=branko user-31=hodgsonmail user-32=ranxterc user-33=outdoorc user-34=donnychicago user-35=firstre5 user-36=steakbridieme user-37=philmcph user-38=ctedorgu user-39=lkpier user-40=leftie user-41=foods user-42=health2045 user-43=fortunaz user-44=nscdp user-45=putterfc user-46=tigerlet user-47=barbersh user-48=nomistakes user-49=hidden
Sep  1 11:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=isleofwi user-51=smrszyqg user-52=cwsocial user-53=pugwash user-54=paulmca1 user-55=howardon user-56=reliable user-57=ninejimm user-58=cathski user-59=cambria1 user-60=courseme user-61=eugincou user-62=hirefootballgame user-63=asandcoc user-64=sibtoncc user-65=steve user-66=zebrapho user-67=bwppodcast user-68=nsceres user-69=fawcettd user-70=burydropin user-71=dhyana user-72=darkstar user-73=eatspam user-74=beauty user-75=oneoarco user-76=battlere user-77=vivienn1 user-78=firstre2 user-79=nstriton user-80=brighto1 user-81=bemadonn user-82=newstoda user-83=belle user-84=ggaaorgu user-85=bedfords user-86=alexadmin user-87=skyfirec user-88=nativene user-89=stuartge user-90=askhform user-91=innovat1 user-92=coursemc user-93=opaiscyx user-94=firstres user-95=ultbcrra user-96=jonhartl user-97=seftvta user-98=highlegh user-99=southlon user-100=firstred user-101=costestimatorco user-102=firstrel user-103=clarkass
Sep  1 11:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=fetch user-105=carsinyo user-106=hubmaster user-107=putterfi user-108=elecleis user-109=gilpin user-110=milloyco user-111=thqkgnbz user-112=connectedshoppin user-113=ianrayne user-114=accooper user-115=atestord user-116=sarafoundation user-117=strathar user-118=brmrjxl user-119=lakesan1 user-120=megacards user-121=musorguk user-122=wilsonsw user-123=ptkxhsbt user-124=dickemery123 user-125=martsblo user-126=magichat user-127=hhdugcor user-128=lbhyisi user-129=lbscrmod user-130=maflemin user-131=vantagep user-132=athenare user-133=connect9 user-134=booff user-135=markward user-136=foundation user-137=ulsukarm user-138=hodgesonweb user-139=theblack user-140=spectrum user-141=jarvisin user-142=leereyn1 user-143=stephani user-144=agproduc user-145=still feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 11:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 11:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:13 nativespace-cdp sudo[918277]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  1 11:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:14 nativespace-cdp sudo[918294]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep  1 11:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  1 11:10:15 nativespace-cdp sudo[918298]: pam_unix(sudo:session): session closed for user onlycont
Sep  1 11:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  1 11:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:16 nativespace-cdp sudo[918310]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  1 11:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 11:10:16 nativespace-cdp sudo[918314]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 11:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  1 11:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:18 nativespace-cdp sudo[918334]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep  1 11:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  1 11:10:18 nativespace-cdp sudo[918338]: pam_unix(sudo:session): session closed for user lkpier
Sep  1 11:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  1 11:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:19 nativespace-cdp sudo[918352]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep  1 11:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  1 11:10:19 nativespace-cdp sudo[918358]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  1 11:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  1 11:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  1 11:10:19 nativespace-cdp sudo[918370]: pam_unix(sudo:session): session closed for user oneoarco
Sep  1 11:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  1 11:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:20 nativespace-cdp sudo[918381]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep  1 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  1 11:10:20 nativespace-cdp sudo[918385]: pam_unix(sudo:session): session closed for user fortunaz
Sep  1 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep  1 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:20 nativespace-cdp sudo[918396]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:20 nativespace-cdp sudo[918399]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep  1 11:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:40 nativespace-cdp sudo[919332]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep  1 11:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:40 nativespace-cdp sudo[919338]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 11:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:42 nativespace-cdp sudo[919347]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-uaSGUwJvi97beYn7.~
Sep  1 11:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:42 nativespace-cdp sudo[919350]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-uaSGUwJvi97beYn7.~'
Sep  1 11:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:42 nativespace-cdp sudo[919353]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-uaSGUwJvi97beYn7.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 11:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:42 nativespace-cdp sudo[919357]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 11:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:42 nativespace-cdp sudo[919360]: pam_unix(sudo:session): session closed for user root
Sep  1 11:10:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 11:10:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 11:10:43 nativespace-cdp sudo[919373]: pam_unix(sudo:session): session closed for user root
Sep  1 11:11:33 nativespace-cdp sshd[919572]: Connection closed by 159.100.136.21 port 58224 [preauth]
Sep  1 11:16:33 nativespace-cdp sshd[920672]: Connection closed by 159.100.136.21 port 40216 [preauth]
Sep  1 11:21:33 nativespace-cdp sshd[921854]: Connection closed by 159.100.136.21 port 50160 [preauth]
Sep  1 11:26:33 nativespace-cdp sshd[923203]: Connection closed by 159.100.136.21 port 60430 [preauth]
Sep  1 11:31:33 nativespace-cdp sshd[924409]: Connection closed by 159.100.136.21 port 42246 [preauth]
Sep  1 11:36:33 nativespace-cdp sshd[925482]: Connection closed by 159.100.136.21 port 52500 [preauth]
Sep  1 11:41:33 nativespace-cdp sshd[926893]: Connection closed by 159.100.136.21 port 34246 [preauth]
Sep  1 11:46:33 nativespace-cdp sshd[927944]: Connection closed by 159.100.136.21 port 44470 [preauth]
Sep  1 11:51:34 nativespace-cdp sshd[929156]: Connection closed by 159.100.136.21 port 54456 [preauth]
Sep  1 11:54:44 nativespace-cdp crond[929443]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:54:44 nativespace-cdp crond[929374]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:54:44 nativespace-cdp crond[929376]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:54:44 nativespace-cdp crond[929375]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:54:45 nativespace-cdp crond[929442]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929517]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929523]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929509]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929516]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929521]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929520]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929518]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929522]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929524]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929508]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929513]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929519]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929511]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929515]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929510]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929512]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929514]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:55:45 nativespace-cdp crond[929525]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:57:08 nativespace-cdp sshd[929700]: Did not receive identification string from 159.100.136.21 port 36324
Sep  1 11:57:54 nativespace-cdp crond[929722]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:57:54 nativespace-cdp crond[929721]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:57:54 nativespace-cdp crond[929723]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:57:54 nativespace-cdp crond[929658]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:57:54 nativespace-cdp crond[929659]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:58:30 nativespace-cdp crond[929891]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:58:30 nativespace-cdp crond[929892]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:58:30 nativespace-cdp crond[929893]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  1 11:59:08 nativespace-cdp sshd[930183]: Invalid user admin from 35.209.160.244 port 47316
Sep  1 11:59:08 nativespace-cdp sshd[930183]: input_userauth_request: invalid user admin [preauth]
Sep  1 11:59:09 nativespace-cdp sshd[930183]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 11:59:09 nativespace-cdp sshd[930183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.209.160.244
Sep  1 11:59:11 nativespace-cdp sshd[930183]: Failed password for invalid user admin from 35.209.160.244 port 47316 ssh2
Sep  1 11:59:12 nativespace-cdp sshd[930183]: Received disconnect from 35.209.160.244 port 47316:11: Bye Bye [preauth]
Sep  1 11:59:12 nativespace-cdp sshd[930183]: Disconnected from 35.209.160.244 port 47316 [preauth]
Sep  1 12:00:34 nativespace-cdp sshd[930994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.177.112  user=root
Sep  1 12:00:35 nativespace-cdp sshd[930994]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 12:00:37 nativespace-cdp sshd[930994]: Failed password for root from 64.227.177.112 port 52824 ssh2
Sep  1 12:00:37 nativespace-cdp sshd[930994]: Received disconnect from 64.227.177.112 port 52824:11: Bye Bye [preauth]
Sep  1 12:00:37 nativespace-cdp sshd[930994]: Disconnected from 64.227.177.112 port 52824 [preauth]
Sep  1 12:01:33 nativespace-cdp sshd[931278]: Connection closed by 159.100.136.21 port 46264 [preauth]
Sep  1 12:01:59 nativespace-cdp sshd[931458]: Invalid user burn from 157.245.104.97 port 56752
Sep  1 12:01:59 nativespace-cdp sshd[931458]: input_userauth_request: invalid user burn [preauth]
Sep  1 12:01:59 nativespace-cdp sshd[931458]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:01:59 nativespace-cdp sshd[931458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.104.97
Sep  1 12:02:01 nativespace-cdp sshd[931458]: Failed password for invalid user burn from 157.245.104.97 port 56752 ssh2
Sep  1 12:02:01 nativespace-cdp sshd[931458]: Received disconnect from 157.245.104.97 port 56752:11: Bye Bye [preauth]
Sep  1 12:02:01 nativespace-cdp sshd[931458]: Disconnected from 157.245.104.97 port 56752 [preauth]
Sep  1 12:02:04 nativespace-cdp sshd[931507]: Invalid user cwding from 72.167.42.160 port 37162
Sep  1 12:02:04 nativespace-cdp sshd[931507]: input_userauth_request: invalid user cwding [preauth]
Sep  1 12:02:04 nativespace-cdp sshd[931507]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:02:04 nativespace-cdp sshd[931507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.42.160
Sep  1 12:02:05 nativespace-cdp sshd[931507]: Failed password for invalid user cwding from 72.167.42.160 port 37162 ssh2
Sep  1 12:02:06 nativespace-cdp sshd[931507]: Received disconnect from 72.167.42.160 port 37162:11: Bye Bye [preauth]
Sep  1 12:02:06 nativespace-cdp sshd[931507]: Disconnected from 72.167.42.160 port 37162 [preauth]
Sep  1 12:02:41 nativespace-cdp sshd[931727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.82.57  user=root
Sep  1 12:02:41 nativespace-cdp sshd[931727]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 12:02:43 nativespace-cdp sshd[931727]: Failed password for root from 159.223.82.57 port 45028 ssh2
Sep  1 12:02:43 nativespace-cdp sshd[931727]: Received disconnect from 159.223.82.57 port 45028:11: Bye Bye [preauth]
Sep  1 12:02:43 nativespace-cdp sshd[931727]: Disconnected from 159.223.82.57 port 45028 [preauth]
Sep  1 12:02:55 nativespace-cdp sshd[931767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.238.32.247  user=root
Sep  1 12:02:55 nativespace-cdp sshd[931767]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 12:02:57 nativespace-cdp sshd[931767]: Failed password for root from 46.238.32.247 port 52664 ssh2
Sep  1 12:02:57 nativespace-cdp sshd[931767]: Received disconnect from 46.238.32.247 port 52664:11: Bye Bye [preauth]
Sep  1 12:02:57 nativespace-cdp sshd[931767]: Disconnected from 46.238.32.247 port 52664 [preauth]
Sep  1 12:03:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 12:03:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:03:11 nativespace-cdp sudo[931873]: pam_unix(sudo:session): session closed for user root
Sep  1 12:03:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status martsblo
Sep  1 12:03:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:03:12 nativespace-cdp sudo[931882]: pam_unix(sudo:session): session closed for user root
Sep  1 12:03:48 nativespace-cdp sshd[932175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.123.24  user=root
Sep  1 12:03:48 nativespace-cdp sshd[932175]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 12:03:50 nativespace-cdp sshd[932175]: Failed password for root from 167.99.123.24 port 40866 ssh2
Sep  1 12:03:50 nativespace-cdp sshd[932175]: Received disconnect from 167.99.123.24 port 40866:11: Bye Bye [preauth]
Sep  1 12:03:50 nativespace-cdp sshd[932175]: Disconnected from 167.99.123.24 port 40866 [preauth]
Sep  1 12:04:34 nativespace-cdp sshd[932355]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.177.112  user=root
Sep  1 12:04:34 nativespace-cdp sshd[932355]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 12:04:35 nativespace-cdp sshd[932355]: Failed password for root from 64.227.177.112 port 38240 ssh2
Sep  1 12:04:35 nativespace-cdp sshd[932355]: Received disconnect from 64.227.177.112 port 38240:11: Bye Bye [preauth]
Sep  1 12:04:35 nativespace-cdp sshd[932355]: Disconnected from 64.227.177.112 port 38240 [preauth]
Sep  1 12:04:48 nativespace-cdp sshd[932398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.238.32.247  user=root
Sep  1 12:04:48 nativespace-cdp sshd[932398]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 12:04:50 nativespace-cdp sshd[932398]: Failed password for root from 46.238.32.247 port 44572 ssh2
Sep  1 12:04:50 nativespace-cdp sshd[932398]: Received disconnect from 46.238.32.247 port 44572:11: Bye Bye [preauth]
Sep  1 12:04:50 nativespace-cdp sshd[932398]: Disconnected from 46.238.32.247 port 44572 [preauth]
Sep  1 12:04:56 nativespace-cdp sshd[932419]: Invalid user orb from 72.167.42.160 port 35300
Sep  1 12:04:56 nativespace-cdp sshd[932419]: input_userauth_request: invalid user orb [preauth]
Sep  1 12:04:56 nativespace-cdp sshd[932419]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:04:56 nativespace-cdp sshd[932419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.42.160
Sep  1 12:04:58 nativespace-cdp sshd[932419]: Failed password for invalid user orb from 72.167.42.160 port 35300 ssh2
Sep  1 12:04:58 nativespace-cdp sshd[932419]: Received disconnect from 72.167.42.160 port 35300:11: Bye Bye [preauth]
Sep  1 12:04:58 nativespace-cdp sshd[932419]: Disconnected from 72.167.42.160 port 35300 [preauth]
Sep  1 12:05:04 nativespace-cdp sshd[932546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.104.97  user=root
Sep  1 12:05:04 nativespace-cdp sshd[932546]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 12:05:06 nativespace-cdp sshd[932546]: Failed password for root from 157.245.104.97 port 36728 ssh2
Sep  1 12:05:06 nativespace-cdp sshd[932546]: Received disconnect from 157.245.104.97 port 36728:11: Bye Bye [preauth]
Sep  1 12:05:06 nativespace-cdp sshd[932546]: Disconnected from 157.245.104.97 port 36728 [preauth]
Sep  1 12:05:08 nativespace-cdp sshd[932562]: Invalid user cwding from 159.223.82.57 port 47844
Sep  1 12:05:08 nativespace-cdp sshd[932562]: input_userauth_request: invalid user cwding [preauth]
Sep  1 12:05:08 nativespace-cdp sshd[932562]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:05:08 nativespace-cdp sshd[932562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.82.57
Sep  1 12:05:10 nativespace-cdp sshd[932562]: Failed password for invalid user cwding from 159.223.82.57 port 47844 ssh2
Sep  1 12:05:11 nativespace-cdp sshd[932562]: Received disconnect from 159.223.82.57 port 47844:11: Bye Bye [preauth]
Sep  1 12:05:11 nativespace-cdp sshd[932562]: Disconnected from 159.223.82.57 port 47844 [preauth]
Sep  1 12:05:14 nativespace-cdp sshd[932586]: Invalid user ubi from 167.99.123.24 port 57530
Sep  1 12:05:14 nativespace-cdp sshd[932586]: input_userauth_request: invalid user ubi [preauth]
Sep  1 12:05:14 nativespace-cdp sshd[932586]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:05:14 nativespace-cdp sshd[932586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.123.24
Sep  1 12:05:16 nativespace-cdp sshd[932586]: Failed password for invalid user ubi from 167.99.123.24 port 57530 ssh2
Sep  1 12:05:16 nativespace-cdp sshd[932586]: Received disconnect from 167.99.123.24 port 57530:11: Bye Bye [preauth]
Sep  1 12:05:16 nativespace-cdp sshd[932586]: Disconnected from 167.99.123.24 port 57530 [preauth]
Sep  1 12:05:25 nativespace-cdp sshd[932662]: Invalid user mayowa from 64.227.177.112 port 47148
Sep  1 12:05:25 nativespace-cdp sshd[932662]: input_userauth_request: invalid user mayowa [preauth]
Sep  1 12:05:25 nativespace-cdp sshd[932662]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:05:25 nativespace-cdp sshd[932662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.177.112
Sep  1 12:05:28 nativespace-cdp sshd[932662]: Failed password for invalid user mayowa from 64.227.177.112 port 47148 ssh2
Sep  1 12:05:28 nativespace-cdp sshd[932662]: Received disconnect from 64.227.177.112 port 47148:11: Bye Bye [preauth]
Sep  1 12:05:28 nativespace-cdp sshd[932662]: Disconnected from 64.227.177.112 port 47148 [preauth]
Sep  1 12:05:31 nativespace-cdp sshd[932700]: Invalid user burn from 46.238.32.247 port 57550
Sep  1 12:05:31 nativespace-cdp sshd[932700]: input_userauth_request: invalid user burn [preauth]
Sep  1 12:05:31 nativespace-cdp sshd[932700]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:05:31 nativespace-cdp sshd[932700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.238.32.247
Sep  1 12:05:33 nativespace-cdp sshd[932700]: Failed password for invalid user burn from 46.238.32.247 port 57550 ssh2
Sep  1 12:05:33 nativespace-cdp sshd[932700]: Received disconnect from 46.238.32.247 port 57550:11: Bye Bye [preauth]
Sep  1 12:05:33 nativespace-cdp sshd[932700]: Disconnected from 46.238.32.247 port 57550 [preauth]
Sep  1 12:05:37 nativespace-cdp sshd[932745]: Invalid user burn from 72.167.42.160 port 48368
Sep  1 12:05:37 nativespace-cdp sshd[932745]: input_userauth_request: invalid user burn [preauth]
Sep  1 12:05:37 nativespace-cdp sshd[932745]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:05:37 nativespace-cdp sshd[932745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.42.160
Sep  1 12:05:39 nativespace-cdp sshd[932749]: Invalid user ddz from 35.209.160.244 port 41734
Sep  1 12:05:39 nativespace-cdp sshd[932749]: input_userauth_request: invalid user ddz [preauth]
Sep  1 12:05:39 nativespace-cdp sshd[932749]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:05:39 nativespace-cdp sshd[932749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.209.160.244
Sep  1 12:05:40 nativespace-cdp sshd[932745]: Failed password for invalid user burn from 72.167.42.160 port 48368 ssh2
Sep  1 12:05:40 nativespace-cdp sshd[932745]: Received disconnect from 72.167.42.160 port 48368:11: Bye Bye [preauth]
Sep  1 12:05:40 nativespace-cdp sshd[932745]: Disconnected from 72.167.42.160 port 48368 [preauth]
Sep  1 12:05:41 nativespace-cdp sshd[932749]: Failed password for invalid user ddz from 35.209.160.244 port 41734 ssh2
Sep  1 12:05:41 nativespace-cdp sshd[932749]: Received disconnect from 35.209.160.244 port 41734:11: Bye Bye [preauth]
Sep  1 12:05:41 nativespace-cdp sshd[932749]: Disconnected from 35.209.160.244 port 41734 [preauth]
Sep  1 12:05:52 nativespace-cdp sshd[932814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.104.97  user=root
Sep  1 12:05:52 nativespace-cdp sshd[932814]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 12:05:54 nativespace-cdp sshd[932814]: Failed password for root from 157.245.104.97 port 34738 ssh2
Sep  1 12:05:54 nativespace-cdp sshd[932821]: Invalid user cwding from 167.99.123.24 port 54060
Sep  1 12:05:54 nativespace-cdp sshd[932821]: input_userauth_request: invalid user cwding [preauth]
Sep  1 12:05:54 nativespace-cdp sshd[932821]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:05:54 nativespace-cdp sshd[932821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.123.24
Sep  1 12:05:54 nativespace-cdp sshd[932814]: Received disconnect from 157.245.104.97 port 34738:11: Bye Bye [preauth]
Sep  1 12:05:54 nativespace-cdp sshd[932814]: Disconnected from 157.245.104.97 port 34738 [preauth]
Sep  1 12:05:56 nativespace-cdp sshd[932821]: Failed password for invalid user cwding from 167.99.123.24 port 54060 ssh2
Sep  1 12:06:00 nativespace-cdp sshd[932887]: Invalid user burn from 159.223.82.57 port 35144
Sep  1 12:06:00 nativespace-cdp sshd[932887]: input_userauth_request: invalid user burn [preauth]
Sep  1 12:06:00 nativespace-cdp sshd[932887]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:06:00 nativespace-cdp sshd[932887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.82.57
Sep  1 12:06:02 nativespace-cdp sshd[932887]: Failed password for invalid user burn from 159.223.82.57 port 35144 ssh2
Sep  1 12:06:02 nativespace-cdp sshd[932887]: Received disconnect from 159.223.82.57 port 35144:11: Bye Bye [preauth]
Sep  1 12:06:02 nativespace-cdp sshd[932887]: Disconnected from 159.223.82.57 port 35144 [preauth]
Sep  1 12:06:34 nativespace-cdp sshd[933054]: Connection closed by 159.100.136.21 port 56598 [preauth]
Sep  1 12:06:42 nativespace-cdp sshd[933076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.209.160.244  user=root
Sep  1 12:06:42 nativespace-cdp sshd[933076]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 12:06:44 nativespace-cdp sshd[933076]: Failed password for root from 35.209.160.244 port 35918 ssh2
Sep  1 12:06:44 nativespace-cdp sshd[933076]: Received disconnect from 35.209.160.244 port 35918:11: Bye Bye [preauth]
Sep  1 12:06:44 nativespace-cdp sshd[933076]: Disconnected from 35.209.160.244 port 35918 [preauth]
Sep  1 12:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 12:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:09:56 nativespace-cdp sudo[933837]: pam_unix(sudo:session): session closed for user root
Sep  1 12:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 12:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:09:56 nativespace-cdp sudo[933841]: pam_unix(sudo:session): session closed for user root
Sep  1 12:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 12:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:09:57 nativespace-cdp sudo[933846]: pam_unix(sudo:session): session closed for user root
Sep  1 12:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 12:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:09:57 nativespace-cdp sudo[933854]: pam_unix(sudo:session): session closed for user root
Sep  1 12:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 12:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:09:59 nativespace-cdp sudo[933862]: pam_unix(sudo:session): session closed for user root
Sep  1 12:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 12:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:09:59 nativespace-cdp sudo[933877]: pam_unix(sudo:session): session closed for user root
Sep  1 12:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 12:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:09:59 nativespace-cdp sudo[933882]: pam_unix(sudo:session): session closed for user root
Sep  1 12:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 12:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:09:59 nativespace-cdp sudo[933886]: pam_unix(sudo:session): session closed for user root
Sep  1 12:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 12:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:09:59 nativespace-cdp sudo[933891]: pam_unix(sudo:session): session closed for user root
Sep  1 12:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 12:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:00 nativespace-cdp sudo[933896]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 12:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:00 nativespace-cdp sudo[933905]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 12:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:02 nativespace-cdp sudo[934021]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 12:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:04 nativespace-cdp sudo[934026]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=pars user-2=david user-3=careers user-4=nbhavers user-5=mcdermos user-6=chrisdal user-7=jennimil user-8=tomandle user-9=romaldki user-10=branko user-11=hodgsonmail user-12=ranxterc user-13=outdoorc user-14=onlycont user-15=lucy user-16=attlebor user-17=crrtipdl user-18=sosevalu user-19=bakery user-20=boldover user-21=nove user-22=design user-23=kategilpin user-24=stagingerris user-25=dancinggardener user-26=ladburyp user-27=nvihkvu user-28=havantho user-29=sketchy user-30=cath user-31=what user-32=oubpgvbx user-33=tstardom user-34=steve user-35=zebrapho user-36=bwppodcast user-37=asandcoc user-38=sibtoncc user-39=dhyana user-40=darkstar user-41=eatspam user-42=beauty user-43=nsceres user-44=fawcettd user-45=burydropin user-46=barbersh user-47=tigerlet user-48=nomistakes user-49=hidden
Sep  1 12:10:04 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=isleofwi user-51=smrszyqg user-52=donnychicago user-53=steakbridieme user-54=firstre5 user-55=ctedorgu user-56=philmcph user-57=lkpier user-58=leftie user-59=foods user-60=fortunaz user-61=health2045 user-62=nscdp user-63=putterfc user-64=courseme user-65=eugincou user-66=hirefootballgame user-67=cwsocial user-68=paulmca1 user-69=pugwash user-70=howardon user-71=ninejimm user-72=reliable user-73=cambria1 user-74=cathski user-75=highlegh user-76=southlon user-77=firstred user-78=costestimatorco user-79=firstrel user-80=clarkass user-81=coursemc user-82=opaiscyx user-83=firstres user-84=ultbcrra user-85=seftvta user-86=jonhartl user-87=thqkgnbz user-88=connectedshoppin user-89=ianrayne user-90=accooper user-91=fetch user-92=carsinyo user-93=hubmaster user-94=putterfi user-95=elecleis user-96=milloyco user-97=gilpin user-98=bemadonn user-99=newstoda user-100=ggaaorgu user-101=belle user-102=bedfords
Sep  1 12:10:04 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=oneoarco user-104=battlere user-105=vivienn1 user-106=firstre2 user-107=nstriton user-108=brighto1 user-109=nativene user-110=stuartge user-111=askhform user-112=innovat1 user-113=alexadmin user-114=skyfirec user-115=ulsukarm user-116=lbscrmod user-117=maflemin user-118=vantagep user-119=connect9 user-120=athenare user-121=markward user-122=booff user-123=foundation user-124=leereyn1 user-125=stephani user-126=agproduc user-127=still user-128=theblack user-129=hodgesonweb user-130=spectrum user-131=jarvisin user-132=megacards user-133=musorguk user-134=wilsonsw user-135=atestord user-136=sarafoundation user-137=strathar user-138=brmrjxl user-139=lakesan1 user-140=magichat user-141=hhdugcor user-142=lbhyisi user-143=ptkxhsbt user-144=dickemery123 user-145=martsblo feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 12:10:04 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 12:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:05 nativespace-cdp sudo[934051]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:06 nativespace-cdp sudo[934061]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1htoSpF9xDcQJ0Ri.~
Sep  1 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:06 nativespace-cdp sudo[934064]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1htoSpF9xDcQJ0Ri.~'
Sep  1 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:06 nativespace-cdp sudo[934067]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1htoSpF9xDcQJ0Ri.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:06 nativespace-cdp sudo[934071]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:06 nativespace-cdp sudo[934074]: pam_unix(sudo:session): session closed for user root
Sep  1 12:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 12:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 12:10:08 nativespace-cdp sudo[934099]: pam_unix(sudo:session): session closed for user root
Sep  1 12:11:33 nativespace-cdp sshd[934424]: Connection closed by 159.100.136.21 port 38318 [preauth]
Sep  1 12:16:33 nativespace-cdp sshd[935869]: Connection closed by 159.100.136.21 port 48534 [preauth]
Sep  1 12:21:33 nativespace-cdp sshd[937097]: Connection closed by 159.100.136.21 port 58508 [preauth]
Sep  1 12:26:33 nativespace-cdp sshd[938236]: Connection closed by 159.100.136.21 port 40520 [preauth]
Sep  1 12:31:33 nativespace-cdp sshd[939839]: Connection closed by 159.100.136.21 port 50566 [preauth]
Sep  1 12:36:33 nativespace-cdp sshd[940901]: Connection closed by 159.100.136.21 port 60860 [preauth]
Sep  1 12:41:33 nativespace-cdp sshd[942229]: Connection closed by 159.100.136.21 port 42588 [preauth]
Sep  1 12:46:33 nativespace-cdp sshd[943349]: Connection closed by 159.100.136.21 port 52778 [preauth]
Sep  1 12:51:33 nativespace-cdp sshd[944477]: Connection closed by 159.100.136.21 port 34562 [preauth]
Sep  1 12:56:33 nativespace-cdp sshd[945809]: Connection closed by 159.100.136.21 port 44808 [preauth]
Sep  1 12:58:21 nativespace-cdp sshd[946328]: Invalid user ftpuser from 212.62.96.129 port 49944
Sep  1 12:58:21 nativespace-cdp sshd[946328]: input_userauth_request: invalid user ftpuser [preauth]
Sep  1 12:58:21 nativespace-cdp sshd[946328]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:58:21 nativespace-cdp sshd[946328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.62.96.129
Sep  1 12:58:23 nativespace-cdp sshd[946328]: Failed password for invalid user ftpuser from 212.62.96.129 port 49944 ssh2
Sep  1 12:58:23 nativespace-cdp sshd[946328]: Received disconnect from 212.62.96.129 port 49944:11: Bye Bye [preauth]
Sep  1 12:58:23 nativespace-cdp sshd[946328]: Disconnected from 212.62.96.129 port 49944 [preauth]
Sep  1 12:58:39 nativespace-cdp sshd[946381]: Invalid user shiro from 159.203.112.234 port 48050
Sep  1 12:58:39 nativespace-cdp sshd[946381]: input_userauth_request: invalid user shiro [preauth]
Sep  1 12:58:39 nativespace-cdp sshd[946381]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 12:58:39 nativespace-cdp sshd[946381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.112.234
Sep  1 12:58:41 nativespace-cdp sshd[946381]: Failed password for invalid user shiro from 159.203.112.234 port 48050 ssh2
Sep  1 12:58:41 nativespace-cdp sshd[946381]: Received disconnect from 159.203.112.234 port 48050:11: Bye Bye [preauth]
Sep  1 12:58:41 nativespace-cdp sshd[946381]: Disconnected from 159.203.112.234 port 48050 [preauth]
Sep  1 13:01:33 nativespace-cdp sshd[947183]: Connection closed by 159.100.136.21 port 54798 [preauth]
Sep  1 13:01:40 nativespace-cdp sshd[947209]: Invalid user staging from 14.63.162.98 port 38859
Sep  1 13:01:40 nativespace-cdp sshd[947209]: input_userauth_request: invalid user staging [preauth]
Sep  1 13:01:40 nativespace-cdp sshd[947209]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 13:01:40 nativespace-cdp sshd[947209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.162.98
Sep  1 13:01:42 nativespace-cdp sshd[947209]: Failed password for invalid user staging from 14.63.162.98 port 38859 ssh2
Sep  1 13:01:43 nativespace-cdp sshd[947209]: Received disconnect from 14.63.162.98 port 38859:11: Bye Bye [preauth]
Sep  1 13:01:43 nativespace-cdp sshd[947209]: Disconnected from 14.63.162.98 port 38859 [preauth]
Sep  1 13:05:20 nativespace-cdp sshd[948054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.85.163.94  user=root
Sep  1 13:05:20 nativespace-cdp sshd[948054]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 13:05:22 nativespace-cdp sshd[948054]: Failed password for root from 34.85.163.94 port 55596 ssh2
Sep  1 13:05:22 nativespace-cdp sshd[948054]: Received disconnect from 34.85.163.94 port 55596:11: Bye Bye [preauth]
Sep  1 13:05:22 nativespace-cdp sshd[948054]: Disconnected from 34.85.163.94 port 55596 [preauth]
Sep  1 13:06:04 nativespace-cdp sshd[948248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.112.234  user=root
Sep  1 13:06:04 nativespace-cdp sshd[948248]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 13:06:06 nativespace-cdp sshd[948248]: Failed password for root from 159.203.112.234 port 53708 ssh2
Sep  1 13:06:06 nativespace-cdp sshd[948248]: Received disconnect from 159.203.112.234 port 53708:11: Bye Bye [preauth]
Sep  1 13:06:06 nativespace-cdp sshd[948248]: Disconnected from 159.203.112.234 port 53708 [preauth]
Sep  1 13:06:33 nativespace-cdp sshd[948326]: Connection closed by 159.100.136.21 port 36900 [preauth]
Sep  1 13:06:40 nativespace-cdp sshd[948352]: Invalid user ul from 212.62.96.129 port 50178
Sep  1 13:06:40 nativespace-cdp sshd[948352]: input_userauth_request: invalid user ul [preauth]
Sep  1 13:06:40 nativespace-cdp sshd[948352]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 13:06:40 nativespace-cdp sshd[948352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.62.96.129
Sep  1 13:06:43 nativespace-cdp sshd[948352]: Failed password for invalid user ul from 212.62.96.129 port 50178 ssh2
Sep  1 13:06:43 nativespace-cdp sshd[948352]: Received disconnect from 212.62.96.129 port 50178:11: Bye Bye [preauth]
Sep  1 13:06:43 nativespace-cdp sshd[948352]: Disconnected from 212.62.96.129 port 50178 [preauth]
Sep  1 13:06:47 nativespace-cdp sshd[948378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.112.234  user=root
Sep  1 13:06:47 nativespace-cdp sshd[948378]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 13:06:48 nativespace-cdp sshd[948378]: Failed password for root from 159.203.112.234 port 35470 ssh2
Sep  1 13:06:48 nativespace-cdp sshd[948378]: Received disconnect from 159.203.112.234 port 35470:11: Bye Bye [preauth]
Sep  1 13:06:48 nativespace-cdp sshd[948378]: Disconnected from 159.203.112.234 port 35470 [preauth]
Sep  1 13:07:07 nativespace-cdp sshd[948471]: Invalid user dishub from 14.63.162.98 port 59604
Sep  1 13:07:07 nativespace-cdp sshd[948471]: input_userauth_request: invalid user dishub [preauth]
Sep  1 13:07:07 nativespace-cdp sshd[948471]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 13:07:07 nativespace-cdp sshd[948471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.162.98
Sep  1 13:07:09 nativespace-cdp sshd[948471]: Failed password for invalid user dishub from 14.63.162.98 port 59604 ssh2
Sep  1 13:07:09 nativespace-cdp sshd[948471]: Received disconnect from 14.63.162.98 port 59604:11: Bye Bye [preauth]
Sep  1 13:07:09 nativespace-cdp sshd[948471]: Disconnected from 14.63.162.98 port 59604 [preauth]
Sep  1 13:07:24 nativespace-cdp sshd[948543]: Invalid user wululu from 212.62.96.129 port 50244
Sep  1 13:07:24 nativespace-cdp sshd[948543]: input_userauth_request: invalid user wululu [preauth]
Sep  1 13:07:24 nativespace-cdp sshd[948543]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 13:07:24 nativespace-cdp sshd[948543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.62.96.129
Sep  1 13:07:26 nativespace-cdp sshd[948543]: Failed password for invalid user wululu from 212.62.96.129 port 50244 ssh2
Sep  1 13:07:26 nativespace-cdp sshd[948543]: Received disconnect from 212.62.96.129 port 50244:11: Bye Bye [preauth]
Sep  1 13:07:26 nativespace-cdp sshd[948543]: Disconnected from 212.62.96.129 port 50244 [preauth]
Sep  1 13:07:56 nativespace-cdp sshd[948677]: Invalid user test1 from 14.63.162.98 port 37952
Sep  1 13:07:56 nativespace-cdp sshd[948677]: input_userauth_request: invalid user test1 [preauth]
Sep  1 13:07:56 nativespace-cdp sshd[948677]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 13:07:56 nativespace-cdp sshd[948677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.162.98
Sep  1 13:07:57 nativespace-cdp sshd[948677]: Failed password for invalid user test1 from 14.63.162.98 port 37952 ssh2
Sep  1 13:07:58 nativespace-cdp sshd[948677]: Received disconnect from 14.63.162.98 port 37952:11: Bye Bye [preauth]
Sep  1 13:07:58 nativespace-cdp sshd[948677]: Disconnected from 14.63.162.98 port 37952 [preauth]
Sep  1 13:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 13:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:00 nativespace-cdp sudo[949344]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 13:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:00 nativespace-cdp sudo[949349]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 13:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:02 nativespace-cdp sudo[949354]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 13:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:02 nativespace-cdp sudo[949482]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 13:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:07 nativespace-cdp sudo[949485]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 13:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:07 nativespace-cdp sudo[949507]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 13:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:07 nativespace-cdp sudo[949512]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 13:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:07 nativespace-cdp sudo[949515]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 13:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:07 nativespace-cdp sudo[949518]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 13:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:07 nativespace-cdp sudo[949521]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 13:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:07 nativespace-cdp sudo[949524]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 13:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:09 nativespace-cdp sudo[949533]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 13:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:10 nativespace-cdp sudo[949537]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=sosevalu user-2=crrtipdl user-3=bakery user-4=boldover user-5=nove user-6=design user-7=kategilpin user-8=ladburyp user-9=stagingerris user-10=dancinggardener user-11=nvihkvu user-12=cath user-13=sketchy user-14=havantho user-15=what user-16=tstardom user-17=oubpgvbx user-18=careers user-19=nbhavers user-20=david user-21=pars user-22=mcdermos user-23=chrisdal user-24=jennimil user-25=tomandle user-26=romaldki user-27=branko user-28=hodgsonmail user-29=outdoorc user-30=ranxterc user-31=onlycont user-32=attlebor user-33=lucy user-34=tigerlet user-35=barbersh user-36=hidden user-37=nomistakes user-38=smrszyqg user-39=isleofwi user-40=philmcph user-41=ctedorgu user-42=donnychicago user-43=firstre5 user-44=steakbridieme user-45=lkpier user-46=fortunaz user-47=health2045 user-48=foods user-49=leftie
Sep  1 13:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=putterfc user-51=nscdp user-52=courseme user-53=eugincou user-54=hirefootballgame user-55=paulmca1 user-56=howardon user-57=pugwash user-58=cwsocial user-59=ninejimm user-60=reliable user-61=cambria1 user-62=cathski user-63=steve user-64=zebrapho user-65=bwppodcast user-66=sibtoncc user-67=asandcoc user-68=dhyana user-69=eatspam user-70=darkstar user-71=beauty user-72=nsceres user-73=burydropin user-74=fawcettd user-75=bemadonn user-76=belle user-77=ggaaorgu user-78=newstoda user-79=bedfords user-80=battlere user-81=oneoarco user-82=firstre2 user-83=vivienn1 user-84=brighto1 user-85=nstriton user-86=nativene user-87=stuartge user-88=askhform user-89=innovat1 user-90=skyfirec user-91=alexadmin user-92=southlon user-93=highlegh user-94=firstred user-95=costestimatorco user-96=clarkass user-97=firstrel user-98=coursemc user-99=opaiscyx user-100=firstres user-101=seftvta user-102=jonhartl user-103=ultbcrra
Sep  1 13:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=thqkgnbz user-105=connectedshoppin user-106=ianrayne user-107=accooper user-108=carsinyo user-109=fetch user-110=hubmaster user-111=putterfi user-112=elecleis user-113=gilpin user-114=milloyco user-115=musorguk user-116=megacards user-117=wilsonsw user-118=sarafoundation user-119=atestord user-120=strathar user-121=lakesan1 user-122=brmrjxl user-123=magichat user-124=lbhyisi user-125=hhdugcor user-126=ptkxhsbt user-127=dickemery123 user-128=martsblo user-129=ulsukarm user-130=maflemin user-131=lbscrmod user-132=athenare user-133=connect9 user-134=vantagep user-135=markward user-136=booff user-137=foundation user-138=leereyn1 user-139=stephani user-140=still user-141=agproduc user-142=hodgesonweb user-143=theblack user-144=spectrum user-145=jarvisin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 13:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 13:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:12 nativespace-cdp sudo[949543]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 13:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:12 nativespace-cdp sudo[949551]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VUhUXWFxX0eTQa9M.~
Sep  1 13:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:12 nativespace-cdp sudo[949554]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VUhUXWFxX0eTQa9M.~'
Sep  1 13:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:12 nativespace-cdp sudo[949557]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VUhUXWFxX0eTQa9M.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 13:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:12 nativespace-cdp sudo[949561]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 13:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:12 nativespace-cdp sudo[949564]: pam_unix(sudo:session): session closed for user root
Sep  1 13:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 13:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 13:10:14 nativespace-cdp sudo[949586]: pam_unix(sudo:session): session closed for user root
Sep  1 13:11:33 nativespace-cdp sshd[949887]: Connection closed by 159.100.136.21 port 46860 [preauth]
Sep  1 13:12:20 nativespace-cdp sshd[950131]: Invalid user jelly from 34.85.163.94 port 33512
Sep  1 13:12:20 nativespace-cdp sshd[950131]: input_userauth_request: invalid user jelly [preauth]
Sep  1 13:12:20 nativespace-cdp sshd[950131]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 13:12:20 nativespace-cdp sshd[950131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.85.163.94
Sep  1 13:12:22 nativespace-cdp sshd[950131]: Failed password for invalid user jelly from 34.85.163.94 port 33512 ssh2
Sep  1 13:12:22 nativespace-cdp sshd[950131]: Received disconnect from 34.85.163.94 port 33512:11: Bye Bye [preauth]
Sep  1 13:12:22 nativespace-cdp sshd[950131]: Disconnected from 34.85.163.94 port 33512 [preauth]
Sep  1 13:13:09 nativespace-cdp sshd[950297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.85.163.94  user=root
Sep  1 13:13:09 nativespace-cdp sshd[950297]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 13:13:12 nativespace-cdp sshd[950297]: Failed password for root from 34.85.163.94 port 52414 ssh2
Sep  1 13:13:12 nativespace-cdp sshd[950297]: Received disconnect from 34.85.163.94 port 52414:11: Bye Bye [preauth]
Sep  1 13:13:12 nativespace-cdp sshd[950297]: Disconnected from 34.85.163.94 port 52414 [preauth]
Sep  1 13:16:33 nativespace-cdp sshd[951226]: Connection closed by 159.100.136.21 port 57074 [preauth]
Sep  1 13:21:34 nativespace-cdp sshd[953393]: Connection closed by 159.100.136.21 port 38796 [preauth]
Sep  1 13:26:33 nativespace-cdp sshd[955737]: Connection closed by 159.100.136.21 port 49058 [preauth]
Sep  1 13:31:33 nativespace-cdp sshd[958710]: Connection closed by 159.100.136.21 port 59104 [preauth]
Sep  1 13:36:33 nativespace-cdp sshd[962195]: Connection closed by 159.100.136.21 port 41136 [preauth]
Sep  1 13:41:33 nativespace-cdp sshd[963262]: Connection closed by 159.100.136.21 port 51112 [preauth]
Sep  1 13:46:33 nativespace-cdp sshd[964614]: Connection closed by 159.100.136.21 port 33098 [preauth]
Sep  1 13:51:33 nativespace-cdp sshd[965708]: Connection closed by 159.100.136.21 port 43102 [preauth]
Sep  1 13:56:33 nativespace-cdp sshd[967004]: Connection closed by 159.100.136.21 port 53380 [preauth]
Sep  1 14:01:33 nativespace-cdp sshd[968307]: Connection closed by 159.100.136.21 port 35090 [preauth]
Sep  1 14:06:33 nativespace-cdp sshd[969415]: Connection closed by 159.100.136.21 port 45398 [preauth]
Sep  1 14:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 14:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:01 nativespace-cdp sudo[970240]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 14:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:01 nativespace-cdp sudo[970249]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 14:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:04 nativespace-cdp sudo[970254]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 14:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:04 nativespace-cdp sudo[970283]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 14:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:10 nativespace-cdp sudo[970286]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 14:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:10 nativespace-cdp sudo[970310]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 14:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:10 nativespace-cdp sudo[970313]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 14:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:10 nativespace-cdp sudo[970316]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 14:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:10 nativespace-cdp sudo[970320]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 14:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:10 nativespace-cdp sudo[970323]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 14:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:10 nativespace-cdp sudo[970326]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 14:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:12 nativespace-cdp sudo[970340]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 14:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:13 nativespace-cdp sudo[970346]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nove user-2=boldover user-3=crrtipdl user-4=sosevalu user-5=bakery user-6=what user-7=tstardom user-8=oubpgvbx user-9=nvihkvu user-10=havantho user-11=cath user-12=sketchy user-13=kategilpin user-14=stagingerris user-15=dancinggardener user-16=ladburyp user-17=design user-18=tomandle user-19=jennimil user-20=mcdermos user-21=chrisdal user-22=pars user-23=david user-24=careers user-25=nbhavers user-26=lucy user-27=attlebor user-28=onlycont user-29=branko user-30=ranxterc user-31=hodgsonmail user-32=outdoorc user-33=romaldki user-34=foods user-35=leftie user-36=fortunaz user-37=health2045 user-38=nscdp user-39=putterfc user-40=steakbridieme user-41=donnychicago user-42=firstre5 user-43=ctedorgu user-44=philmcph user-45=lkpier user-46=smrszyqg user-47=isleofwi user-48=barbersh user-49=tigerlet
Sep  1 14:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=nomistakes user-51=hidden user-52=ninejimm user-53=reliable user-54=cambria1 user-55=cathski user-56=cwsocial user-57=paulmca1 user-58=pugwash user-59=howardon user-60=hirefootballgame user-61=courseme user-62=eugincou user-63=asandcoc user-64=sibtoncc user-65=zebrapho user-66=bwppodcast user-67=steve user-68=fawcettd user-69=burydropin user-70=nsceres user-71=darkstar user-72=eatspam user-73=beauty user-74=dhyana user-75=nstriton user-76=brighto1 user-77=oneoarco user-78=battlere user-79=vivienn1 user-80=firstre2 user-81=bedfords user-82=bemadonn user-83=newstoda user-84=belle user-85=ggaaorgu user-86=alexadmin user-87=skyfirec user-88=askhform user-89=stuartge user-90=innovat1 user-91=nativene user-92=firstres user-93=ultbcrra user-94=jonhartl user-95=seftvta user-96=opaiscyx user-97=coursemc user-98=costestimatorco user-99=firstrel user-100=clarkass user-101=highlegh user-102=southlon user-103=firstred
Sep  1 14:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=elecleis user-105=gilpin user-106=milloyco user-107=fetch user-108=carsinyo user-109=putterfi user-110=hubmaster user-111=ianrayne user-112=accooper user-113=thqkgnbz user-114=connectedshoppin user-115=lakesan1 user-116=brmrjxl user-117=atestord user-118=sarafoundation user-119=strathar user-120=wilsonsw user-121=megacards user-122=musorguk user-123=martsblo user-124=ptkxhsbt user-125=dickemery123 user-126=hhdugcor user-127=lbhyisi user-128=magichat user-129=foundation user-130=booff user-131=markward user-132=lbscrmod user-133=maflemin user-134=vantagep user-135=athenare user-136=connect9 user-137=ulsukarm user-138=jarvisin user-139=theblack user-140=hodgesonweb user-141=spectrum user-142=agproduc user-143=still user-144=leereyn1 user-145=stephani feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 14:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 14:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:15 nativespace-cdp sudo[970353]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:15 nativespace-cdp sudo[970359]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mDCwOIuZaTaVhaQv.~
Sep  1 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:15 nativespace-cdp sudo[970362]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mDCwOIuZaTaVhaQv.~'
Sep  1 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:15 nativespace-cdp sudo[970365]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mDCwOIuZaTaVhaQv.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:15 nativespace-cdp sudo[970369]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:15 nativespace-cdp sudo[970373]: pam_unix(sudo:session): session closed for user root
Sep  1 14:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 14:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 14:10:17 nativespace-cdp sudo[970399]: pam_unix(sudo:session): session closed for user root
Sep  1 14:11:33 nativespace-cdp sshd[970732]: Connection closed by 159.100.136.21 port 55386 [preauth]
Sep  1 14:15:40 nativespace-cdp sshd[972083]: Bad protocol version identification '\003' from 92.255.85.105 port 64784
Sep  1 14:16:33 nativespace-cdp sshd[972278]: Connection closed by 159.100.136.21 port 37362 [preauth]
Sep  1 14:21:33 nativespace-cdp sshd[973546]: Connection closed by 159.100.136.21 port 47336 [preauth]
Sep  1 14:26:33 nativespace-cdp sshd[974822]: Connection closed by 159.100.136.21 port 57566 [preauth]
Sep  1 14:31:33 nativespace-cdp sshd[976221]: Connection closed by 159.100.136.21 port 39386 [preauth]
Sep  1 14:36:33 nativespace-cdp sshd[977417]: Connection closed by 159.100.136.21 port 49682 [preauth]
Sep  1 14:41:33 nativespace-cdp sshd[978851]: Connection closed by 159.100.136.21 port 59616 [preauth]
Sep  1 14:41:39 nativespace-cdp sshd[978867]: Invalid user demouser from 159.65.147.20 port 56752
Sep  1 14:41:39 nativespace-cdp sshd[978867]: input_userauth_request: invalid user demouser [preauth]
Sep  1 14:41:39 nativespace-cdp sshd[978867]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:41:39 nativespace-cdp sshd[978867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.147.20
Sep  1 14:41:41 nativespace-cdp sshd[978867]: Failed password for invalid user demouser from 159.65.147.20 port 56752 ssh2
Sep  1 14:41:41 nativespace-cdp sshd[978867]: Received disconnect from 159.65.147.20 port 56752:11: Bye Bye [preauth]
Sep  1 14:41:41 nativespace-cdp sshd[978867]: Disconnected from 159.65.147.20 port 56752 [preauth]
Sep  1 14:42:28 nativespace-cdp sshd[979052]: Invalid user rn from 47.243.237.45 port 41068
Sep  1 14:42:28 nativespace-cdp sshd[979052]: input_userauth_request: invalid user rn [preauth]
Sep  1 14:42:28 nativespace-cdp sshd[979052]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:42:28 nativespace-cdp sshd[979052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.243.237.45
Sep  1 14:42:30 nativespace-cdp sshd[979052]: Failed password for invalid user rn from 47.243.237.45 port 41068 ssh2
Sep  1 14:42:30 nativespace-cdp sshd[979052]: Received disconnect from 47.243.237.45 port 41068:11: Bye Bye [preauth]
Sep  1 14:42:30 nativespace-cdp sshd[979052]: Disconnected from 47.243.237.45 port 41068 [preauth]
Sep  1 14:43:10 nativespace-cdp sshd[979180]: Invalid user User2 from 156.0.255.50 port 37200
Sep  1 14:43:10 nativespace-cdp sshd[979180]: input_userauth_request: invalid user User2 [preauth]
Sep  1 14:43:10 nativespace-cdp sshd[979180]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:43:10 nativespace-cdp sshd[979180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.0.255.50
Sep  1 14:43:12 nativespace-cdp sshd[979180]: Failed password for invalid user User2 from 156.0.255.50 port 37200 ssh2
Sep  1 14:43:12 nativespace-cdp sshd[979180]: Received disconnect from 156.0.255.50 port 37200:11: Bye Bye [preauth]
Sep  1 14:43:12 nativespace-cdp sshd[979180]: Disconnected from 156.0.255.50 port 37200 [preauth]
Sep  1 14:44:00 nativespace-cdp sshd[979338]: Invalid user admin from 202.157.184.3 port 51508
Sep  1 14:44:00 nativespace-cdp sshd[979338]: input_userauth_request: invalid user admin [preauth]
Sep  1 14:44:00 nativespace-cdp sshd[979338]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:44:00 nativespace-cdp sshd[979338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.184.3
Sep  1 14:44:02 nativespace-cdp sshd[979338]: Failed password for invalid user admin from 202.157.184.3 port 51508 ssh2
Sep  1 14:44:02 nativespace-cdp sshd[979338]: Received disconnect from 202.157.184.3 port 51508:11: Bye Bye [preauth]
Sep  1 14:44:02 nativespace-cdp sshd[979338]: Disconnected from 202.157.184.3 port 51508 [preauth]
Sep  1 14:45:13 nativespace-cdp sshd[979786]: Invalid user zh from 210.91.73.167 port 57666
Sep  1 14:45:13 nativespace-cdp sshd[979786]: input_userauth_request: invalid user zh [preauth]
Sep  1 14:45:13 nativespace-cdp sshd[979786]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:45:13 nativespace-cdp sshd[979786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.91.73.167
Sep  1 14:45:15 nativespace-cdp sshd[979786]: Failed password for invalid user zh from 210.91.73.167 port 57666 ssh2
Sep  1 14:45:15 nativespace-cdp sshd[979786]: Received disconnect from 210.91.73.167 port 57666:11: Bye Bye [preauth]
Sep  1 14:45:15 nativespace-cdp sshd[979786]: Disconnected from 210.91.73.167 port 57666 [preauth]
Sep  1 14:46:33 nativespace-cdp sshd[980192]: Connection closed by 159.100.136.21 port 41598 [preauth]
Sep  1 14:49:12 nativespace-cdp sshd[980641]: Invalid user sklep from 156.0.255.50 port 55474
Sep  1 14:49:12 nativespace-cdp sshd[980641]: input_userauth_request: invalid user sklep [preauth]
Sep  1 14:49:12 nativespace-cdp sshd[980641]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:49:12 nativespace-cdp sshd[980641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.0.255.50
Sep  1 14:49:14 nativespace-cdp sshd[980641]: Failed password for invalid user sklep from 156.0.255.50 port 55474 ssh2
Sep  1 14:49:14 nativespace-cdp sshd[980641]: Received disconnect from 156.0.255.50 port 55474:11: Bye Bye [preauth]
Sep  1 14:49:14 nativespace-cdp sshd[980641]: Disconnected from 156.0.255.50 port 55474 [preauth]
Sep  1 14:49:40 nativespace-cdp sshd[980769]: Invalid user user from 47.243.237.45 port 58500
Sep  1 14:49:40 nativespace-cdp sshd[980769]: input_userauth_request: invalid user user [preauth]
Sep  1 14:49:40 nativespace-cdp sshd[980769]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:49:40 nativespace-cdp sshd[980769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.243.237.45
Sep  1 14:49:41 nativespace-cdp sshd[980769]: Failed password for invalid user user from 47.243.237.45 port 58500 ssh2
Sep  1 14:49:42 nativespace-cdp sshd[980769]: Received disconnect from 47.243.237.45 port 58500:11: Bye Bye [preauth]
Sep  1 14:49:42 nativespace-cdp sshd[980769]: Disconnected from 47.243.237.45 port 58500 [preauth]
Sep  1 14:49:49 nativespace-cdp sshd[980800]: Invalid user fly from 210.91.73.167 port 39054
Sep  1 14:49:49 nativespace-cdp sshd[980800]: input_userauth_request: invalid user fly [preauth]
Sep  1 14:49:49 nativespace-cdp sshd[980800]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:49:49 nativespace-cdp sshd[980800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.91.73.167
Sep  1 14:49:51 nativespace-cdp sshd[980800]: Failed password for invalid user fly from 210.91.73.167 port 39054 ssh2
Sep  1 14:49:51 nativespace-cdp sshd[980800]: Received disconnect from 210.91.73.167 port 39054:11: Bye Bye [preauth]
Sep  1 14:49:51 nativespace-cdp sshd[980800]: Disconnected from 210.91.73.167 port 39054 [preauth]
Sep  1 14:49:55 nativespace-cdp sshd[980816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.147.20  user=root
Sep  1 14:49:55 nativespace-cdp sshd[980816]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 14:49:57 nativespace-cdp sshd[980816]: Failed password for root from 159.65.147.20 port 34408 ssh2
Sep  1 14:49:57 nativespace-cdp sshd[980816]: Received disconnect from 159.65.147.20 port 34408:11: Bye Bye [preauth]
Sep  1 14:49:57 nativespace-cdp sshd[980816]: Disconnected from 159.65.147.20 port 34408 [preauth]
Sep  1 14:50:05 nativespace-cdp sshd[980962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.0.255.50  user=root
Sep  1 14:50:05 nativespace-cdp sshd[980962]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 14:50:07 nativespace-cdp sshd[980962]: Failed password for root from 156.0.255.50 port 42506 ssh2
Sep  1 14:50:07 nativespace-cdp sshd[980962]: Received disconnect from 156.0.255.50 port 42506:11: Bye Bye [preauth]
Sep  1 14:50:07 nativespace-cdp sshd[980962]: Disconnected from 156.0.255.50 port 42506 [preauth]
Sep  1 14:50:19 nativespace-cdp sshd[981066]: Invalid user west from 202.157.184.3 port 40722
Sep  1 14:50:19 nativespace-cdp sshd[981066]: input_userauth_request: invalid user west [preauth]
Sep  1 14:50:19 nativespace-cdp sshd[981066]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:50:19 nativespace-cdp sshd[981066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.184.3
Sep  1 14:50:21 nativespace-cdp sshd[981066]: Failed password for invalid user west from 202.157.184.3 port 40722 ssh2
Sep  1 14:50:21 nativespace-cdp sshd[981066]: Received disconnect from 202.157.184.3 port 40722:11: Bye Bye [preauth]
Sep  1 14:50:21 nativespace-cdp sshd[981066]: Disconnected from 202.157.184.3 port 40722 [preauth]
Sep  1 14:50:29 nativespace-cdp sshd[981173]: Invalid user zh from 47.243.237.45 port 33362
Sep  1 14:50:29 nativespace-cdp sshd[981173]: input_userauth_request: invalid user zh [preauth]
Sep  1 14:50:29 nativespace-cdp sshd[981173]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:50:29 nativespace-cdp sshd[981173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.243.237.45
Sep  1 14:50:31 nativespace-cdp sshd[981173]: Failed password for invalid user zh from 47.243.237.45 port 33362 ssh2
Sep  1 14:50:42 nativespace-cdp sshd[981235]: Invalid user faisal from 210.91.73.167 port 54572
Sep  1 14:50:42 nativespace-cdp sshd[981235]: input_userauth_request: invalid user faisal [preauth]
Sep  1 14:50:42 nativespace-cdp sshd[981235]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 14:50:42 nativespace-cdp sshd[981235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.91.73.167
Sep  1 14:50:43 nativespace-cdp sshd[981235]: Failed password for invalid user faisal from 210.91.73.167 port 54572 ssh2
Sep  1 14:50:44 nativespace-cdp sshd[981235]: Received disconnect from 210.91.73.167 port 54572:11: Bye Bye [preauth]
Sep  1 14:50:44 nativespace-cdp sshd[981235]: Disconnected from 210.91.73.167 port 54572 [preauth]
Sep  1 14:50:49 nativespace-cdp sshd[981280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.147.20  user=root
Sep  1 14:50:49 nativespace-cdp sshd[981280]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 14:50:51 nativespace-cdp sshd[981280]: Failed password for root from 159.65.147.20 port 54064 ssh2
Sep  1 14:51:12 nativespace-cdp sshd[981369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.184.3  user=root
Sep  1 14:51:12 nativespace-cdp sshd[981369]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 14:51:15 nativespace-cdp sshd[981369]: Failed password for root from 202.157.184.3 port 53568 ssh2
Sep  1 14:51:15 nativespace-cdp sshd[981369]: Received disconnect from 202.157.184.3 port 53568:11: Bye Bye [preauth]
Sep  1 14:51:15 nativespace-cdp sshd[981369]: Disconnected from 202.157.184.3 port 53568 [preauth]
Sep  1 14:51:33 nativespace-cdp sshd[981454]: Connection closed by 159.100.136.21 port 51616 [preauth]
Sep  1 14:56:33 nativespace-cdp sshd[982858]: Connection closed by 159.100.136.21 port 33650 [preauth]
Sep  1 15:01:33 nativespace-cdp sshd[984061]: Connection closed by 159.100.136.21 port 43630 [preauth]
Sep  1 15:06:33 nativespace-cdp sshd[985303]: Connection closed by 159.100.136.21 port 53954 [preauth]
Sep  1 15:09:12 nativespace-cdp sshd[985947]: Invalid user opi from 89.44.47.158 port 56442
Sep  1 15:09:12 nativespace-cdp sshd[985947]: input_userauth_request: invalid user opi [preauth]
Sep  1 15:09:12 nativespace-cdp sshd[985947]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:09:12 nativespace-cdp sshd[985947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.44.47.158
Sep  1 15:09:14 nativespace-cdp sshd[985947]: Failed password for invalid user opi from 89.44.47.158 port 56442 ssh2
Sep  1 15:09:14 nativespace-cdp sshd[985947]: Received disconnect from 89.44.47.158 port 56442:11: Bye Bye [preauth]
Sep  1 15:09:14 nativespace-cdp sshd[985947]: Disconnected from 89.44.47.158 port 56442 [preauth]
Sep  1 15:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 15:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:02 nativespace-cdp sudo[986183]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 15:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:02 nativespace-cdp sudo[986195]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 15:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:05 nativespace-cdp sudo[986198]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 15:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:05 nativespace-cdp sudo[986233]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 15:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:08 nativespace-cdp sshd[986252]: Invalid user connie from 77.61.64.143 port 44930
Sep  1 15:10:08 nativespace-cdp sshd[986252]: input_userauth_request: invalid user connie [preauth]
Sep  1 15:10:08 nativespace-cdp sshd[986252]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:10:08 nativespace-cdp sshd[986252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.61.64.143
Sep  1 15:10:09 nativespace-cdp sudo[986236]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:09 nativespace-cdp sudo[986258]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:09 nativespace-cdp sudo[986261]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:09 nativespace-cdp sudo[986264]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:09 nativespace-cdp sudo[986267]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:09 nativespace-cdp sudo[986270]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:09 nativespace-cdp sudo[986273]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:11 nativespace-cdp sshd[986252]: Failed password for invalid user connie from 77.61.64.143 port 44930 ssh2
Sep  1 15:10:11 nativespace-cdp sshd[986252]: Received disconnect from 77.61.64.143 port 44930:11: Bye Bye [preauth]
Sep  1 15:10:11 nativespace-cdp sshd[986252]: Disconnected from 77.61.64.143 port 44930 [preauth]
Sep  1 15:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 15:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:13 nativespace-cdp sudo[986292]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 15:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:13 nativespace-cdp sudo[986297]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=firstre5 user-2=donnychicago user-3=steakbridieme user-4=philmcph user-5=ctedorgu user-6=lkpier user-7=leftie user-8=foods user-9=fortunaz user-10=health2045 user-11=nscdp user-12=putterfc user-13=barbersh user-14=tigerlet user-15=nomistakes user-16=hidden user-17=isleofwi user-18=smrszyqg user-19=cwsocial user-20=paulmca1 user-21=pugwash user-22=howardon user-23=ninejimm user-24=reliable user-25=cambria1 user-26=cathski user-27=courseme user-28=eugincou user-29=hirefootballgame user-30=asandcoc user-31=sibtoncc user-32=steve user-33=zebrapho user-34=bwppodcast user-35=nsceres user-36=fawcettd user-37=burydropin user-38=dhyana user-39=darkstar user-40=eatspam user-41=beauty user-42=boldover user-43=nove user-44=crrtipdl user-45=sosevalu user-46=bakery user-47=nvihkvu user-48=havantho
Sep  1 15:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=sketchy user-50=cath user-51=what user-52=oubpgvbx user-53=tstardom user-54=design user-55=kategilpin user-56=dancinggardener user-57=stagingerris user-58=ladburyp user-59=jennimil user-60=tomandle user-61=david user-62=pars user-63=careers user-64=nbhavers user-65=mcdermos user-66=chrisdal user-67=onlycont user-68=lucy user-69=attlebor user-70=romaldki user-71=branko user-72=ranxterc user-73=hodgsonmail user-74=outdoorc user-75=atestord user-76=sarafoundation user-77=strathar user-78=lakesan1 user-79=brmrjxl user-80=megacards user-81=musorguk user-82=wilsonsw user-83=ptkxhsbt user-84=dickemery123 user-85=martsblo user-86=magichat user-87=hhdugcor user-88=lbhyisi user-89=lbscrmod user-90=maflemin user-91=vantagep user-92=athenare user-93=connect9 user-94=booff user-95=markward user-96=foundation user-97=ulsukarm user-98=hodgesonweb user-99=theblack user-100=spectrum user-101=jarvisin user-102=leereyn1
Sep  1 15:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=stephani user-104=agproduc user-105=still user-106=oneoarco user-107=battlere user-108=vivienn1 user-109=firstre2 user-110=nstriton user-111=brighto1 user-112=bemadonn user-113=newstoda user-114=ggaaorgu user-115=belle user-116=bedfords user-117=skyfirec user-118=alexadmin user-119=nativene user-120=stuartge user-121=askhform user-122=innovat1 user-123=coursemc user-124=opaiscyx user-125=firstres user-126=ultbcrra user-127=jonhartl user-128=seftvta user-129=highlegh user-130=southlon user-131=firstred user-132=costestimatorco user-133=clarkass user-134=firstrel user-135=fetch user-136=carsinyo user-137=hubmaster user-138=putterfi user-139=elecleis user-140=milloyco user-141=gilpin user-142=thqkgnbz user-143=connectedshoppin user-144=ianrayne user-145=accooper feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 15:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 15:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:14 nativespace-cdp sudo[986303]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:15 nativespace-cdp sudo[986309]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Yituqf4nGh4PLAA7.~
Sep  1 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:15 nativespace-cdp sudo[986314]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Yituqf4nGh4PLAA7.~'
Sep  1 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:15 nativespace-cdp sudo[986317]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Yituqf4nGh4PLAA7.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:15 nativespace-cdp sudo[986321]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:15 nativespace-cdp sudo[986324]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 15:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 15:10:17 nativespace-cdp sudo[986347]: pam_unix(sudo:session): session closed for user root
Sep  1 15:10:17 nativespace-cdp sshd[986339]: Invalid user middleware from 103.149.143.20 port 30123
Sep  1 15:10:17 nativespace-cdp sshd[986339]: input_userauth_request: invalid user middleware [preauth]
Sep  1 15:10:17 nativespace-cdp sshd[986339]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:10:17 nativespace-cdp sshd[986339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.143.20
Sep  1 15:10:19 nativespace-cdp sshd[986339]: Failed password for invalid user middleware from 103.149.143.20 port 30123 ssh2
Sep  1 15:10:20 nativespace-cdp sshd[986339]: Received disconnect from 103.149.143.20 port 30123:11: Bye Bye [preauth]
Sep  1 15:10:20 nativespace-cdp sshd[986339]: Disconnected from 103.149.143.20 port 30123 [preauth]
Sep  1 15:11:13 nativespace-cdp sshd[986631]: Invalid user sysop from 160.22.173.209 port 54180
Sep  1 15:11:13 nativespace-cdp sshd[986631]: input_userauth_request: invalid user sysop [preauth]
Sep  1 15:11:13 nativespace-cdp sshd[986631]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:11:13 nativespace-cdp sshd[986631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.22.173.209
Sep  1 15:11:15 nativespace-cdp sshd[986631]: Failed password for invalid user sysop from 160.22.173.209 port 54180 ssh2
Sep  1 15:11:15 nativespace-cdp sshd[986631]: Received disconnect from 160.22.173.209 port 54180:11: Bye Bye [preauth]
Sep  1 15:11:15 nativespace-cdp sshd[986631]: Disconnected from 160.22.173.209 port 54180 [preauth]
Sep  1 15:11:33 nativespace-cdp sshd[986701]: Connection closed by 159.100.136.21 port 35680 [preauth]
Sep  1 15:13:08 nativespace-cdp sshd[987070]: Invalid user root2 from 159.203.129.103 port 38696
Sep  1 15:13:08 nativespace-cdp sshd[987070]: input_userauth_request: invalid user root2 [preauth]
Sep  1 15:13:08 nativespace-cdp sshd[987070]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:13:08 nativespace-cdp sshd[987070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.129.103
Sep  1 15:13:11 nativespace-cdp sshd[987070]: Failed password for invalid user root2 from 159.203.129.103 port 38696 ssh2
Sep  1 15:13:11 nativespace-cdp sshd[987070]: Received disconnect from 159.203.129.103 port 38696:11: Bye Bye [preauth]
Sep  1 15:13:11 nativespace-cdp sshd[987070]: Disconnected from 159.203.129.103 port 38696 [preauth]
Sep  1 15:15:07 nativespace-cdp sshd[987630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.44.47.158  user=root
Sep  1 15:15:07 nativespace-cdp sshd[987630]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 15:15:09 nativespace-cdp sshd[987630]: Failed password for root from 89.44.47.158 port 35260 ssh2
Sep  1 15:15:09 nativespace-cdp sshd[987630]: Received disconnect from 89.44.47.158 port 35260:11: Bye Bye [preauth]
Sep  1 15:15:09 nativespace-cdp sshd[987630]: Disconnected from 89.44.47.158 port 35260 [preauth]
Sep  1 15:15:50 nativespace-cdp sshd[987894]: Invalid user mina from 103.149.143.20 port 15628
Sep  1 15:15:50 nativespace-cdp sshd[987894]: input_userauth_request: invalid user mina [preauth]
Sep  1 15:15:50 nativespace-cdp sshd[987894]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:15:50 nativespace-cdp sshd[987894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.143.20
Sep  1 15:15:52 nativespace-cdp sshd[987894]: Failed password for invalid user mina from 103.149.143.20 port 15628 ssh2
Sep  1 15:15:52 nativespace-cdp sshd[987894]: Received disconnect from 103.149.143.20 port 15628:11: Bye Bye [preauth]
Sep  1 15:15:52 nativespace-cdp sshd[987894]: Disconnected from 103.149.143.20 port 15628 [preauth]
Sep  1 15:16:07 nativespace-cdp sshd[987955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.44.47.158  user=root
Sep  1 15:16:07 nativespace-cdp sshd[987955]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 15:16:09 nativespace-cdp sshd[987955]: Failed password for root from 89.44.47.158 port 54058 ssh2
Sep  1 15:16:09 nativespace-cdp sshd[987955]: Received disconnect from 89.44.47.158 port 54058:11: Bye Bye [preauth]
Sep  1 15:16:09 nativespace-cdp sshd[987955]: Disconnected from 89.44.47.158 port 54058 [preauth]
Sep  1 15:16:17 nativespace-cdp sshd[988014]: Invalid user dpt from 159.203.129.103 port 52777
Sep  1 15:16:17 nativespace-cdp sshd[988014]: input_userauth_request: invalid user dpt [preauth]
Sep  1 15:16:17 nativespace-cdp sshd[988014]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:16:17 nativespace-cdp sshd[988014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.129.103
Sep  1 15:16:19 nativespace-cdp sshd[988014]: Failed password for invalid user dpt from 159.203.129.103 port 52777 ssh2
Sep  1 15:16:19 nativespace-cdp sshd[988014]: Received disconnect from 159.203.129.103 port 52777:11: Bye Bye [preauth]
Sep  1 15:16:19 nativespace-cdp sshd[988014]: Disconnected from 159.203.129.103 port 52777 [preauth]
Sep  1 15:16:33 nativespace-cdp sshd[988123]: Connection closed by 159.100.136.21 port 45874 [preauth]
Sep  1 15:16:33 nativespace-cdp sshd[988125]: Invalid user zxx from 77.61.64.143 port 40585
Sep  1 15:16:33 nativespace-cdp sshd[988125]: input_userauth_request: invalid user zxx [preauth]
Sep  1 15:16:33 nativespace-cdp sshd[988125]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:16:33 nativespace-cdp sshd[988125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.61.64.143
Sep  1 15:16:35 nativespace-cdp sshd[988125]: Failed password for invalid user zxx from 77.61.64.143 port 40585 ssh2
Sep  1 15:16:35 nativespace-cdp sshd[988125]: Received disconnect from 77.61.64.143 port 40585:11: Bye Bye [preauth]
Sep  1 15:16:35 nativespace-cdp sshd[988125]: Disconnected from 77.61.64.143 port 40585 [preauth]
Sep  1 15:16:41 nativespace-cdp sshd[988138]: Invalid user romel from 103.149.143.20 port 28920
Sep  1 15:16:41 nativespace-cdp sshd[988138]: input_userauth_request: invalid user romel [preauth]
Sep  1 15:16:41 nativespace-cdp sshd[988138]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:16:41 nativespace-cdp sshd[988138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.143.20
Sep  1 15:16:44 nativespace-cdp sshd[988138]: Failed password for invalid user romel from 103.149.143.20 port 28920 ssh2
Sep  1 15:16:58 nativespace-cdp sshd[988225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.129.103  user=root
Sep  1 15:16:58 nativespace-cdp sshd[988225]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 15:17:00 nativespace-cdp sshd[988225]: Failed password for root from 159.203.129.103 port 59282 ssh2
Sep  1 15:17:00 nativespace-cdp sshd[988225]: Received disconnect from 159.203.129.103 port 59282:11: Bye Bye [preauth]
Sep  1 15:17:00 nativespace-cdp sshd[988225]: Disconnected from 159.203.129.103 port 59282 [preauth]
Sep  1 15:17:14 nativespace-cdp sshd[988306]: Invalid user ubuntu from 160.22.173.209 port 48908
Sep  1 15:17:14 nativespace-cdp sshd[988306]: input_userauth_request: invalid user ubuntu [preauth]
Sep  1 15:17:14 nativespace-cdp sshd[988306]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:17:14 nativespace-cdp sshd[988306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.22.173.209
Sep  1 15:17:17 nativespace-cdp sshd[988306]: Failed password for invalid user ubuntu from 160.22.173.209 port 48908 ssh2
Sep  1 15:17:17 nativespace-cdp sshd[988306]: Received disconnect from 160.22.173.209 port 48908:11: Bye Bye [preauth]
Sep  1 15:17:17 nativespace-cdp sshd[988306]: Disconnected from 160.22.173.209 port 48908 [preauth]
Sep  1 15:17:23 nativespace-cdp sshd[988340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.61.64.143  user=root
Sep  1 15:17:23 nativespace-cdp sshd[988340]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 15:17:26 nativespace-cdp sshd[988340]: Failed password for root from 77.61.64.143 port 47341 ssh2
Sep  1 15:17:26 nativespace-cdp sshd[988340]: Received disconnect from 77.61.64.143 port 47341:11: Bye Bye [preauth]
Sep  1 15:17:26 nativespace-cdp sshd[988340]: Disconnected from 77.61.64.143 port 47341 [preauth]
Sep  1 15:18:21 nativespace-cdp sshd[988510]: Invalid user omkar from 160.22.173.209 port 60660
Sep  1 15:18:21 nativespace-cdp sshd[988510]: input_userauth_request: invalid user omkar [preauth]
Sep  1 15:18:21 nativespace-cdp sshd[988510]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 15:18:21 nativespace-cdp sshd[988510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.22.173.209
Sep  1 15:18:22 nativespace-cdp sshd[988510]: Failed password for invalid user omkar from 160.22.173.209 port 60660 ssh2
Sep  1 15:18:23 nativespace-cdp sshd[988510]: Received disconnect from 160.22.173.209 port 60660:11: Bye Bye [preauth]
Sep  1 15:18:23 nativespace-cdp sshd[988510]: Disconnected from 160.22.173.209 port 60660 [preauth]
Sep  1 15:21:33 nativespace-cdp sshd[989441]: Connection closed by 159.100.136.21 port 55842 [preauth]
Sep  1 15:26:33 nativespace-cdp sshd[990709]: Connection closed by 159.100.136.21 port 37892 [preauth]
Sep  1 15:31:33 nativespace-cdp sshd[992090]: Connection closed by 159.100.136.21 port 47928 [preauth]
Sep  1 15:36:33 nativespace-cdp sshd[993147]: Connection closed by 159.100.136.21 port 58200 [preauth]
Sep  1 15:41:33 nativespace-cdp sshd[994304]: Connection closed by 159.100.136.21 port 39928 [preauth]
Sep  1 15:46:33 nativespace-cdp sshd[995782]: Connection closed by 159.100.136.21 port 50166 [preauth]
Sep  1 15:51:33 nativespace-cdp sshd[996858]: Connection closed by 159.100.136.21 port 60136 [preauth]
Sep  1 15:56:33 nativespace-cdp sshd[998179]: Connection closed by 159.100.136.21 port 42174 [preauth]
Sep  1 16:01:33 nativespace-cdp sshd[999523]: Connection closed by 159.100.136.21 port 52140 [preauth]
Sep  1 16:06:33 nativespace-cdp sshd[1000653]: Connection closed by 159.100.136.21 port 34242 [preauth]
Sep  1 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:56 nativespace-cdp sudo[1001320]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:56 nativespace-cdp sudo[1001324]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:57 nativespace-cdp sudo[1001329]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:57 nativespace-cdp sudo[1001335]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:59 nativespace-cdp sudo[1001341]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 16:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:59 nativespace-cdp sudo[1001354]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 16:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:59 nativespace-cdp sudo[1001359]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 16:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:59 nativespace-cdp sudo[1001363]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 16:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:59 nativespace-cdp sudo[1001368]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 16:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:59 nativespace-cdp sudo[1001373]: pam_unix(sudo:session): session closed for user root
Sep  1 16:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 16:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:09:59 nativespace-cdp sudo[1001379]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 16:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:02 nativespace-cdp sudo[1001480]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:02 nativespace-cdp sudo[1001485]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=eugincou user-2=courseme user-3=hirefootballgame user-4=pugwash user-5=paulmca1 user-6=howardon user-7=cwsocial user-8=cambria1 user-9=cathski user-10=ninejimm user-11=reliable user-12=hidden user-13=nomistakes user-14=barbersh user-15=tigerlet user-16=smrszyqg user-17=isleofwi user-18=lkpier user-19=philmcph user-20=ctedorgu user-21=donnychicago user-22=firstre5 user-23=steakbridieme user-24=putterfc user-25=nscdp user-26=fortunaz user-27=health2045 user-28=foods user-29=leftie user-30=dhyana user-31=beauty user-32=eatspam user-33=darkstar user-34=nsceres user-35=burydropin user-36=fawcettd user-37=steve user-38=bwppodcast user-39=zebrapho user-40=asandcoc user-41=sibtoncc user-42=design user-43=ladburyp user-44=dancinggardener user-45=stagingerris user-46=kategilpin user-47=sketchy
Sep  1 16:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=cath user-49=havantho user-50=nvihkvu user-51=oubpgvbx user-52=tstardom user-53=what user-54=bakery user-55=sosevalu user-56=crrtipdl user-57=boldover user-58=nove user-59=romaldki user-60=outdoorc user-61=hodgsonmail user-62=ranxterc user-63=branko user-64=onlycont user-65=attlebor user-66=lucy user-67=careers user-68=nbhavers user-69=pars user-70=david user-71=chrisdal user-72=mcdermos user-73=jennimil user-74=tomandle user-75=magichat user-76=lbhyisi user-77=hhdugcor user-78=dickemery123 user-79=ptkxhsbt user-80=martsblo user-81=musorguk user-82=megacards user-83=wilsonsw user-84=strathar user-85=sarafoundation user-86=atestord user-87=lakesan1 user-88=brmrjxl user-89=stephani user-90=leereyn1 user-91=still user-92=agproduc user-93=spectrum user-94=theblack user-95=hodgesonweb user-96=jarvisin user-97=ulsukarm user-98=connect9 user-99=athenare user-100=vantagep user-101=maflemin user-102=lbscrmod
Sep  1 16:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=booff user-104=foundation user-105=markward user-106=nativene user-107=innovat1 user-108=stuartge user-109=askhform user-110=skyfirec user-111=alexadmin user-112=belle user-113=ggaaorgu user-114=newstoda user-115=bemadonn user-116=bedfords user-117=firstre2 user-118=vivienn1 user-119=battlere user-120=oneoarco user-121=brighto1 user-122=nstriton user-123=connectedshoppin user-124=thqkgnbz user-125=accooper user-126=ianrayne user-127=hubmaster user-128=putterfi user-129=carsinyo user-130=fetch user-131=gilpin user-132=milloyco user-133=elecleis user-134=firstred user-135=southlon user-136=highlegh user-137=clarkass user-138=firstrel user-139=costestimatorco user-140=coursemc user-141=opaiscyx user-142=seftvta user-143=jonhartl user-144=ultbcrra user-145=firstres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 16:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:02 nativespace-cdp sudo[1001496]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 16:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:03 nativespace-cdp sudo[1001574]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-iCLi8jO9Fqbfoi7h.~
Sep  1 16:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:03 nativespace-cdp sudo[1001578]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-iCLi8jO9Fqbfoi7h.~'
Sep  1 16:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:04 nativespace-cdp sudo[1001581]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-iCLi8jO9Fqbfoi7h.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 16:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:04 nativespace-cdp sudo[1001585]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 16:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:04 nativespace-cdp sudo[1001588]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep  1 16:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:04 nativespace-cdp sudo[1001592]: pam_unix(sudo:session): session closed for user root
Sep  1 16:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 16:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 16:10:06 nativespace-cdp sudo[1001622]: pam_unix(sudo:session): session closed for user root
Sep  1 16:11:33 nativespace-cdp sshd[1001941]: Connection closed by 159.100.136.21 port 44194 [preauth]
Sep  1 16:16:33 nativespace-cdp sshd[1003305]: Connection closed by 159.100.136.21 port 54424 [preauth]
Sep  1 16:21:33 nativespace-cdp sshd[1004508]: Connection closed by 159.100.136.21 port 36146 [preauth]
Sep  1 16:26:33 nativespace-cdp sshd[1005989]: Connection closed by 159.100.136.21 port 46400 [preauth]
Sep  1 16:31:33 nativespace-cdp sshd[1007144]: Connection closed by 159.100.136.21 port 56440 [preauth]
Sep  1 16:36:33 nativespace-cdp sshd[1008219]: Connection closed by 159.100.136.21 port 38510 [preauth]
Sep  1 16:41:33 nativespace-cdp sshd[1009566]: Connection closed by 159.100.136.21 port 48456 [preauth]
Sep  1 16:46:33 nativespace-cdp sshd[1010698]: Connection closed by 159.100.136.21 port 58700 [preauth]
Sep  1 16:51:33 nativespace-cdp sshd[1011847]: Connection closed by 159.100.136.21 port 40430 [preauth]
Sep  1 16:56:33 nativespace-cdp sshd[1013012]: Connection closed by 159.100.136.21 port 50704 [preauth]
Sep  1 17:01:33 nativespace-cdp sshd[1014458]: Connection closed by 159.100.136.21 port 60690 [preauth]
Sep  1 17:06:33 nativespace-cdp sshd[1015582]: Connection closed by 159.100.136.21 port 42786 [preauth]
Sep  1 17:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 17:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:09:56 nativespace-cdp sudo[1016401]: pam_unix(sudo:session): session closed for user root
Sep  1 17:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 17:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:09:56 nativespace-cdp sudo[1016405]: pam_unix(sudo:session): session closed for user root
Sep  1 17:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 17:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:09:57 nativespace-cdp sudo[1016410]: pam_unix(sudo:session): session closed for user root
Sep  1 17:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 17:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:09:57 nativespace-cdp sudo[1016416]: pam_unix(sudo:session): session closed for user root
Sep  1 17:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 17:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:10 nativespace-cdp sudo[1016422]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:10 nativespace-cdp sudo[1016639]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:10 nativespace-cdp sudo[1016644]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:10 nativespace-cdp sudo[1016648]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:10 nativespace-cdp sudo[1016653]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:10 nativespace-cdp sudo[1016658]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:10 nativespace-cdp sudo[1016664]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 17:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:12 nativespace-cdp sudo[1016673]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 17:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:12 nativespace-cdp sudo[1016681]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=eatspam user-2=darkstar user-3=beauty user-4=dhyana user-5=burydropin user-6=fawcettd user-7=nsceres user-8=zebrapho user-9=bwppodcast user-10=steve user-11=asandcoc user-12=sibtoncc user-13=hirefootballgame user-14=courseme user-15=eugincou user-16=reliable user-17=ninejimm user-18=cambria1 user-19=cathski user-20=paulmca1 user-21=howardon user-22=pugwash user-23=cwsocial user-24=smrszyqg user-25=isleofwi user-26=tigerlet user-27=barbersh user-28=hidden user-29=nomistakes user-30=health2045 user-31=fortunaz user-32=foods user-33=leftie user-34=putterfc user-35=nscdp user-36=philmcph user-37=ctedorgu user-38=firstre5 user-39=donnychicago user-40=steakbridieme user-41=lkpier user-42=branko user-43=hodgsonmail user-44=outdoorc user-45=ranxterc user-46=romaldki user-47=attlebor user-48=lucy
Sep  1 17:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=mcdermos user-51=chrisdal user-52=nbhavers user-53=careers user-54=david user-55=pars user-56=tomandle user-57=jennimil user-58=kategilpin user-59=ladburyp user-60=dancinggardener user-61=stagingerris user-62=design user-63=what user-64=oubpgvbx user-65=tstardom user-66=nvihkvu user-67=cath user-68=sketchy user-69=havantho user-70=sosevalu user-71=crrtipdl user-72=bakery user-73=nove user-74=boldover user-75=still user-76=agproduc user-77=leereyn1 user-78=stephani user-79=jarvisin user-80=hodgesonweb user-81=theblack user-82=spectrum user-83=ulsukarm user-84=foundation user-85=booff user-86=markward user-87=maflemin user-88=lbscrmod user-89=athenare user-90=connect9 user-91=vantagep user-92=lbhyisi user-93=hhdugcor user-94=magichat user-95=martsblo user-96=ptkxhsbt user-97=dickemery123 user-98=wilsonsw user-99=musorguk user-100=megacards user-101=lakesan1 user-102=brmrjxl
Sep  1 17:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=sarafoundation user-104=atestord user-105=strathar user-106=ianrayne user-107=accooper user-108=thqkgnbz user-109=connectedshoppin user-110=elecleis user-111=gilpin user-112=milloyco user-113=carsinyo user-114=fetch user-115=hubmaster user-116=putterfi user-117=costestimatorco user-118=firstrel user-119=clarkass user-120=southlon user-121=highlegh user-122=firstred user-123=firstres user-124=jonhartl user-125=seftvta user-126=ultbcrra user-127=coursemc user-128=opaiscyx user-129=askhform user-130=stuartge user-131=innovat1 user-132=nativene user-133=skyfirec user-134=alexadmin user-135=bedfords user-136=bemadonn user-137=belle user-138=ggaaorgu user-139=newstoda user-140=brighto1 user-141=nstriton user-142=battlere user-143=oneoarco user-144=firstre2 user-145=vivienn1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 17:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 17:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:13 nativespace-cdp sudo[1016687]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 17:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:13 nativespace-cdp sudo[1016694]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-a2rTcRBiEnEr6PWk.~
Sep  1 17:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:13 nativespace-cdp sudo[1016699]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-a2rTcRBiEnEr6PWk.~'
Sep  1 17:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:13 nativespace-cdp sudo[1016703]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-a2rTcRBiEnEr6PWk.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 17:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:13 nativespace-cdp sudo[1016709]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 17:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:13 nativespace-cdp sudo[1016715]: pam_unix(sudo:session): session closed for user root
Sep  1 17:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 17:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 17:10:18 nativespace-cdp sudo[1016748]: pam_unix(sudo:session): session closed for user root
Sep  1 17:11:33 nativespace-cdp sshd[1017050]: Connection closed by 159.100.136.21 port 52752 [preauth]
Sep  1 17:16:33 nativespace-cdp sshd[1018165]: Connection closed by 159.100.136.21 port 34704 [preauth]
Sep  1 17:21:33 nativespace-cdp sshd[1019360]: Connection closed by 159.100.136.21 port 44690 [preauth]
Sep  1 17:26:33 nativespace-cdp sshd[1020454]: Connection closed by 159.100.136.21 port 54934 [preauth]
Sep  1 17:31:33 nativespace-cdp sshd[1021811]: Connection closed by 159.100.136.21 port 35706 [preauth]
Sep  1 17:36:33 nativespace-cdp sshd[1022955]: Connection closed by 159.100.136.21 port 45996 [preauth]
Sep  1 17:41:33 nativespace-cdp sshd[1024223]: Connection closed by 159.100.136.21 port 55960 [preauth]
Sep  1 17:46:33 nativespace-cdp sshd[1025681]: Connection closed by 159.100.136.21 port 37960 [preauth]
Sep  1 17:51:33 nativespace-cdp sshd[1026748]: Connection closed by 159.100.136.21 port 47922 [preauth]
Sep  1 17:56:33 nativespace-cdp sshd[1028045]: Connection closed by 159.100.136.21 port 58206 [preauth]
Sep  1 18:01:33 nativespace-cdp sshd[1029242]: Connection closed by 159.100.136.21 port 39956 [preauth]
Sep  1 18:06:33 nativespace-cdp sshd[1030357]: Connection closed by 159.100.136.21 port 50282 [preauth]
Sep  1 18:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 18:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:09:57 nativespace-cdp sudo[1031248]: pam_unix(sudo:session): session closed for user root
Sep  1 18:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 18:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:09:57 nativespace-cdp sudo[1031257]: pam_unix(sudo:session): session closed for user root
Sep  1 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:09:58 nativespace-cdp sudo[1031262]: pam_unix(sudo:session): session closed for user root
Sep  1 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:09:58 nativespace-cdp sudo[1031268]: pam_unix(sudo:session): session closed for user root
Sep  1 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:09:59 nativespace-cdp sudo[1031275]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:00 nativespace-cdp sudo[1031286]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:00 nativespace-cdp sudo[1031291]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:00 nativespace-cdp sudo[1031295]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:00 nativespace-cdp sudo[1031300]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:00 nativespace-cdp sudo[1031306]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:00 nativespace-cdp sudo[1031311]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 18:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:03 nativespace-cdp sudo[1031442]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 18:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:04 nativespace-cdp sudo[1031446]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=barbersh user-2=tigerlet user-3=nomistakes user-4=hidden user-5=smrszyqg user-6=isleofwi user-7=steakbridieme user-8=donnychicago user-9=firstre5 user-10=philmcph user-11=ctedorgu user-12=lkpier user-13=leftie user-14=foods user-15=fortunaz user-16=health2045 user-17=nscdp user-18=putterfc user-19=courseme user-20=eugincou user-21=hirefootballgame user-22=cwsocial user-23=pugwash user-24=paulmca1 user-25=howardon user-26=reliable user-27=ninejimm user-28=cambria1 user-29=cathski user-30=steve user-31=zebrapho user-32=bwppodcast user-33=sibtoncc user-34=asandcoc user-35=dhyana user-36=darkstar user-37=eatspam user-38=beauty user-39=nsceres user-40=fawcettd user-41=burydropin user-42=crrtipdl user-43=sosevalu user-44=bakery user-45=boldover user-46=nove user-47=design user-48=kategilpin
Sep  1 18:10:04 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=stagingerris user-50=dancinggardener user-51=ladburyp user-52=nvihkvu user-53=havantho user-54=sketchy user-55=cath user-56=what user-57=oubpgvbx user-58=tstardom user-59=pars user-60=david user-61=nbhavers user-62=careers user-63=mcdermos user-64=chrisdal user-65=jennimil user-66=tomandle user-67=romaldki user-68=branko user-69=ranxterc user-70=hodgsonmail user-71=outdoorc user-72=onlycont user-73=lucy user-74=attlebor user-75=megacards user-76=musorguk user-77=wilsonsw user-78=atestord user-79=sarafoundation user-80=strathar user-81=brmrjxl user-82=lakesan1 user-83=magichat user-84=hhdugcor user-85=lbhyisi user-86=ptkxhsbt user-87=dickemery123 user-88=martsblo user-89=ulsukarm user-90=lbscrmod user-91=maflemin user-92=vantagep user-93=athenare user-94=connect9 user-95=booff user-96=markward user-97=foundation user-98=leereyn1 user-99=stephani user-100=agproduc user-101=still user-102=hodgesonweb
Sep  1 18:10:04 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=theblack user-104=spectrum user-105=jarvisin user-106=bemadonn user-107=newstoda user-108=belle user-109=ggaaorgu user-110=bedfords user-111=oneoarco user-112=battlere user-113=vivienn1 user-114=firstre2 user-115=nstriton user-116=brighto1 user-117=nativene user-118=stuartge user-119=askhform user-120=innovat1 user-121=alexadmin user-122=skyfirec user-123=highlegh user-124=southlon user-125=firstred user-126=costestimatorco user-127=firstrel user-128=clarkass user-129=opaiscyx user-130=coursemc user-131=firstres user-132=ultbcrra user-133=jonhartl user-134=seftvta user-135=thqkgnbz user-136=connectedshoppin user-137=ianrayne user-138=accooper user-139=fetch user-140=carsinyo user-141=putterfi user-142=hubmaster user-143=elecleis user-144=gilpin user-145=milloyco feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 18:10:04 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 18:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:05 nativespace-cdp sudo[1031451]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:05 nativespace-cdp sudo[1031462]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DTxUOcoCKK2HELY2.~
Sep  1 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:05 nativespace-cdp sudo[1031465]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DTxUOcoCKK2HELY2.~'
Sep  1 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:05 nativespace-cdp sudo[1031468]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DTxUOcoCKK2HELY2.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:05 nativespace-cdp sudo[1031472]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:05 nativespace-cdp sudo[1031478]: pam_unix(sudo:session): session closed for user root
Sep  1 18:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 18:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 18:10:07 nativespace-cdp sudo[1031497]: pam_unix(sudo:session): session closed for user root
Sep  1 18:11:33 nativespace-cdp sshd[1031811]: Connection closed by 159.100.136.21 port 60230 [preauth]
Sep  1 18:16:33 nativespace-cdp sshd[1032998]: Connection closed by 159.100.136.21 port 42208 [preauth]
Sep  1 18:21:33 nativespace-cdp sshd[1034076]: Connection closed by 159.100.136.21 port 52166 [preauth]
Sep  1 18:26:33 nativespace-cdp sshd[1035155]: Connection closed by 159.100.136.21 port 33626 [preauth]
Sep  1 18:26:40 nativespace-cdp sshd[1035152]: Accepted publickey for root from 185.67.178.249 port 49908 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  1 18:26:40 nativespace-cdp sshd[1035152]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  1 18:31:33 nativespace-cdp sshd[1050777]: Connection closed by 159.100.136.21 port 43568 [preauth]
Sep  1 18:36:33 nativespace-cdp sshd[1060253]: Connection closed by 159.100.136.21 port 53866 [preauth]
Sep  1 18:41:33 nativespace-cdp sshd[1065704]: Connection closed by 159.100.136.21 port 35606 [preauth]
Sep  1 18:46:33 nativespace-cdp sshd[1066854]: Connection closed by 159.100.136.21 port 45798 [preauth]
Sep  1 18:51:33 nativespace-cdp sshd[1067948]: Connection closed by 159.100.136.21 port 55806 [preauth]
Sep  1 18:56:33 nativespace-cdp sshd[1069032]: Connection closed by 159.100.136.21 port 37822 [preauth]
Sep  1 19:01:33 nativespace-cdp sshd[1070409]: Connection closed by 159.100.136.21 port 47816 [preauth]
Sep  1 19:06:33 nativespace-cdp sshd[1071482]: Connection closed by 159.100.136.21 port 58142 [preauth]
Sep  1 19:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 19:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:09:57 nativespace-cdp sudo[1072350]: pam_unix(sudo:session): session closed for user root
Sep  1 19:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 19:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:09:57 nativespace-cdp sudo[1072360]: pam_unix(sudo:session): session closed for user root
Sep  1 19:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 19:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:09:59 nativespace-cdp sudo[1072368]: pam_unix(sudo:session): session closed for user root
Sep  1 19:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 19:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:09:59 nativespace-cdp sudo[1072397]: pam_unix(sudo:session): session closed for user root
Sep  1 19:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 19:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:02 nativespace-cdp sudo[1072400]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 19:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:03 nativespace-cdp sudo[1072536]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 19:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:03 nativespace-cdp sudo[1072539]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 19:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:03 nativespace-cdp sudo[1072542]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 19:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:03 nativespace-cdp sudo[1072545]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 19:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:03 nativespace-cdp sudo[1072548]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 19:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:03 nativespace-cdp sudo[1072552]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 19:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:06 nativespace-cdp sudo[1072572]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 19:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:06 nativespace-cdp sudo[1072577]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=cwsocial user-2=pugwash user-3=paulmca1 user-4=howardon user-5=ninejimm user-6=reliable user-7=cambria1 user-8=cathski user-9=courseme user-10=eugincou user-11=hirefootballgame user-12=donnychicago user-13=firstre5 user-14=steakbridieme user-15=ctedorgu user-16=philmcph user-17=lkpier user-18=leftie user-19=foods user-20=health2045 user-21=fortunaz user-22=nscdp user-23=putterfc user-24=barbersh user-25=tigerlet user-26=nomistakes user-27=hidden user-28=smrszyqg user-29=isleofwi user-30=nsceres user-31=fawcettd user-32=burydropin user-33=dhyana user-34=darkstar user-35=eatspam user-36=beauty user-37=sibtoncc user-38=asandcoc user-39=steve user-40=zebrapho user-41=bwppodcast user-42=nvihkvu user-43=havantho user-44=cath user-45=sketchy user-46=what user-47=tstardom user-48=oubpgvbx user-49=design
Sep  1 19:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=kategilpin user-51=dancinggardener user-52=stagingerris user-53=ladburyp user-54=boldover user-55=nove user-56=crrtipdl user-57=sosevalu user-58=bakery user-59=onlycont user-60=lucy user-61=attlebor user-62=romaldki user-63=branko user-64=ranxterc user-65=hodgsonmail user-66=outdoorc user-67=jennimil user-68=tomandle user-69=pars user-70=david user-71=nbhavers user-72=careers user-73=mcdermos user-74=chrisdal user-75=ptkxhsbt user-76=dickemery123 user-77=martsblo user-78=magichat user-79=hhdugcor user-80=lbhyisi user-81=atestord user-82=sarafoundation user-83=strathar user-84=lakesan1 user-85=brmrjxl user-86=megacards user-87=musorguk user-88=wilsonsw user-89=hodgesonweb user-90=theblack user-91=spectrum user-92=jarvisin user-93=leereyn1 user-94=stephani user-95=agproduc user-96=still user-97=lbscrmod user-98=maflemin user-99=vantagep user-100=connect9 user-101=athenare user-102=foundation user-103=booff
Sep  1 19:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=markward user-105=ulsukarm user-106=skyfirec user-107=alexadmin user-108=nativene user-109=stuartge user-110=askhform user-111=innovat1 user-112=oneoarco user-113=battlere user-114=vivienn1 user-115=firstre2 user-116=nstriton user-117=brighto1 user-118=bemadonn user-119=newstoda user-120=belle user-121=ggaaorgu user-122=bedfords user-123=fetch user-124=carsinyo user-125=hubmaster user-126=putterfi user-127=elecleis user-128=gilpin user-129=milloyco user-130=thqkgnbz user-131=connectedshoppin user-132=ianrayne user-133=accooper user-134=coursemc user-135=opaiscyx user-136=firstres user-137=ultbcrra user-138=jonhartl user-139=seftvta user-140=highlegh user-141=southlon user-142=firstred user-143=costestimatorco user-144=firstrel user-145=clarkass feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 19:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 19:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:07 nativespace-cdp sudo[1072582]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 19:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:07 nativespace-cdp sudo[1072588]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ys4OgOuKvNPryDrA.~
Sep  1 19:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:07 nativespace-cdp sudo[1072591]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ys4OgOuKvNPryDrA.~'
Sep  1 19:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:07 nativespace-cdp sudo[1072594]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ys4OgOuKvNPryDrA.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 19:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:07 nativespace-cdp sudo[1072598]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 19:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:07 nativespace-cdp sudo[1072601]: pam_unix(sudo:session): session closed for user root
Sep  1 19:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 19:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 19:10:09 nativespace-cdp sudo[1072622]: pam_unix(sudo:session): session closed for user root
Sep  1 19:11:33 nativespace-cdp sshd[1072900]: Connection closed by 159.100.136.21 port 39866 [preauth]
Sep  1 19:16:34 nativespace-cdp sshd[1074059]: Connection closed by 159.100.136.21 port 50094 [preauth]
Sep  1 19:21:33 nativespace-cdp sshd[1075146]: Connection closed by 159.100.136.21 port 60042 [preauth]
Sep  1 19:26:33 nativespace-cdp sshd[1076275]: Connection closed by 159.100.136.21 port 42082 [preauth]
Sep  1 19:31:33 nativespace-cdp sshd[1077575]: Connection closed by 159.100.136.21 port 52108 [preauth]
Sep  1 19:36:33 nativespace-cdp sshd[1078680]: Connection closed by 159.100.136.21 port 33186 [preauth]
Sep  1 19:40:31 nativespace-cdp sshd[1079745]: Invalid user marco from 183.88.232.183 port 52972
Sep  1 19:40:31 nativespace-cdp sshd[1079745]: input_userauth_request: invalid user marco [preauth]
Sep  1 19:40:31 nativespace-cdp sshd[1079745]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 19:40:31 nativespace-cdp sshd[1079745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.88.232.183
Sep  1 19:40:34 nativespace-cdp sshd[1079745]: Failed password for invalid user marco from 183.88.232.183 port 52972 ssh2
Sep  1 19:40:34 nativespace-cdp sshd[1079745]: Received disconnect from 183.88.232.183 port 52972:11: Bye Bye [preauth]
Sep  1 19:40:34 nativespace-cdp sshd[1079745]: Disconnected from 183.88.232.183 port 52972 [preauth]
Sep  1 19:41:33 nativespace-cdp sshd[1079989]: Connection closed by 159.100.136.21 port 43152 [preauth]
Sep  1 19:42:11 nativespace-cdp sshd[1080145]: Invalid user oa from 183.88.232.183 port 43074
Sep  1 19:42:11 nativespace-cdp sshd[1080145]: input_userauth_request: invalid user oa [preauth]
Sep  1 19:42:11 nativespace-cdp sshd[1080145]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 19:42:11 nativespace-cdp sshd[1080145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.88.232.183
Sep  1 19:42:13 nativespace-cdp sshd[1080145]: Failed password for invalid user oa from 183.88.232.183 port 43074 ssh2
Sep  1 19:42:13 nativespace-cdp sshd[1080145]: Received disconnect from 183.88.232.183 port 43074:11: Bye Bye [preauth]
Sep  1 19:42:13 nativespace-cdp sshd[1080145]: Disconnected from 183.88.232.183 port 43074 [preauth]
Sep  1 19:42:59 nativespace-cdp sshd[1080352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.88.232.183  user=root
Sep  1 19:42:59 nativespace-cdp sshd[1080352]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 19:43:01 nativespace-cdp sshd[1080352]: Failed password for root from 183.88.232.183 port 56228 ssh2
Sep  1 19:43:01 nativespace-cdp sshd[1080352]: Received disconnect from 183.88.232.183 port 56228:11: Bye Bye [preauth]
Sep  1 19:43:01 nativespace-cdp sshd[1080352]: Disconnected from 183.88.232.183 port 56228 [preauth]
Sep  1 19:46:33 nativespace-cdp sshd[1081242]: Connection closed by 159.100.136.21 port 53366 [preauth]
Sep  1 19:50:47 nativespace-cdp sshd[1082182]: Invalid user bella from 51.79.159.66 port 38346
Sep  1 19:50:47 nativespace-cdp sshd[1082182]: input_userauth_request: invalid user bella [preauth]
Sep  1 19:50:47 nativespace-cdp sshd[1082182]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 19:50:47 nativespace-cdp sshd[1082182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.159.66
Sep  1 19:50:49 nativespace-cdp sshd[1082182]: Failed password for invalid user bella from 51.79.159.66 port 38346 ssh2
Sep  1 19:50:49 nativespace-cdp sshd[1082182]: Received disconnect from 51.79.159.66 port 38346:11: Bye Bye [preauth]
Sep  1 19:50:49 nativespace-cdp sshd[1082182]: Disconnected from 51.79.159.66 port 38346 [preauth]
Sep  1 19:51:21 nativespace-cdp sshd[1082298]: Invalid user wikijs from 27.71.25.96 port 50840
Sep  1 19:51:21 nativespace-cdp sshd[1082298]: input_userauth_request: invalid user wikijs [preauth]
Sep  1 19:51:21 nativespace-cdp sshd[1082298]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 19:51:21 nativespace-cdp sshd[1082298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.25.96
Sep  1 19:51:23 nativespace-cdp sshd[1082298]: Failed password for invalid user wikijs from 27.71.25.96 port 50840 ssh2
Sep  1 19:51:23 nativespace-cdp sshd[1082298]: Received disconnect from 27.71.25.96 port 50840:11: Bye Bye [preauth]
Sep  1 19:51:23 nativespace-cdp sshd[1082298]: Disconnected from 27.71.25.96 port 50840 [preauth]
Sep  1 19:51:33 nativespace-cdp sshd[1082327]: Connection closed by 159.100.136.21 port 35158 [preauth]
Sep  1 19:55:22 nativespace-cdp sshd[1083377]: Invalid user www-data from 27.71.25.96 port 49934
Sep  1 19:55:22 nativespace-cdp sshd[1083377]: input_userauth_request: invalid user www-data [preauth]
Sep  1 19:55:22 nativespace-cdp sshd[1083377]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 19:55:22 nativespace-cdp sshd[1083377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.25.96
Sep  1 19:55:24 nativespace-cdp sshd[1083377]: Failed password for invalid user www-data from 27.71.25.96 port 49934 ssh2
Sep  1 19:55:24 nativespace-cdp sshd[1083377]: Received disconnect from 27.71.25.96 port 49934:11: Bye Bye [preauth]
Sep  1 19:55:24 nativespace-cdp sshd[1083377]: Disconnected from 27.71.25.96 port 49934 [preauth]
Sep  1 19:55:44 nativespace-cdp sshd[1083479]: Invalid user wikijs from 51.79.159.66 port 36140
Sep  1 19:55:44 nativespace-cdp sshd[1083479]: input_userauth_request: invalid user wikijs [preauth]
Sep  1 19:55:44 nativespace-cdp sshd[1083479]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 19:55:44 nativespace-cdp sshd[1083479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.159.66
Sep  1 19:55:46 nativespace-cdp sshd[1083479]: Failed password for invalid user wikijs from 51.79.159.66 port 36140 ssh2
Sep  1 19:55:46 nativespace-cdp sshd[1083479]: Received disconnect from 51.79.159.66 port 36140:11: Bye Bye [preauth]
Sep  1 19:55:46 nativespace-cdp sshd[1083479]: Disconnected from 51.79.159.66 port 36140 [preauth]
Sep  1 19:56:16 nativespace-cdp sshd[1083587]: Invalid user admin from 27.71.25.96 port 50340
Sep  1 19:56:16 nativespace-cdp sshd[1083587]: input_userauth_request: invalid user admin [preauth]
Sep  1 19:56:16 nativespace-cdp sshd[1083587]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 19:56:16 nativespace-cdp sshd[1083587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.25.96
Sep  1 19:56:18 nativespace-cdp sshd[1083587]: Failed password for invalid user admin from 27.71.25.96 port 50340 ssh2
Sep  1 19:56:33 nativespace-cdp sshd[1083647]: Connection closed by 159.100.136.21 port 45404 [preauth]
Sep  1 19:56:36 nativespace-cdp sshd[1083652]: Invalid user q from 51.79.159.66 port 60014
Sep  1 19:56:36 nativespace-cdp sshd[1083652]: input_userauth_request: invalid user q [preauth]
Sep  1 19:56:36 nativespace-cdp sshd[1083652]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 19:56:36 nativespace-cdp sshd[1083652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.159.66
Sep  1 19:56:37 nativespace-cdp sshd[1083652]: Failed password for invalid user q from 51.79.159.66 port 60014 ssh2
Sep  1 19:56:37 nativespace-cdp sshd[1083652]: Received disconnect from 51.79.159.66 port 60014:11: Bye Bye [preauth]
Sep  1 19:56:37 nativespace-cdp sshd[1083652]: Disconnected from 51.79.159.66 port 60014 [preauth]
Sep  1 20:01:33 nativespace-cdp sshd[1084882]: Connection closed by 159.100.136.21 port 55392 [preauth]
Sep  1 20:06:33 nativespace-cdp sshd[1085913]: Connection closed by 159.100.136.21 port 37336 [preauth]
Sep  1 20:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 20:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:01 nativespace-cdp sudo[1086680]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 20:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:01 nativespace-cdp sudo[1086687]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 20:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:03 nativespace-cdp sudo[1086691]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 20:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:03 nativespace-cdp sudo[1086720]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 20:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:06 nativespace-cdp sudo[1086725]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 20:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:06 nativespace-cdp sudo[1086738]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 20:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:06 nativespace-cdp sudo[1086741]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 20:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:06 nativespace-cdp sudo[1086744]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 20:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:06 nativespace-cdp sudo[1086747]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 20:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:06 nativespace-cdp sudo[1086751]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 20:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:07 nativespace-cdp sudo[1086754]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 20:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:09 nativespace-cdp sudo[1086769]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 20:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:09 nativespace-cdp sudo[1086773]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=design user-2=kategilpin user-3=stagingerris user-4=dancinggardener user-5=ladburyp user-6=nvihkvu user-7=havantho user-8=cath user-9=sketchy user-10=what user-11=oubpgvbx user-12=tstardom user-13=crrtipdl user-14=sosevalu user-15=bakery user-16=boldover user-17=nove user-18=romaldki user-19=branko user-20=outdoorc user-21=hodgsonmail user-22=ranxterc user-23=onlycont user-24=lucy user-25=attlebor user-26=pars user-27=david user-28=nbhavers user-29=careers user-30=mcdermos user-31=chrisdal user-32=jennimil user-33=tomandle user-34=courseme user-35=eugincou user-36=hirefootballgame user-37=cwsocial user-38=paulmca1 user-39=howardon user-40=pugwash user-41=ninejimm user-42=reliable user-43=cambria1 user-44=cathski user-45=tigerlet user-46=barbersh user-47=nomistakes user-48=hidden user-49=isleofwi
Sep  1 20:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=smrszyqg user-51=firstre5 user-52=donnychicago user-53=steakbridieme user-54=ctedorgu user-55=philmcph user-56=lkpier user-57=leftie user-58=foods user-59=fortunaz user-60=health2045 user-61=nscdp user-62=putterfc user-63=dhyana user-64=darkstar user-65=eatspam user-66=beauty user-67=nsceres user-68=fawcettd user-69=burydropin user-70=steve user-71=zebrapho user-72=bwppodcast user-73=asandcoc user-74=sibtoncc user-75=nativene user-76=askhform user-77=stuartge user-78=innovat1 user-79=skyfirec user-80=alexadmin user-81=bemadonn user-82=newstoda user-83=belle user-84=ggaaorgu user-85=bedfords user-86=oneoarco user-87=battlere user-88=vivienn1 user-89=firstre2 user-90=nstriton user-91=brighto1 user-92=thqkgnbz user-93=connectedshoppin user-94=ianrayne user-95=accooper user-96=fetch user-97=carsinyo user-98=putterfi user-99=hubmaster user-100=elecleis user-101=gilpin user-102=milloyco user-103=highlegh
Sep  1 20:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=southlon user-105=firstred user-106=costestimatorco user-107=clarkass user-108=firstrel user-109=coursemc user-110=opaiscyx user-111=firstres user-112=ultbcrra user-113=seftvta user-114=jonhartl user-115=magichat user-116=hhdugcor user-117=lbhyisi user-118=ptkxhsbt user-119=dickemery123 user-120=martsblo user-121=megacards user-122=musorguk user-123=wilsonsw user-124=atestord user-125=sarafoundation user-126=strathar user-127=lakesan1 user-128=brmrjxl user-129=leereyn1 user-130=stephani user-131=agproduc user-132=still user-133=hodgesonweb user-134=theblack user-135=spectrum user-136=jarvisin user-137=ulsukarm user-138=lbscrmod user-139=maflemin user-140=vantagep user-141=athenare user-142=connect9 user-143=foundation user-144=booff user-145=markward feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 20:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 20:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:10 nativespace-cdp sudo[1086777]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:11 nativespace-cdp sudo[1086782]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qBPEMdanbaJhtyQf.~
Sep  1 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:11 nativespace-cdp sudo[1086785]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qBPEMdanbaJhtyQf.~'
Sep  1 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:11 nativespace-cdp sudo[1086789]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qBPEMdanbaJhtyQf.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:11 nativespace-cdp sudo[1086793]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:11 nativespace-cdp sudo[1086796]: pam_unix(sudo:session): session closed for user root
Sep  1 20:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 20:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 20:10:12 nativespace-cdp sudo[1086814]: pam_unix(sudo:session): session closed for user root
Sep  1 20:11:33 nativespace-cdp sshd[1087066]: Connection closed by 159.100.136.21 port 47312 [preauth]
Sep  1 20:16:33 nativespace-cdp sshd[1088344]: Connection closed by 159.100.136.21 port 57498 [preauth]
Sep  1 20:21:33 nativespace-cdp sshd[1089577]: Connection closed by 159.100.136.21 port 39242 [preauth]
Sep  1 20:26:33 nativespace-cdp sshd[1090942]: Connection closed by 159.100.136.21 port 49512 [preauth]
Sep  1 20:31:33 nativespace-cdp sshd[1092147]: Connection closed by 159.100.136.21 port 59526 [preauth]
Sep  1 20:36:33 nativespace-cdp sshd[1093207]: Connection closed by 159.100.136.21 port 41586 [preauth]
Sep  1 20:41:33 nativespace-cdp sshd[1094444]: Connection closed by 159.100.136.21 port 51550 [preauth]
Sep  1 20:46:33 nativespace-cdp sshd[1095803]: Connection closed by 159.100.136.21 port 33554 [preauth]
Sep  1 20:51:33 nativespace-cdp sshd[1096850]: Connection closed by 159.100.136.21 port 43522 [preauth]
Sep  1 20:53:25 nativespace-cdp sshd[1097290]: Bad protocol version identification '\003' from 92.255.85.105 port 62417
Sep  1 20:56:33 nativespace-cdp sshd[1098178]: Connection closed by 159.100.136.21 port 53796 [preauth]
Sep  1 21:01:33 nativespace-cdp sshd[1099470]: Connection closed by 159.100.136.21 port 35542 [preauth]
Sep  1 21:06:33 nativespace-cdp sshd[1100609]: Connection closed by 159.100.136.21 port 45868 [preauth]
Sep  1 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:01 nativespace-cdp sudo[1101564]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:01 nativespace-cdp sudo[1101648]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:03 nativespace-cdp sudo[1101658]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 21:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:03 nativespace-cdp sudo[1101700]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 21:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:05 nativespace-cdp sudo[1101703]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:05 nativespace-cdp sudo[1101737]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:05 nativespace-cdp sudo[1101740]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:05 nativespace-cdp sudo[1101743]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:05 nativespace-cdp sudo[1101747]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:05 nativespace-cdp sudo[1101750]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:05 nativespace-cdp sudo[1101753]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 21:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:10 nativespace-cdp sudo[1101767]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 21:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:11 nativespace-cdp sudo[1101771]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nstriton user-2=brighto1 user-3=oneoarco user-4=battlere user-5=vivienn1 user-6=firstre2 user-7=bedfords user-8=bemadonn user-9=newstoda user-10=ggaaorgu user-11=belle user-12=skyfirec user-13=alexadmin user-14=stuartge user-15=askhform user-16=innovat1 user-17=nativene user-18=firstres user-19=ultbcrra user-20=seftvta user-21=jonhartl user-22=opaiscyx user-23=coursemc user-24=costestimatorco user-25=clarkass user-26=firstrel user-27=highlegh user-28=southlon user-29=firstred user-30=elecleis user-31=gilpin user-32=milloyco user-33=fetch user-34=carsinyo user-35=hubmaster user-36=putterfi user-37=ianrayne user-38=accooper user-39=thqkgnbz user-40=connectedshoppin user-41=lakesan1 user-42=brmrjxl user-43=atestord user-44=sarafoundation user-45=strathar user-46=wilsonsw user-47=megacards
Sep  1 21:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=musorguk user-49=martsblo user-50=ptkxhsbt user-51=dickemery123 user-52=hhdugcor user-53=lbhyisi user-54=magichat user-55=foundation user-56=booff user-57=markward user-58=lbscrmod user-59=maflemin user-60=vantagep user-61=connect9 user-62=athenare user-63=ulsukarm user-64=jarvisin user-65=theblack user-66=hodgesonweb user-67=spectrum user-68=agproduc user-69=still user-70=leereyn1 user-71=stephani user-72=nove user-73=boldover user-74=crrtipdl user-75=sosevalu user-76=bakery user-77=what user-78=tstardom user-79=oubpgvbx user-80=nvihkvu user-81=havantho user-82=cath user-83=sketchy user-84=kategilpin user-85=stagingerris user-86=dancinggardener user-87=ladburyp user-88=design user-89=tomandle user-90=jennimil user-91=mcdermos user-92=chrisdal user-93=pars user-94=david user-95=careers user-96=nbhavers user-97=lucy user-98=attlebor user-99=onlycont user-100=branko user-101=outdoorc user-102=hodgsonmail
Sep  1 21:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ranxterc user-104=romaldki user-105=foods user-106=leftie user-107=health2045 user-108=fortunaz user-109=nscdp user-110=putterfc user-111=firstre5 user-112=donnychicago user-113=steakbridieme user-114=ctedorgu user-115=philmcph user-116=lkpier user-117=isleofwi user-118=smrszyqg user-119=barbersh user-120=tigerlet user-121=nomistakes user-122=hidden user-123=ninejimm user-124=reliable user-125=cathski user-126=cambria1 user-127=cwsocial user-128=paulmca1 user-129=pugwash user-130=howardon user-131=hirefootballgame user-132=courseme user-133=eugincou user-134=asandcoc user-135=sibtoncc user-136=zebrapho user-137=bwppodcast user-138=steve user-139=fawcettd user-140=burydropin user-141=nsceres user-142=darkstar user-143=eatspam user-144=beauty user-145=dhyana feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  1 21:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 21:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:12 nativespace-cdp sudo[1101775]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 21:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:13 nativespace-cdp sudo[1101786]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Vtfq50L6BRWILqaE.~
Sep  1 21:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:13 nativespace-cdp sudo[1101789]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Vtfq50L6BRWILqaE.~'
Sep  1 21:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:13 nativespace-cdp sudo[1101792]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Vtfq50L6BRWILqaE.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 21:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:13 nativespace-cdp sudo[1101796]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 21:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:13 nativespace-cdp sudo[1101800]: pam_unix(sudo:session): session closed for user root
Sep  1 21:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 21:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:10:16 nativespace-cdp sudo[1101823]: pam_unix(sudo:session): session closed for user root
Sep  1 21:11:33 nativespace-cdp sshd[1102149]: Connection closed by 159.100.136.21 port 55840 [preauth]
Sep  1 21:16:33 nativespace-cdp sshd[1103212]: Connection closed by 159.100.136.21 port 37830 [preauth]
Sep  1 21:21:33 nativespace-cdp sshd[1104291]: Connection closed by 159.100.136.21 port 47810 [preauth]
Sep  1 21:26:33 nativespace-cdp sshd[1105642]: Connection closed by 159.100.136.21 port 58056 [preauth]
Sep  1 21:31:33 nativespace-cdp sshd[1106866]: Connection closed by 159.100.136.21 port 39864 [preauth]
Sep  1 21:36:33 nativespace-cdp sshd[1107973]: Connection closed by 159.100.136.21 port 50160 [preauth]
Sep  1 21:41:14 nativespace-cdp sshd[1035152]: pam_unix(sshd:session): session closed for user root
Sep  1 21:41:34 nativespace-cdp sshd[1109639]: Connection closed by 159.100.136.21 port 60018 [preauth]
Sep  1 21:42:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 21:42:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:08 nativespace-cdp sudo[1109860]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status athenare
Sep  1 21:42:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:14 nativespace-cdp sshd[1109887]: Bad protocol version identification '\003' from 194.28.112.182 port 36580
Sep  1 21:42:14 nativespace-cdp sshd[1109888]: Bad protocol version identification '\003' from 194.28.112.182 port 37575
Sep  1 21:42:14 nativespace-cdp sshd[1109889]: Bad protocol version identification '\003' from 194.28.112.182 port 38724
Sep  1 21:42:17 nativespace-cdp sudo[1109869]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 21:42:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:22 nativespace-cdp sudo[1109921]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status athenare
Sep  1 21:42:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:22 nativespace-cdp sudo[1109925]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 21:42:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:24 nativespace-cdp sudo[1109937]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status athenare
Sep  1 21:42:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:24 nativespace-cdp sudo[1109942]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 21:42:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:28 nativespace-cdp sudo[1109969]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bemadonn
Sep  1 21:42:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:28 nativespace-cdp sudo[1109974]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 21:42:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:30 nativespace-cdp sudo[1110002]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status booff
Sep  1 21:42:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:31 nativespace-cdp sudo[1110006]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 21:42:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:33 nativespace-cdp sudo[1110060]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status cathski
Sep  1 21:42:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:33 nativespace-cdp sudo[1110069]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 21:42:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:35 nativespace-cdp sudo[1110104]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status martsblo
Sep  1 21:42:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:35 nativespace-cdp sudo[1110108]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 21:42:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:37 nativespace-cdp sudo[1110130]: pam_unix(sudo:session): session closed for user root
Sep  1 21:42:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status nstriton
Sep  1 21:42:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 21:42:37 nativespace-cdp sudo[1110134]: pam_unix(sudo:session): session closed for user root
Sep  1 21:46:33 nativespace-cdp sshd[1111182]: Connection closed by 159.100.136.21 port 41990 [preauth]
Sep  1 21:51:33 nativespace-cdp sshd[1112374]: Connection closed by 159.100.136.21 port 52002 [preauth]
Sep  1 21:56:33 nativespace-cdp sshd[1113481]: Connection closed by 159.100.136.21 port 34026 [preauth]
Sep  1 22:01:33 nativespace-cdp sshd[1114972]: Connection closed by 159.100.136.21 port 44018 [preauth]
Sep  1 22:06:33 nativespace-cdp sshd[1116113]: Connection closed by 159.100.136.21 port 54348 [preauth]
Sep  1 22:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 22:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:26 nativespace-cdp sudo[1116765]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 22:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:26 nativespace-cdp sudo[1116773]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 22:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:28 nativespace-cdp sudo[1116778]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 22:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:28 nativespace-cdp sudo[1116784]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 22:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:32 nativespace-cdp sudo[1116791]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:32 nativespace-cdp sudo[1116808]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:32 nativespace-cdp sudo[1116814]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:32 nativespace-cdp sudo[1116818]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:32 nativespace-cdp sudo[1116823]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:32 nativespace-cdp sudo[1116829]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:32 nativespace-cdp sudo[1116834]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:35 nativespace-cdp sudo[1116846]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 22:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:35 nativespace-cdp sudo[1116852]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nove user-2=boldover user-3=bakery user-4=sosevalu user-5=crrtipdl user-6=tstardom user-7=oubpgvbx user-8=what user-9=cath user-10=sketchy user-11=havantho user-12=nvihkvu user-13=ladburyp user-14=stagingerris user-15=dancinggardener user-16=kategilpin user-17=design user-18=tomandle user-19=jennimil user-20=chrisdal user-21=mcdermos user-22=nbhavers user-23=careers user-24=pars user-25=david user-26=attlebor user-27=lucy user-28=onlycont user-29=hodgsonmail user-30=outdoorc user-31=ranxterc user-32=branko user-33=romaldki user-34=putterfc user-35=nscdp user-36=health2045 user-37=fortunaz user-38=leftie user-39=foods user-40=lkpier user-41=ctedorgu user-42=philmcph user-43=steakbridieme user-44=donnychicago user-45=firstre5 user-46=smrszyqg user-47=isleofwi user-48=hidden user-49=nomistakes
Sep  1 22:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=barbersh user-51=tigerlet user-52=cambria1 user-53=cathski user-54=ninejimm user-55=reliable user-56=pugwash user-57=paulmca1 user-58=howardon user-59=cwsocial user-60=hirefootballgame user-61=eugincou user-62=courseme user-63=sibtoncc user-64=asandcoc user-65=bwppodcast user-66=zebrapho user-67=steve user-68=burydropin user-69=fawcettd user-70=nsceres user-71=beauty user-72=eatspam user-73=darkstar user-74=dhyana user-75=brighto1 user-76=nstriton user-77=firstre2 user-78=vivienn1 user-79=battlere user-80=oneoarco user-81=bedfords user-82=belle user-83=ggaaorgu user-84=newstoda user-85=bemadonn user-86=skyfirec user-87=alexadmin user-88=innovat1 user-89=askhform user-90=stuartge user-91=nativene user-92=seftvta user-93=jonhartl user-94=ultbcrra user-95=firstres user-96=opaiscyx user-97=coursemc user-98=clarkass user-99=firstrel user-100=costestimatorco user-101=firstred user-102=southlon user-103=highlegh
Sep  1 22:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=milloyco user-105=gilpin user-106=elecleis user-107=hubmaster user-108=putterfi user-109=carsinyo user-110=fetch user-111=accooper user-112=ianrayne user-113=connectedshoppin user-114=thqkgnbz user-115=brmrjxl user-116=lakesan1 user-117=strathar user-118=sarafoundation user-119=atestord user-120=wilsonsw user-121=musorguk user-122=megacards user-123=martsblo user-124=dickemery123 user-125=ptkxhsbt user-126=lbhyisi user-127=hhdugcor user-128=magichat user-129=foundation user-130=booff user-131=markward user-132=connect9 user-133=athenare user-134=vantagep user-135=maflemin user-136=lbscrmod user-137=ulsukarm user-138=jarvisin user-139=spectrum user-140=hodgesonweb user-141=theblack user-142=still user-143=agproduc user-144=stephani user-145=leereyn1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 22:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 22:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:36 nativespace-cdp sudo[1116859]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 22:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:37 nativespace-cdp sudo[1116869]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EJTJZIDbBpzeSq5h.~
Sep  1 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:38 nativespace-cdp sudo[1116875]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EJTJZIDbBpzeSq5h.~'
Sep  1 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:38 nativespace-cdp sudo[1116880]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EJTJZIDbBpzeSq5h.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:38 nativespace-cdp sudo[1116886]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:38 nativespace-cdp sudo[1116891]: pam_unix(sudo:session): session closed for user root
Sep  1 22:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 22:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 22:09:40 nativespace-cdp sudo[1116916]: pam_unix(sudo:session): session closed for user root
Sep  1 22:11:33 nativespace-cdp sshd[1117638]: Connection closed by 159.100.136.21 port 36066 [preauth]
Sep  1 22:16:33 nativespace-cdp sshd[1118693]: Connection closed by 159.100.136.21 port 46268 [preauth]
Sep  1 22:19:47 nativespace-cdp sshd[1119404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.227.154.203  user=root
Sep  1 22:19:47 nativespace-cdp sshd[1119404]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 22:19:49 nativespace-cdp sshd[1119404]: Failed password for root from 185.227.154.203 port 58524 ssh2
Sep  1 22:19:49 nativespace-cdp sshd[1119404]: Received disconnect from 185.227.154.203 port 58524:11: Bye Bye [preauth]
Sep  1 22:19:49 nativespace-cdp sshd[1119404]: Disconnected from 185.227.154.203 port 58524 [preauth]
Sep  1 22:20:58 nativespace-cdp sshd[1119753]: Invalid user zz from 24.199.103.40 port 46974
Sep  1 22:20:58 nativespace-cdp sshd[1119753]: input_userauth_request: invalid user zz [preauth]
Sep  1 22:20:58 nativespace-cdp sshd[1119753]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 22:20:58 nativespace-cdp sshd[1119753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.199.103.40
Sep  1 22:21:00 nativespace-cdp sshd[1119753]: Failed password for invalid user zz from 24.199.103.40 port 46974 ssh2
Sep  1 22:21:00 nativespace-cdp sshd[1119753]: Received disconnect from 24.199.103.40 port 46974:11: Bye Bye [preauth]
Sep  1 22:21:00 nativespace-cdp sshd[1119753]: Disconnected from 24.199.103.40 port 46974 [preauth]
Sep  1 22:21:33 nativespace-cdp sshd[1119865]: Connection closed by 159.100.136.21 port 56258 [preauth]
Sep  1 22:26:33 nativespace-cdp sshd[1121234]: Connection closed by 159.100.136.21 port 38298 [preauth]
Sep  1 22:27:06 nativespace-cdp sshd[1121339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.184.164.27  user=root
Sep  1 22:27:06 nativespace-cdp sshd[1121339]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 22:27:08 nativespace-cdp sshd[1121339]: Failed password for root from 4.184.164.27 port 62424 ssh2
Sep  1 22:27:08 nativespace-cdp sshd[1121339]: Received disconnect from 4.184.164.27 port 62424:11: Bye Bye [preauth]
Sep  1 22:27:08 nativespace-cdp sshd[1121339]: Disconnected from 4.184.164.27 port 62424 [preauth]
Sep  1 22:27:15 nativespace-cdp sshd[1121363]: Invalid user user from 24.199.103.40 port 43766
Sep  1 22:27:15 nativespace-cdp sshd[1121363]: input_userauth_request: invalid user user [preauth]
Sep  1 22:27:15 nativespace-cdp sshd[1121363]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 22:27:15 nativespace-cdp sshd[1121363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.199.103.40
Sep  1 22:27:17 nativespace-cdp sshd[1121363]: Failed password for invalid user user from 24.199.103.40 port 43766 ssh2
Sep  1 22:27:17 nativespace-cdp sshd[1121363]: Received disconnect from 24.199.103.40 port 43766:11: Bye Bye [preauth]
Sep  1 22:27:17 nativespace-cdp sshd[1121363]: Disconnected from 24.199.103.40 port 43766 [preauth]
Sep  1 22:27:55 nativespace-cdp sshd[1121498]: Invalid user wpuser from 24.199.103.40 port 37008
Sep  1 22:27:55 nativespace-cdp sshd[1121498]: input_userauth_request: invalid user wpuser [preauth]
Sep  1 22:27:55 nativespace-cdp sshd[1121498]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 22:27:55 nativespace-cdp sshd[1121498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.199.103.40
Sep  1 22:27:57 nativespace-cdp sshd[1121498]: Failed password for invalid user wpuser from 24.199.103.40 port 37008 ssh2
Sep  1 22:27:57 nativespace-cdp sshd[1121498]: Received disconnect from 24.199.103.40 port 37008:11: Bye Bye [preauth]
Sep  1 22:27:57 nativespace-cdp sshd[1121498]: Disconnected from 24.199.103.40 port 37008 [preauth]
Sep  1 22:29:33 nativespace-cdp sshd[1121893]: Invalid user pi from 185.227.154.203 port 54980
Sep  1 22:29:33 nativespace-cdp sshd[1121893]: input_userauth_request: invalid user pi [preauth]
Sep  1 22:29:33 nativespace-cdp sshd[1121893]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 22:29:33 nativespace-cdp sshd[1121893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.227.154.203
Sep  1 22:29:35 nativespace-cdp sshd[1121893]: Failed password for invalid user pi from 185.227.154.203 port 54980 ssh2
Sep  1 22:29:35 nativespace-cdp sshd[1121893]: Received disconnect from 185.227.154.203 port 54980:11: Bye Bye [preauth]
Sep  1 22:29:35 nativespace-cdp sshd[1121893]: Disconnected from 185.227.154.203 port 54980 [preauth]
Sep  1 22:29:47 nativespace-cdp sshd[1121930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.227.154.203  user=root
Sep  1 22:29:47 nativespace-cdp sshd[1121930]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 22:29:49 nativespace-cdp sshd[1121930]: Failed password for root from 185.227.154.203 port 56452 ssh2
Sep  1 22:29:49 nativespace-cdp sshd[1121930]: Received disconnect from 185.227.154.203 port 56452:11: Bye Bye [preauth]
Sep  1 22:29:49 nativespace-cdp sshd[1121930]: Disconnected from 185.227.154.203 port 56452 [preauth]
Sep  1 22:31:17 nativespace-cdp sshd[1122423]: Invalid user ali from 4.184.164.27 port 40686
Sep  1 22:31:17 nativespace-cdp sshd[1122423]: input_userauth_request: invalid user ali [preauth]
Sep  1 22:31:17 nativespace-cdp sshd[1122423]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 22:31:17 nativespace-cdp sshd[1122423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.184.164.27
Sep  1 22:31:19 nativespace-cdp sshd[1122423]: Failed password for invalid user ali from 4.184.164.27 port 40686 ssh2
Sep  1 22:31:19 nativespace-cdp sshd[1122423]: Received disconnect from 4.184.164.27 port 40686:11: Bye Bye [preauth]
Sep  1 22:31:19 nativespace-cdp sshd[1122423]: Disconnected from 4.184.164.27 port 40686 [preauth]
Sep  1 22:31:33 nativespace-cdp sshd[1122455]: Connection closed by 159.100.136.21 port 48298 [preauth]
Sep  1 22:32:00 nativespace-cdp sshd[1122526]: Invalid user zw from 4.184.164.27 port 54020
Sep  1 22:32:00 nativespace-cdp sshd[1122526]: input_userauth_request: invalid user zw [preauth]
Sep  1 22:32:00 nativespace-cdp sshd[1122526]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 22:32:00 nativespace-cdp sshd[1122526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.184.164.27
Sep  1 22:32:02 nativespace-cdp sshd[1122526]: Failed password for invalid user zw from 4.184.164.27 port 54020 ssh2
Sep  1 22:32:02 nativespace-cdp sshd[1122526]: Received disconnect from 4.184.164.27 port 54020:11: Bye Bye [preauth]
Sep  1 22:32:02 nativespace-cdp sshd[1122526]: Disconnected from 4.184.164.27 port 54020 [preauth]
Sep  1 22:36:33 nativespace-cdp sshd[1123517]: Connection closed by 159.100.136.21 port 58598 [preauth]
Sep  1 22:41:33 nativespace-cdp sshd[1124595]: Connection closed by 159.100.136.21 port 40334 [preauth]
Sep  1 22:46:34 nativespace-cdp sshd[1125745]: Connection closed by 159.100.136.21 port 50552 [preauth]
Sep  1 22:51:33 nativespace-cdp sshd[1126870]: Connection closed by 159.100.136.21 port 60538 [preauth]
Sep  1 22:56:33 nativespace-cdp sshd[1128192]: Connection closed by 159.100.136.21 port 42580 [preauth]
Sep  1 23:01:33 nativespace-cdp sshd[1129335]: Connection closed by 159.100.136.21 port 52560 [preauth]
Sep  1 23:06:33 nativespace-cdp sshd[1130346]: Connection closed by 159.100.136.21 port 34654 [preauth]
Sep  1 23:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  1 23:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:19 nativespace-cdp sudo[1130917]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  1 23:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:19 nativespace-cdp sudo[1130921]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  1 23:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:20 nativespace-cdp sudo[1130926]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  1 23:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:20 nativespace-cdp sudo[1130934]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  1 23:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:22 nativespace-cdp sudo[1130940]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  1 23:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:22 nativespace-cdp sudo[1130954]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  1 23:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:22 nativespace-cdp sudo[1130958]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  1 23:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:22 nativespace-cdp sudo[1130963]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  1 23:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:22 nativespace-cdp sudo[1130968]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  1 23:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:22 nativespace-cdp sudo[1130973]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  1 23:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:22 nativespace-cdp sudo[1130979]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  1 23:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:24 nativespace-cdp sudo[1130990]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  1 23:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:24 nativespace-cdp sudo[1130997]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=dickemery123 user-2=ptkxhsbt user-3=martsblo user-4=magichat user-5=lbhyisi user-6=hhdugcor user-7=strathar user-8=sarafoundation user-9=atestord user-10=lakesan1 user-11=brmrjxl user-12=musorguk user-13=megacards user-14=wilsonsw user-15=spectrum user-16=theblack user-17=hodgesonweb user-18=jarvisin user-19=stephani user-20=leereyn1 user-21=still user-22=agproduc user-23=athenare user-24=connect9 user-25=vantagep user-26=maflemin user-27=lbscrmod user-28=foundation user-29=booff user-30=markward user-31=ulsukarm user-32=skyfirec user-33=alexadmin user-34=nativene user-35=innovat1 user-36=askhform user-37=stuartge user-38=firstre2 user-39=vivienn1 user-40=battlere user-41=oneoarco user-42=brighto1 user-43=nstriton user-44=ggaaorgu user-45=belle user-46=newstoda user-47=bemadonn user-48=bedfords
Sep  1 23:09:24 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=putterfi user-50=hubmaster user-51=carsinyo user-52=fetch user-53=gilpin user-54=milloyco user-55=elecleis user-56=connectedshoppin user-57=thqkgnbz user-58=accooper user-59=ianrayne user-60=coursemc user-61=opaiscyx user-62=seftvta user-63=jonhartl user-64=ultbcrra user-65=firstres user-66=firstred user-67=southlon user-68=highlegh user-69=firstrel user-70=clarkass user-71=costestimatorco user-72=howardon user-73=paulmca1 user-74=pugwash user-75=cwsocial user-76=cambria1 user-77=cathski user-78=ninejimm user-79=reliable user-80=eugincou user-81=courseme user-82=hirefootballgame user-83=lkpier user-84=philmcph user-85=ctedorgu user-86=firstre5 user-87=donnychicago user-88=steakbridieme user-89=putterfc user-90=nscdp user-91=fortunaz user-92=health2045 user-93=leftie user-94=foods user-95=hidden user-96=nomistakes user-97=barbersh user-98=tigerlet user-99=smrszyqg user-100=isleofwi user-101=nsceres
Sep  1 23:09:24 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=burydropin user-103=fawcettd user-104=dhyana user-105=beauty user-106=eatspam user-107=darkstar user-108=sibtoncc user-109=asandcoc user-110=steve user-111=bwppodcast user-112=zebrapho user-113=cath user-114=sketchy user-115=havantho user-116=nvihkvu user-117=tstardom user-118=oubpgvbx user-119=what user-120=design user-121=ladburyp user-122=stagingerris user-123=dancinggardener user-124=kategilpin user-125=boldover user-126=nove user-127=bakery user-128=sosevalu user-129=crrtipdl user-130=onlycont user-131=attlebor user-132=lucy user-133=romaldki user-134=outdoorc user-135=hodgsonmail user-136=ranxterc user-137=branko user-138=jennimil user-139=tomandle user-140=careers user-141=nbhavers user-142=david user-143=pars user-144=chrisdal user-145=mcdermos feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  1 23:09:24 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  1 23:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:25 nativespace-cdp sudo[1131005]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 23:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:25 nativespace-cdp sudo[1131011]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kNjosxXdNRXGaaDu.~
Sep  1 23:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:25 nativespace-cdp sudo[1131016]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kNjosxXdNRXGaaDu.~'
Sep  1 23:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:25 nativespace-cdp sudo[1131020]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kNjosxXdNRXGaaDu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  1 23:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:25 nativespace-cdp sudo[1131026]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  1 23:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:25 nativespace-cdp sudo[1131031]: pam_unix(sudo:session): session closed for user root
Sep  1 23:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  1 23:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  1 23:09:27 nativespace-cdp sudo[1131053]: pam_unix(sudo:session): session closed for user root
Sep  1 23:11:33 nativespace-cdp sshd[1131785]: Connection closed by 159.100.136.21 port 44608 [preauth]
Sep  1 23:12:43 nativespace-cdp sshd[1131956]: Invalid user ftpguest from 188.81.107.160 port 57062
Sep  1 23:12:43 nativespace-cdp sshd[1131956]: input_userauth_request: invalid user ftpguest [preauth]
Sep  1 23:12:43 nativespace-cdp sshd[1131956]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:12:43 nativespace-cdp sshd[1131956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.81.107.160
Sep  1 23:12:45 nativespace-cdp sshd[1131956]: Failed password for invalid user ftpguest from 188.81.107.160 port 57062 ssh2
Sep  1 23:12:45 nativespace-cdp sshd[1131956]: Received disconnect from 188.81.107.160 port 57062:11: Bye Bye [preauth]
Sep  1 23:12:45 nativespace-cdp sshd[1131956]: Disconnected from 188.81.107.160 port 57062 [preauth]
Sep  1 23:14:27 nativespace-cdp sshd[1132310]: Invalid user serban from 34.142.156.17 port 38630
Sep  1 23:14:27 nativespace-cdp sshd[1132310]: input_userauth_request: invalid user serban [preauth]
Sep  1 23:14:27 nativespace-cdp sshd[1132310]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:14:27 nativespace-cdp sshd[1132310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.142.156.17
Sep  1 23:14:29 nativespace-cdp sshd[1132310]: Failed password for invalid user serban from 34.142.156.17 port 38630 ssh2
Sep  1 23:14:29 nativespace-cdp sshd[1132310]: Received disconnect from 34.142.156.17 port 38630:11: Bye Bye [preauth]
Sep  1 23:14:29 nativespace-cdp sshd[1132310]: Disconnected from 34.142.156.17 port 38630 [preauth]
Sep  1 23:14:47 nativespace-cdp sshd[1132357]: Invalid user weishibo from 103.115.109.76 port 50106
Sep  1 23:14:47 nativespace-cdp sshd[1132357]: input_userauth_request: invalid user weishibo [preauth]
Sep  1 23:14:47 nativespace-cdp sshd[1132357]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:14:47 nativespace-cdp sshd[1132357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.115.109.76
Sep  1 23:14:49 nativespace-cdp sshd[1132357]: Failed password for invalid user weishibo from 103.115.109.76 port 50106 ssh2
Sep  1 23:14:49 nativespace-cdp sshd[1132357]: Received disconnect from 103.115.109.76 port 50106:11: Bye Bye [preauth]
Sep  1 23:14:49 nativespace-cdp sshd[1132357]: Disconnected from 103.115.109.76 port 50106 [preauth]
Sep  1 23:15:25 nativespace-cdp sshd[1132624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.25.236.192  user=root
Sep  1 23:15:25 nativespace-cdp sshd[1132624]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 23:15:28 nativespace-cdp sshd[1132624]: Failed password for root from 46.25.236.192 port 39120 ssh2
Sep  1 23:15:28 nativespace-cdp sshd[1132624]: Received disconnect from 46.25.236.192 port 39120:11: Bye Bye [preauth]
Sep  1 23:15:28 nativespace-cdp sshd[1132624]: Disconnected from 46.25.236.192 port 39120 [preauth]
Sep  1 23:16:14 nativespace-cdp sshd[1132795]: Invalid user test from 109.94.172.86 port 48514
Sep  1 23:16:14 nativespace-cdp sshd[1132795]: input_userauth_request: invalid user test [preauth]
Sep  1 23:16:14 nativespace-cdp sshd[1132795]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:16:14 nativespace-cdp sshd[1132795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.94.172.86
Sep  1 23:16:16 nativespace-cdp sshd[1132795]: Failed password for invalid user test from 109.94.172.86 port 48514 ssh2
Sep  1 23:16:16 nativespace-cdp sshd[1132795]: Received disconnect from 109.94.172.86 port 48514:11: Bye Bye [preauth]
Sep  1 23:16:16 nativespace-cdp sshd[1132795]: Disconnected from 109.94.172.86 port 48514 [preauth]
Sep  1 23:16:33 nativespace-cdp sshd[1132858]: Connection closed by 159.100.136.21 port 54826 [preauth]
Sep  1 23:19:23 nativespace-cdp sshd[1133453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.159.121  user=root
Sep  1 23:19:23 nativespace-cdp sshd[1133453]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 23:19:25 nativespace-cdp sshd[1133453]: Failed password for root from 152.32.159.121 port 35194 ssh2
Sep  1 23:19:25 nativespace-cdp sshd[1133453]: Received disconnect from 152.32.159.121 port 35194:11: Bye Bye [preauth]
Sep  1 23:19:25 nativespace-cdp sshd[1133453]: Disconnected from 152.32.159.121 port 35194 [preauth]
Sep  1 23:20:59 nativespace-cdp sshd[1133841]: Invalid user anurag from 103.115.109.76 port 44112
Sep  1 23:20:59 nativespace-cdp sshd[1133841]: input_userauth_request: invalid user anurag [preauth]
Sep  1 23:20:59 nativespace-cdp sshd[1133841]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:20:59 nativespace-cdp sshd[1133841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.115.109.76
Sep  1 23:21:01 nativespace-cdp sshd[1133841]: Failed password for invalid user anurag from 103.115.109.76 port 44112 ssh2
Sep  1 23:21:01 nativespace-cdp sshd[1133852]: Invalid user elasticdev from 188.81.107.160 port 32830
Sep  1 23:21:01 nativespace-cdp sshd[1133852]: input_userauth_request: invalid user elasticdev [preauth]
Sep  1 23:21:01 nativespace-cdp sshd[1133852]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:21:01 nativespace-cdp sshd[1133852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.81.107.160
Sep  1 23:21:01 nativespace-cdp sshd[1133841]: Received disconnect from 103.115.109.76 port 44112:11: Bye Bye [preauth]
Sep  1 23:21:01 nativespace-cdp sshd[1133841]: Disconnected from 103.115.109.76 port 44112 [preauth]
Sep  1 23:21:03 nativespace-cdp sshd[1133852]: Failed password for invalid user elasticdev from 188.81.107.160 port 32830 ssh2
Sep  1 23:21:03 nativespace-cdp sshd[1133852]: Received disconnect from 188.81.107.160 port 32830:11: Bye Bye [preauth]
Sep  1 23:21:03 nativespace-cdp sshd[1133852]: Disconnected from 188.81.107.160 port 32830 [preauth]
Sep  1 23:21:13 nativespace-cdp sshd[1133903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.142.156.17  user=root
Sep  1 23:21:13 nativespace-cdp sshd[1133903]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 23:21:14 nativespace-cdp sshd[1133903]: Failed password for root from 34.142.156.17 port 33884 ssh2
Sep  1 23:21:14 nativespace-cdp sshd[1133903]: Received disconnect from 34.142.156.17 port 33884:11: Bye Bye [preauth]
Sep  1 23:21:14 nativespace-cdp sshd[1133903]: Disconnected from 34.142.156.17 port 33884 [preauth]
Sep  1 23:21:33 nativespace-cdp sshd[1133965]: Connection closed by 159.100.136.21 port 36538 [preauth]
Sep  1 23:21:49 nativespace-cdp sshd[1134015]: Invalid user empty from 109.94.172.86 port 37136
Sep  1 23:21:49 nativespace-cdp sshd[1134015]: input_userauth_request: invalid user empty [preauth]
Sep  1 23:21:49 nativespace-cdp sshd[1134015]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:21:49 nativespace-cdp sshd[1134015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.94.172.86
Sep  1 23:21:51 nativespace-cdp sshd[1134015]: Failed password for invalid user empty from 109.94.172.86 port 37136 ssh2
Sep  1 23:21:51 nativespace-cdp sshd[1134015]: Received disconnect from 109.94.172.86 port 37136:11: Bye Bye [preauth]
Sep  1 23:21:51 nativespace-cdp sshd[1134015]: Disconnected from 109.94.172.86 port 37136 [preauth]
Sep  1 23:21:52 nativespace-cdp sshd[1134024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.115.109.76  user=root
Sep  1 23:21:52 nativespace-cdp sshd[1134024]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 23:21:54 nativespace-cdp sshd[1134024]: Failed password for root from 103.115.109.76 port 60540 ssh2
Sep  1 23:21:54 nativespace-cdp sshd[1134024]: Received disconnect from 103.115.109.76 port 60540:11: Bye Bye [preauth]
Sep  1 23:21:54 nativespace-cdp sshd[1134024]: Disconnected from 103.115.109.76 port 60540 [preauth]
Sep  1 23:21:58 nativespace-cdp sshd[1134063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.142.156.17  user=root
Sep  1 23:21:58 nativespace-cdp sshd[1134063]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 23:22:00 nativespace-cdp sshd[1134063]: Failed password for root from 34.142.156.17 port 53958 ssh2
Sep  1 23:22:00 nativespace-cdp sshd[1134093]: Invalid user kyle from 152.32.159.121 port 59610
Sep  1 23:22:00 nativespace-cdp sshd[1134093]: input_userauth_request: invalid user kyle [preauth]
Sep  1 23:22:00 nativespace-cdp sshd[1134093]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:22:00 nativespace-cdp sshd[1134093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.159.121
Sep  1 23:22:00 nativespace-cdp sshd[1134102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.81.107.160  user=root
Sep  1 23:22:00 nativespace-cdp sshd[1134102]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 23:22:01 nativespace-cdp sshd[1134030]: Connection closed by 46.25.236.192 port 59726 [preauth]
Sep  1 23:22:02 nativespace-cdp sshd[1134093]: Failed password for invalid user kyle from 152.32.159.121 port 59610 ssh2
Sep  1 23:22:03 nativespace-cdp sshd[1134093]: Received disconnect from 152.32.159.121 port 59610:11: Bye Bye [preauth]
Sep  1 23:22:03 nativespace-cdp sshd[1134093]: Disconnected from 152.32.159.121 port 59610 [preauth]
Sep  1 23:22:03 nativespace-cdp sshd[1134102]: Failed password for root from 188.81.107.160 port 46032 ssh2
Sep  1 23:22:03 nativespace-cdp sshd[1134102]: Received disconnect from 188.81.107.160 port 46032:11: Bye Bye [preauth]
Sep  1 23:22:03 nativespace-cdp sshd[1134102]: Disconnected from 188.81.107.160 port 46032 [preauth]
Sep  1 23:22:38 nativespace-cdp sshd[1134235]: Invalid user admin from 109.94.172.86 port 53012
Sep  1 23:22:38 nativespace-cdp sshd[1134235]: input_userauth_request: invalid user admin [preauth]
Sep  1 23:22:38 nativespace-cdp sshd[1134235]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:22:38 nativespace-cdp sshd[1134235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.94.172.86
Sep  1 23:22:40 nativespace-cdp sshd[1134235]: Failed password for invalid user admin from 109.94.172.86 port 53012 ssh2
Sep  1 23:22:45 nativespace-cdp sshd[1134283]: Invalid user empty from 152.32.159.121 port 18080
Sep  1 23:22:45 nativespace-cdp sshd[1134283]: input_userauth_request: invalid user empty [preauth]
Sep  1 23:22:45 nativespace-cdp sshd[1134283]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:22:45 nativespace-cdp sshd[1134283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.159.121
Sep  1 23:22:47 nativespace-cdp sshd[1134283]: Failed password for invalid user empty from 152.32.159.121 port 18080 ssh2
Sep  1 23:22:47 nativespace-cdp sshd[1134283]: Received disconnect from 152.32.159.121 port 18080:11: Bye Bye [preauth]
Sep  1 23:22:47 nativespace-cdp sshd[1134283]: Disconnected from 152.32.159.121 port 18080 [preauth]
Sep  1 23:23:17 nativespace-cdp sshd[1134434]: Invalid user judi from 205.185.113.189 port 37994
Sep  1 23:23:17 nativespace-cdp sshd[1134434]: input_userauth_request: invalid user judi [preauth]
Sep  1 23:23:17 nativespace-cdp sshd[1134434]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:23:17 nativespace-cdp sshd[1134434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=205.185.113.189
Sep  1 23:23:19 nativespace-cdp sshd[1134434]: Failed password for invalid user judi from 205.185.113.189 port 37994 ssh2
Sep  1 23:23:19 nativespace-cdp sshd[1134434]: Received disconnect from 205.185.113.189 port 37994:11: Bye Bye [preauth]
Sep  1 23:23:19 nativespace-cdp sshd[1134434]: Disconnected from 205.185.113.189 port 37994 [preauth]
Sep  1 23:23:38 nativespace-cdp sshd[1134515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.25.236.192  user=root
Sep  1 23:23:38 nativespace-cdp sshd[1134515]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 23:23:39 nativespace-cdp sshd[1134515]: Failed password for root from 46.25.236.192 port 46742 ssh2
Sep  1 23:23:39 nativespace-cdp sshd[1134515]: Received disconnect from 46.25.236.192 port 46742:11: Bye Bye [preauth]
Sep  1 23:23:39 nativespace-cdp sshd[1134515]: Disconnected from 46.25.236.192 port 46742 [preauth]
Sep  1 23:25:15 nativespace-cdp sshd[1134952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.25.236.192  user=mysql
Sep  1 23:25:15 nativespace-cdp sshd[1134952]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "mysql"
Sep  1 23:25:17 nativespace-cdp sshd[1134952]: Failed password for mysql from 46.25.236.192 port 33754 ssh2
Sep  1 23:25:17 nativespace-cdp sshd[1134952]: Received disconnect from 46.25.236.192 port 33754:11: Bye Bye [preauth]
Sep  1 23:25:17 nativespace-cdp sshd[1134952]: Disconnected from 46.25.236.192 port 33754 [preauth]
Sep  1 23:25:59 nativespace-cdp sshd[1135143]: Invalid user cdp from 205.185.113.189 port 40176
Sep  1 23:25:59 nativespace-cdp sshd[1135143]: input_userauth_request: invalid user cdp [preauth]
Sep  1 23:25:59 nativespace-cdp sshd[1135143]: pam_unix(sshd:auth): check pass; user unknown
Sep  1 23:25:59 nativespace-cdp sshd[1135143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=205.185.113.189
Sep  1 23:26:01 nativespace-cdp sshd[1135143]: Failed password for invalid user cdp from 205.185.113.189 port 40176 ssh2
Sep  1 23:26:01 nativespace-cdp sshd[1135143]: Received disconnect from 205.185.113.189 port 40176:11: Bye Bye [preauth]
Sep  1 23:26:01 nativespace-cdp sshd[1135143]: Disconnected from 205.185.113.189 port 40176 [preauth]
Sep  1 23:26:33 nativespace-cdp sshd[1135254]: Connection closed by 159.100.136.21 port 46802 [preauth]
Sep  1 23:27:13 nativespace-cdp sshd[1135504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=205.185.113.189  user=root
Sep  1 23:27:13 nativespace-cdp sshd[1135504]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  1 23:27:15 nativespace-cdp sshd[1135504]: Failed password for root from 205.185.113.189 port 32950 ssh2
Sep  1 23:31:33 nativespace-cdp sshd[1136568]: Connection closed by 159.100.136.21 port 56854 [preauth]
Sep  1 23:36:33 nativespace-cdp sshd[1137614]: Connection closed by 159.100.136.21 port 38922 [preauth]
Sep  1 23:41:33 nativespace-cdp sshd[1138900]: Connection closed by 159.100.136.21 port 48868 [preauth]
Sep  1 23:46:33 nativespace-cdp sshd[1140000]: Connection closed by 159.100.136.21 port 59088 [preauth]
Sep  1 23:51:33 nativespace-cdp sshd[1141056]: Connection closed by 159.100.136.21 port 40836 [preauth]
Sep  1 23:56:33 nativespace-cdp sshd[1142163]: Connection closed by 159.100.136.21 port 51114 [preauth]
Sep  2 00:01:33 nativespace-cdp sshd[1143609]: Connection closed by 159.100.136.21 port 32860 [preauth]
Sep  2 00:06:33 nativespace-cdp sshd[1144656]: Connection closed by 159.100.136.21 port 43190 [preauth]
Sep  2 00:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 00:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:19 nativespace-cdp sudo[1145183]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 00:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:19 nativespace-cdp sudo[1145188]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 00:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:20 nativespace-cdp sudo[1145193]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 00:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:20 nativespace-cdp sudo[1145200]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 00:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:21 nativespace-cdp sudo[1145206]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:21 nativespace-cdp sudo[1145216]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:21 nativespace-cdp sudo[1145221]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:21 nativespace-cdp sudo[1145226]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:21 nativespace-cdp sudo[1145231]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:21 nativespace-cdp sudo[1145236]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:21 nativespace-cdp sudo[1145242]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 00:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:23 nativespace-cdp sudo[1145253]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 00:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:23 nativespace-cdp sudo[1145259]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=chrisdal user-2=mcdermos user-3=pars user-4=david user-5=careers user-6=nbhavers user-7=tomandle user-8=jennimil user-9=hodgsonmail user-10=ranxterc user-11=outdoorc user-12=branko user-13=romaldki user-14=lucy user-15=attlebor user-16=onlycont user-17=bakery user-18=crrtipdl user-19=sosevalu user-20=nove user-21=boldover user-22=stagingerris user-23=dancinggardener user-24=ladburyp user-25=kategilpin user-26=design user-27=oubpgvbx user-28=tstardom user-29=what user-30=havantho user-31=sketchy user-32=cath user-33=nvihkvu user-34=bwppodcast user-35=zebrapho user-36=steve user-37=sibtoncc user-38=asandcoc user-39=beauty user-40=darkstar user-41=eatspam user-42=dhyana user-43=fawcettd user-44=burydropin user-45=nsceres user-46=smrszyqg user-47=isleofwi user-48=nomistakes user-49=hidden
Sep  2 00:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=tigerlet user-51=barbersh user-52=nscdp user-53=putterfc user-54=foods user-55=leftie user-56=health2045 user-57=fortunaz user-58=lkpier user-59=steakbridieme user-60=donnychicago user-61=firstre5 user-62=ctedorgu user-63=philmcph user-64=hirefootballgame user-65=eugincou user-66=courseme user-67=cambria1 user-68=cathski user-69=reliable user-70=ninejimm user-71=cwsocial user-72=howardon user-73=paulmca1 user-74=pugwash user-75=clarkass user-76=firstrel user-77=costestimatorco user-78=firstred user-79=highlegh user-80=southlon user-81=ultbcrra user-82=jonhartl user-83=seftvta user-84=firstres user-85=opaiscyx user-86=coursemc user-87=accooper user-88=ianrayne user-89=connectedshoppin user-90=thqkgnbz user-91=milloyco user-92=gilpin user-93=elecleis user-94=hubmaster user-95=putterfi user-96=fetch user-97=carsinyo user-98=bedfords user-99=newstoda user-100=ggaaorgu user-101=belle user-102=bemadonn
Sep  2 00:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=nstriton user-104=brighto1 user-105=vivienn1 user-106=firstre2 user-107=oneoarco user-108=battlere user-109=innovat1 user-110=stuartge user-111=askhform user-112=nativene user-113=skyfirec user-114=alexadmin user-115=ulsukarm user-116=markward user-117=booff user-118=foundation user-119=vantagep user-120=athenare user-121=connect9 user-122=lbscrmod user-123=maflemin user-124=agproduc user-125=still user-126=stephani user-127=leereyn1 user-128=jarvisin user-129=spectrum user-130=theblack user-131=hodgesonweb user-132=wilsonsw user-133=megacards user-134=musorguk user-135=brmrjxl user-136=lakesan1 user-137=strathar user-138=atestord user-139=sarafoundation user-140=hhdugcor user-141=lbhyisi user-142=magichat user-143=martsblo user-144=dickemery123 user-145=ptkxhsbt feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 00:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 00:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:24 nativespace-cdp sudo[1145267]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 00:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:24 nativespace-cdp sudo[1145274]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aSBVj2Z5ER2w5NNn.~
Sep  2 00:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:24 nativespace-cdp sudo[1145278]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aSBVj2Z5ER2w5NNn.~'
Sep  2 00:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:24 nativespace-cdp sudo[1145283]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aSBVj2Z5ER2w5NNn.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 00:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:24 nativespace-cdp sudo[1145289]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 00:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:24 nativespace-cdp sudo[1145294]: pam_unix(sudo:session): session closed for user root
Sep  2 00:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 00:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 00:09:26 nativespace-cdp sudo[1145318]: pam_unix(sudo:session): session closed for user root
Sep  2 00:11:33 nativespace-cdp sshd[1146116]: Connection closed by 159.100.136.21 port 53140 [preauth]
Sep  2 00:16:33 nativespace-cdp sshd[1147227]: Connection closed by 159.100.136.21 port 35124 [preauth]
Sep  2 00:21:33 nativespace-cdp sshd[1148289]: Connection closed by 159.100.136.21 port 45098 [preauth]
Sep  2 00:26:33 nativespace-cdp sshd[1149996]: Connection closed by 159.100.136.21 port 55340 [preauth]
Sep  2 00:31:33 nativespace-cdp sshd[1151189]: Connection closed by 159.100.136.21 port 37142 [preauth]
Sep  2 00:36:33 nativespace-cdp sshd[1152308]: Connection closed by 159.100.136.21 port 47432 [preauth]
Sep  2 00:41:33 nativespace-cdp sshd[1153591]: Connection closed by 159.100.136.21 port 57402 [preauth]
Sep  2 00:46:33 nativespace-cdp sshd[1154709]: Connection closed by 159.100.136.21 port 39392 [preauth]
Sep  2 00:51:33 nativespace-cdp sshd[1156061]: Connection closed by 159.100.136.21 port 49390 [preauth]
Sep  2 00:56:33 nativespace-cdp sshd[1157326]: Connection closed by 159.100.136.21 port 59634 [preauth]
Sep  2 01:01:33 nativespace-cdp sshd[1158595]: Connection closed by 159.100.136.21 port 41398 [preauth]
Sep  2 01:06:33 nativespace-cdp sshd[1159789]: Connection closed by 159.100.136.21 port 51724 [preauth]
Sep  2 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:19 nativespace-cdp sudo[1160301]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:19 nativespace-cdp sudo[1160304]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:20 nativespace-cdp sudo[1160307]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 01:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:20 nativespace-cdp sudo[1160313]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 01:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:21 nativespace-cdp sudo[1160316]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:21 nativespace-cdp sudo[1160326]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:21 nativespace-cdp sudo[1160329]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:21 nativespace-cdp sudo[1160332]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:21 nativespace-cdp sudo[1160335]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:21 nativespace-cdp sudo[1160338]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:21 nativespace-cdp sudo[1160341]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 01:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:23 nativespace-cdp sudo[1160348]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 01:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:23 nativespace-cdp sudo[1160352]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=barbersh user-2=tigerlet user-3=nomistakes user-4=hidden user-5=isleofwi user-6=smrszyqg user-7=steakbridieme user-8=donnychicago user-9=firstre5 user-10=philmcph user-11=ctedorgu user-12=lkpier user-13=leftie user-14=foods user-15=health2045 user-16=fortunaz user-17=nscdp user-18=putterfc user-19=courseme user-20=eugincou user-21=hirefootballgame user-22=cwsocial user-23=paulmca1 user-24=pugwash user-25=howardon user-26=ninejimm user-27=reliable user-28=cambria1 user-29=cathski user-30=steve user-31=zebrapho user-32=bwppodcast user-33=asandcoc user-34=sibtoncc user-35=dhyana user-36=darkstar user-37=eatspam user-38=beauty user-39=nsceres user-40=fawcettd user-41=burydropin user-42=crrtipdl user-43=sosevalu user-44=bakery user-45=boldover user-46=nove user-47=design user-48=kategilpin
Sep  2 01:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=stagingerris user-50=dancinggardener user-51=ladburyp user-52=nvihkvu user-53=havantho user-54=sketchy user-55=cath user-56=what user-57=oubpgvbx user-58=tstardom user-59=pars user-60=david user-61=nbhavers user-62=careers user-63=mcdermos user-64=chrisdal user-65=jennimil user-66=tomandle user-67=romaldki user-68=branko user-69=hodgsonmail user-70=outdoorc user-71=ranxterc user-72=onlycont user-73=lucy user-74=attlebor user-75=megacards user-76=musorguk user-77=wilsonsw user-78=atestord user-79=sarafoundation user-80=strathar user-81=brmrjxl user-82=lakesan1 user-83=magichat user-84=hhdugcor user-85=lbhyisi user-86=ptkxhsbt user-87=dickemery123 user-88=martsblo user-89=ulsukarm user-90=lbscrmod user-91=maflemin user-92=vantagep user-93=athenare user-94=connect9 user-95=foundation user-96=booff user-97=markward user-98=leereyn1 user-99=stephani user-100=agproduc user-101=still user-102=hodgesonweb
Sep  2 01:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=theblack user-104=spectrum user-105=jarvisin user-106=bemadonn user-107=newstoda user-108=ggaaorgu user-109=belle user-110=bedfords user-111=oneoarco user-112=battlere user-113=vivienn1 user-114=firstre2 user-115=nstriton user-116=brighto1 user-117=nativene user-118=askhform user-119=stuartge user-120=innovat1 user-121=alexadmin user-122=skyfirec user-123=highlegh user-124=southlon user-125=firstred user-126=costestimatorco user-127=firstrel user-128=clarkass user-129=opaiscyx user-130=coursemc user-131=firstres user-132=ultbcrra user-133=jonhartl user-134=seftvta user-135=thqkgnbz user-136=connectedshoppin user-137=ianrayne user-138=accooper user-139=fetch user-140=carsinyo user-141=hubmaster user-142=putterfi user-143=elecleis user-144=milloyco user-145=gilpin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 01:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 01:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:23 nativespace-cdp sudo[1160358]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 01:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:23 nativespace-cdp sudo[1160366]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DwwEOAIo8HDiN7ze.~
Sep  2 01:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:23 nativespace-cdp sudo[1160369]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DwwEOAIo8HDiN7ze.~'
Sep  2 01:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:23 nativespace-cdp sudo[1160373]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DwwEOAIo8HDiN7ze.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 01:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:24 nativespace-cdp sudo[1160377]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 01:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:24 nativespace-cdp sudo[1160380]: pam_unix(sudo:session): session closed for user root
Sep  2 01:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 01:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 01:09:25 nativespace-cdp sudo[1160397]: pam_unix(sudo:session): session closed for user root
Sep  2 01:11:33 nativespace-cdp sshd[1161257]: Connection closed by 159.100.136.21 port 33440 [preauth]
Sep  2 01:16:33 nativespace-cdp sshd[1162369]: Connection closed by 159.100.136.21 port 43656 [preauth]
Sep  2 01:21:33 nativespace-cdp sshd[1163514]: Connection closed by 159.100.136.21 port 53620 [preauth]
Sep  2 01:26:33 nativespace-cdp sshd[1164859]: Connection closed by 159.100.136.21 port 35670 [preauth]
Sep  2 01:31:33 nativespace-cdp sshd[1165896]: Connection closed by 159.100.136.21 port 45672 [preauth]
Sep  2 01:36:33 nativespace-cdp sshd[1166911]: Connection closed by 159.100.136.21 port 55968 [preauth]
Sep  2 01:41:33 nativespace-cdp sshd[1168046]: Connection closed by 159.100.136.21 port 37688 [preauth]
Sep  2 01:46:33 nativespace-cdp sshd[1169353]: Connection closed by 159.100.136.21 port 47912 [preauth]
Sep  2 01:51:33 nativespace-cdp sshd[1170461]: Connection closed by 159.100.136.21 port 57904 [preauth]
Sep  2 01:56:33 nativespace-cdp sshd[1171660]: Connection closed by 159.100.136.21 port 39938 [preauth]
Sep  2 02:01:33 nativespace-cdp sshd[1172806]: Connection closed by 159.100.136.21 port 49914 [preauth]
Sep  2 02:06:33 nativespace-cdp sshd[1173850]: Connection closed by 159.100.136.21 port 60250 [preauth]
Sep  2 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:19 nativespace-cdp sudo[1174277]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:19 nativespace-cdp sudo[1174280]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:20 nativespace-cdp sudo[1174283]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 02:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:20 nativespace-cdp sudo[1174287]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 02:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:21 nativespace-cdp sudo[1174290]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:21 nativespace-cdp sudo[1174298]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:21 nativespace-cdp sudo[1174302]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:21 nativespace-cdp sudo[1174305]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:21 nativespace-cdp sudo[1174311]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:21 nativespace-cdp sudo[1174314]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:21 nativespace-cdp sudo[1174317]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 02:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:23 nativespace-cdp sudo[1174324]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 02:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:23 nativespace-cdp sudo[1174328]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lakesan1 user-2=brmrjxl user-3=sarafoundation user-4=atestord user-5=strathar user-6=wilsonsw user-7=musorguk user-8=megacards user-9=martsblo user-10=ptkxhsbt user-11=dickemery123 user-12=lbhyisi user-13=hhdugcor user-14=magichat user-15=booff user-16=foundation user-17=markward user-18=maflemin user-19=lbscrmod user-20=athenare user-21=connect9 user-22=vantagep user-23=ulsukarm user-24=jarvisin user-25=theblack user-26=hodgesonweb user-27=spectrum user-28=still user-29=agproduc user-30=leereyn1 user-31=stephani user-32=brighto1 user-33=nstriton user-34=battlere user-35=oneoarco user-36=firstre2 user-37=vivienn1 user-38=bedfords user-39=bemadonn user-40=ggaaorgu user-41=belle user-42=newstoda user-43=skyfirec user-44=alexadmin user-45=askhform user-46=stuartge user-47=innovat1 user-48=nativene
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstres user-50=jonhartl user-51=seftvta user-52=ultbcrra user-53=opaiscyx user-54=coursemc user-55=costestimatorco user-56=firstrel user-57=clarkass user-58=southlon user-59=highlegh user-60=firstred user-61=elecleis user-62=milloyco user-63=gilpin user-64=carsinyo user-65=fetch user-66=hubmaster user-67=putterfi user-68=ianrayne user-69=accooper user-70=thqkgnbz user-71=connectedshoppin user-72=fortunaz user-73=health2045 user-74=leftie user-75=foods user-76=putterfc user-77=nscdp user-78=ctedorgu user-79=philmcph user-80=donnychicago user-81=steakbridieme user-82=firstre5 user-83=lkpier user-84=smrszyqg user-85=isleofwi user-86=tigerlet user-87=barbersh user-88=hidden user-89=nomistakes user-90=ninejimm user-91=reliable user-92=cambria1 user-93=cathski user-94=pugwash user-95=paulmca1 user-96=howardon user-97=cwsocial user-98=hirefootballgame user-99=courseme user-100=eugincou user-101=sibtoncc
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=asandcoc user-103=zebrapho user-104=bwppodcast user-105=steve user-106=burydropin user-107=fawcettd user-108=nsceres user-109=eatspam user-110=darkstar user-111=beauty user-112=dhyana user-113=nove user-114=boldover user-115=sosevalu user-116=crrtipdl user-117=bakery user-118=what user-119=oubpgvbx user-120=tstardom user-121=nvihkvu user-122=cath user-123=sketchy user-124=havantho user-125=kategilpin user-126=ladburyp user-127=dancinggardener user-128=stagingerris user-129=design user-130=tomandle user-131=jennimil user-132=mcdermos user-133=chrisdal user-134=careers user-135=nbhavers user-136=david user-137=pars user-138=attlebor user-139=lucy user-140=onlycont user-141=branko user-142=hodgsonmail user-143=ranxterc user-144=outdoorc user-145=romaldki feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 02:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:23 nativespace-cdp sudo[1174333]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 02:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:23 nativespace-cdp sudo[1174339]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AuJ0bb6SGi9OUp8o.~
Sep  2 02:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:23 nativespace-cdp sudo[1174342]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AuJ0bb6SGi9OUp8o.~'
Sep  2 02:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:23 nativespace-cdp sudo[1174345]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AuJ0bb6SGi9OUp8o.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 02:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:23 nativespace-cdp sudo[1174349]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 02:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:23 nativespace-cdp sudo[1174352]: pam_unix(sudo:session): session closed for user root
Sep  2 02:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 02:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 02:09:24 nativespace-cdp sudo[1174370]: pam_unix(sudo:session): session closed for user root
Sep  2 02:11:33 nativespace-cdp sshd[1175244]: Connection closed by 159.100.136.21 port 42002 [preauth]
Sep  2 02:16:33 nativespace-cdp sshd[1176268]: Connection closed by 159.100.136.21 port 52184 [preauth]
Sep  2 02:21:33 nativespace-cdp sshd[1177344]: Connection closed by 159.100.136.21 port 33928 [preauth]
Sep  2 02:26:33 nativespace-cdp sshd[1178579]: Connection closed by 159.100.136.21 port 44200 [preauth]
Sep  2 02:31:33 nativespace-cdp sshd[1179683]: Connection closed by 159.100.136.21 port 54234 [preauth]
Sep  2 02:36:33 nativespace-cdp sshd[1180750]: Connection closed by 159.100.136.21 port 36276 [preauth]
Sep  2 02:41:33 nativespace-cdp sshd[1181760]: Connection closed by 159.100.136.21 port 46246 [preauth]
Sep  2 02:46:33 nativespace-cdp sshd[1182947]: Connection closed by 159.100.136.21 port 56476 [preauth]
Sep  2 02:51:33 nativespace-cdp sshd[1183952]: Connection closed by 159.100.136.21 port 38216 [preauth]
Sep  2 02:56:33 nativespace-cdp sshd[1185273]: Connection closed by 159.100.136.21 port 48480 [preauth]
Sep  2 03:01:33 nativespace-cdp sshd[1186470]: Connection closed by 159.100.136.21 port 58478 [preauth]
Sep  2 03:06:33 nativespace-cdp sshd[1187569]: Connection closed by 159.100.136.21 port 40534 [preauth]
Sep  2 03:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 03:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:24 nativespace-cdp sudo[1188096]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 03:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:24 nativespace-cdp sudo[1188099]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 03:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:25 nativespace-cdp sudo[1188102]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 03:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:25 nativespace-cdp sudo[1188108]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 03:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:27 nativespace-cdp sudo[1188111]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 03:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:27 nativespace-cdp sudo[1188120]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 03:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:27 nativespace-cdp sudo[1188123]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 03:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:27 nativespace-cdp sudo[1188126]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 03:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:27 nativespace-cdp sudo[1188129]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 03:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:27 nativespace-cdp sudo[1188132]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 03:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:27 nativespace-cdp sudo[1188135]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 03:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:29 nativespace-cdp sudo[1188144]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 03:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:29 nativespace-cdp sudo[1188148]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nativene user-2=stuartge user-3=askhform user-4=innovat1 user-5=alexadmin user-6=skyfirec user-7=bemadonn user-8=ggaaorgu user-9=belle user-10=newstoda user-11=bedfords user-12=battlere user-13=oneoarco user-14=firstre2 user-15=vivienn1 user-16=brighto1 user-17=nstriton user-18=thqkgnbz user-19=connectedshoppin user-20=ianrayne user-21=accooper user-22=carsinyo user-23=fetch user-24=putterfi user-25=hubmaster user-26=elecleis user-27=gilpin user-28=milloyco user-29=southlon user-30=highlegh user-31=firstred user-32=costestimatorco user-33=clarkass user-34=firstrel user-35=coursemc user-36=opaiscyx user-37=firstres user-38=seftvta user-39=jonhartl user-40=ultbcrra user-41=magichat user-42=lbhyisi user-43=hhdugcor user-44=ptkxhsbt user-45=dickemery123 user-46=martsblo user-47=musorguk
Sep  2 03:09:29 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=wilsonsw user-50=sarafoundation user-51=atestord user-52=strathar user-53=brmrjxl user-54=lakesan1 user-55=leereyn1 user-56=stephani user-57=still user-58=agproduc user-59=hodgesonweb user-60=theblack user-61=spectrum user-62=jarvisin user-63=ulsukarm user-64=maflemin user-65=lbscrmod user-66=connect9 user-67=athenare user-68=vantagep user-69=foundation user-70=booff user-71=markward user-72=design user-73=kategilpin user-74=ladburyp user-75=dancinggardener user-76=stagingerris user-77=nvihkvu user-78=sketchy user-79=cath user-80=havantho user-81=what user-82=tstardom user-83=oubpgvbx user-84=sosevalu user-85=crrtipdl user-86=bakery user-87=boldover user-88=nove user-89=romaldki user-90=branko user-91=ranxterc user-92=hodgsonmail user-93=outdoorc user-94=onlycont user-95=attlebor user-96=lucy user-97=careers user-98=nbhavers user-99=pars user-100=david user-101=mcdermos user-102=chrisdal
Sep  2 03:09:29 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=jennimil user-104=tomandle user-105=courseme user-106=eugincou user-107=hirefootballgame user-108=howardon user-109=paulmca1 user-110=pugwash user-111=cwsocial user-112=ninejimm user-113=reliable user-114=cambria1 user-115=cathski user-116=barbersh user-117=tigerlet user-118=hidden user-119=nomistakes user-120=isleofwi user-121=smrszyqg user-122=philmcph user-123=ctedorgu user-124=donnychicago user-125=firstre5 user-126=steakbridieme user-127=lkpier user-128=fortunaz user-129=health2045 user-130=foods user-131=leftie user-132=putterfc user-133=nscdp user-134=dhyana user-135=eatspam user-136=darkstar user-137=beauty user-138=nsceres user-139=burydropin user-140=fawcettd user-141=steve user-142=zebrapho user-143=bwppodcast user-144=asandcoc user-145=sibtoncc feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 03:09:29 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 03:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:30 nativespace-cdp sudo[1188153]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 03:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:30 nativespace-cdp sudo[1188164]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3jR5Ix1CHdRodQBF.~
Sep  2 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:31 nativespace-cdp sudo[1188168]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3jR5Ix1CHdRodQBF.~'
Sep  2 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:31 nativespace-cdp sudo[1188171]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3jR5Ix1CHdRodQBF.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:31 nativespace-cdp sudo[1188175]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:31 nativespace-cdp sudo[1188178]: pam_unix(sudo:session): session closed for user root
Sep  2 03:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 03:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 03:09:32 nativespace-cdp sudo[1188205]: pam_unix(sudo:session): session closed for user root
Sep  2 03:11:33 nativespace-cdp sshd[1188898]: Connection closed by 159.100.136.21 port 50530 [preauth]
Sep  2 03:16:33 nativespace-cdp sshd[1190162]: Connection closed by 159.100.136.21 port 60736 [preauth]
Sep  2 03:21:33 nativespace-cdp sshd[1191234]: Connection closed by 159.100.136.21 port 42464 [preauth]
Sep  2 03:26:33 nativespace-cdp sshd[1192473]: Connection closed by 159.100.136.21 port 52748 [preauth]
Sep  2 03:31:33 nativespace-cdp sshd[1193550]: Connection closed by 159.100.136.21 port 34528 [preauth]
Sep  2 03:36:33 nativespace-cdp sshd[1194761]: Connection closed by 159.100.136.21 port 44816 [preauth]
Sep  2 03:41:33 nativespace-cdp sshd[1195922]: Connection closed by 159.100.136.21 port 54790 [preauth]
Sep  2 03:46:33 nativespace-cdp sshd[1197109]: Connection closed by 159.100.136.21 port 36766 [preauth]
Sep  2 03:51:34 nativespace-cdp sshd[1198126]: Connection closed by 159.100.136.21 port 46766 [preauth]
Sep  2 03:56:33 nativespace-cdp sshd[1199424]: Connection closed by 159.100.136.21 port 57022 [preauth]
Sep  2 04:01:33 nativespace-cdp sshd[1200633]: Connection closed by 159.100.136.21 port 38760 [preauth]
Sep  2 04:06:33 nativespace-cdp sshd[1201773]: Connection closed by 159.100.136.21 port 49076 [preauth]
Sep  2 04:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 04:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:20 nativespace-cdp sudo[1202252]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 04:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:20 nativespace-cdp sudo[1202255]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 04:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:20 nativespace-cdp sudo[1202258]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 04:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:20 nativespace-cdp sudo[1202261]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 04:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:22 nativespace-cdp sudo[1202264]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 04:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:22 nativespace-cdp sudo[1202272]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 04:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:22 nativespace-cdp sudo[1202275]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 04:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:22 nativespace-cdp sudo[1202278]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 04:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:22 nativespace-cdp sudo[1202281]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 04:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:22 nativespace-cdp sudo[1202284]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 04:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:23 nativespace-cdp sudo[1202287]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 04:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:24 nativespace-cdp sudo[1202298]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 04:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:24 nativespace-cdp sudo[1202302]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=zebrapho user-2=bwppodcast user-3=steve user-4=sibtoncc user-5=asandcoc user-6=eatspam user-7=darkstar user-8=beauty user-9=dhyana user-10=burydropin user-11=fawcettd user-12=nsceres user-13=isleofwi user-14=smrszyqg user-15=barbersh user-16=tigerlet user-17=hidden user-18=nomistakes user-19=health2045 user-20=fortunaz user-21=leftie user-22=foods user-23=putterfc user-24=nscdp user-25=philmcph user-26=ctedorgu user-27=steakbridieme user-28=donnychicago user-29=firstre5 user-30=lkpier user-31=hirefootballgame user-32=courseme user-33=eugincou user-34=ninejimm user-35=reliable user-36=cambria1 user-37=cathski user-38=paulmca1 user-39=pugwash user-40=howardon user-41=cwsocial user-42=mcdermos user-43=chrisdal user-44=careers user-45=nbhavers user-46=pars user-47=david user-48=tomandle
Sep  2 04:09:24 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=jennimil user-50=branko user-51=hodgsonmail user-52=outdoorc user-53=ranxterc user-54=romaldki user-55=attlebor user-56=lucy user-57=onlycont user-58=sosevalu user-59=crrtipdl user-60=bakery user-61=nove user-62=boldover user-63=kategilpin user-64=ladburyp user-65=dancinggardener user-66=stagingerris user-67=design user-68=what user-69=tstardom user-70=oubpgvbx user-71=nvihkvu user-72=sketchy user-73=cath user-74=havantho user-75=ulsukarm user-76=foundation user-77=booff user-78=markward user-79=maflemin user-80=lbscrmod user-81=athenare user-82=connect9 user-83=vantagep user-84=still user-85=agproduc user-86=leereyn1 user-87=stephani user-88=jarvisin user-89=hodgesonweb user-90=theblack user-91=spectrum user-92=wilsonsw user-93=musorguk user-94=megacards user-95=lakesan1 user-96=brmrjxl user-97=sarafoundation user-98=atestord user-99=strathar user-100=lbhyisi user-101=hhdugcor user-102=magichat
Sep  2 04:09:24 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=martsblo user-104=ptkxhsbt user-105=dickemery123 user-106=costestimatorco user-107=firstrel user-108=clarkass user-109=southlon user-110=highlegh user-111=firstred user-112=firstres user-113=jonhartl user-114=seftvta user-115=ultbcrra user-116=opaiscyx user-117=coursemc user-118=ianrayne user-119=accooper user-120=thqkgnbz user-121=connectedshoppin user-122=elecleis user-123=milloyco user-124=gilpin user-125=carsinyo user-126=fetch user-127=putterfi user-128=hubmaster user-129=bedfords user-130=bemadonn user-131=ggaaorgu user-132=belle user-133=newstoda user-134=brighto1 user-135=nstriton user-136=battlere user-137=oneoarco user-138=firstre2 user-139=vivienn1 user-140=stuartge user-141=askhform user-142=innovat1 user-143=nativene user-144=alexadmin user-145=skyfirec feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 04:09:24 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 04:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:25 nativespace-cdp sudo[1202308]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 04:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:25 nativespace-cdp sudo[1202312]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-XBPliM0vCpUbaNCs.~
Sep  2 04:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:25 nativespace-cdp sudo[1202315]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-XBPliM0vCpUbaNCs.~'
Sep  2 04:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:25 nativespace-cdp sudo[1202318]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-XBPliM0vCpUbaNCs.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 04:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:25 nativespace-cdp sudo[1202322]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 04:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:25 nativespace-cdp sudo[1202325]: pam_unix(sudo:session): session closed for user root
Sep  2 04:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 04:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:09:26 nativespace-cdp sudo[1202343]: pam_unix(sudo:session): session closed for user root
Sep  2 04:11:33 nativespace-cdp sshd[1203183]: Connection closed by 159.100.136.21 port 59060 [preauth]
Sep  2 04:16:33 nativespace-cdp sshd[1204157]: Connection closed by 159.100.136.21 port 41044 [preauth]
Sep  2 04:21:33 nativespace-cdp sshd[1205324]: Connection closed by 159.100.136.21 port 51010 [preauth]
Sep  2 04:26:33 nativespace-cdp sshd[1206374]: Connection closed by 159.100.136.21 port 33028 [preauth]
Sep  2 04:31:32 nativespace-cdp sshd[1207644]: Connection closed by 159.100.136.21 port 43066 [preauth]
Sep  2 04:36:35 nativespace-cdp sshd[1210145]: Connection closed by 159.100.136.21 port 53368 [preauth]
Sep  2 04:41:32 nativespace-cdp sshd[1211596]: Connection closed by 159.100.136.21 port 35086 [preauth]
Sep  2 04:46:33 nativespace-cdp sshd[1212647]: Connection closed by 159.100.136.21 port 45288 [preauth]
Sep  2 04:51:33 nativespace-cdp sshd[1213638]: Connection closed by 159.100.136.21 port 55292 [preauth]
Sep  2 04:56:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 04:56:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:24 nativespace-cdp sudo[1214737]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 04:56:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:24 nativespace-cdp sudo[1214750]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 04:56:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:27 nativespace-cdp sudo[1214759]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ctedorgu user-2=philmcph user-3=steakbridieme user-4=donnychicago user-5=firstre5 user-6=lkpier user-7=health2045 user-8=fortunaz user-9=leftie user-10=foods user-11=putterfc user-12=nscdp user-13=tigerlet user-14=barbersh user-15=hidden user-16=nomistakes user-17=isleofwi user-18=smrszyqg user-19=pugwash user-20=paulmca1 user-21=howardon user-22=cwsocial user-23=ninejimm user-24=reliable user-25=cathski user-26=cambria1 user-27=courseme user-28=eugincou user-29=hirefootballgame user-30=sibtoncc user-31=asandcoc user-32=steve user-33=zebrapho user-34=bwppodcast user-35=nsceres user-36=burydropin user-37=fawcettd user-38=dhyana user-39=eatspam user-40=darkstar user-41=beauty user-42=boldover user-43=nove user-44=sosevalu user-45=crrtipdl user-46=bakery user-47=nvihkvu user-48=sketchy user-49=cath
Sep  2 04:56:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=havantho user-51=what user-52=oubpgvbx user-53=tstardom user-54=design user-55=kategilpin user-56=ladburyp user-57=dancinggardener user-58=stagingerris user-59=jennimil user-60=tomandle user-61=careers user-62=nbhavers user-63=pars user-64=david user-65=mcdermos user-66=chrisdal user-67=onlycont user-68=attlebor user-69=lucy user-70=romaldki user-71=branko user-72=outdoorc user-73=ranxterc user-74=hodgsonmail user-75=sarafoundation user-76=atestord user-77=strathar user-78=brmrjxl user-79=lakesan1 user-80=musorguk user-81=megacards user-82=wilsonsw user-83=ptkxhsbt user-84=dickemery123 user-85=martsblo user-86=magichat user-87=lbhyisi user-88=hhdugcor user-89=maflemin user-90=lbscrmod user-91=connect9 user-92=athenare user-93=vantagep user-94=booff user-95=markward user-96=foundation user-97=ulsukarm user-98=hodgesonweb user-99=theblack user-100=spectrum user-101=jarvisin user-102=leereyn1
Sep  2 04:56:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=stephani user-104=still user-105=agproduc user-106=battlere user-107=oneoarco user-108=firstre2 user-109=vivienn1 user-110=brighto1 user-111=nstriton user-112=bemadonn user-113=belle user-114=ggaaorgu user-115=newstoda user-116=bedfords user-117=alexadmin user-118=skyfirec user-119=nativene user-120=stuartge user-121=askhform user-122=innovat1 user-123=opaiscyx user-124=coursemc user-125=firstres user-126=jonhartl user-127=seftvta user-128=ultbcrra user-129=southlon user-130=highlegh user-131=firstred user-132=costestimatorco user-133=clarkass user-134=firstrel user-135=carsinyo user-136=fetch user-137=hubmaster user-138=putterfi user-139=elecleis user-140=milloyco user-141=gilpin user-142=thqkgnbz user-143=connectedshoppin user-144=ianrayne user-145=accooper feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 04:56:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 04:56:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:28 nativespace-cdp sudo[1214763]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  2 04:56:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:30 nativespace-cdp sudo[1214768]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=onlycont --output=json
Sep  2 04:56:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:30 nativespace-cdp sudo[1214774]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:33 nativespace-cdp sshd[1214792]: Connection closed by 159.100.136.21 port 37314 [preauth]
Sep  2 04:56:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  2 04:56:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 04:56:51 nativespace-cdp sudo[1214868]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 04:56:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user onlycont --user-current --json
Sep  2 04:56:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:52 nativespace-cdp sudo[1214874]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont LangPHP php_get_vhost_versions --output=json
Sep  2 04:56:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:54 nativespace-cdp sudo[1214882]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep  2 04:56:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:56 nativespace-cdp sudo[1214932]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  2 04:56:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:56 nativespace-cdp sudo[1214985]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DomainInfo single_domain_data domain=apexred.com return_https_redirect_status=1 --output=json
Sep  2 04:56:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:56:58 nativespace-cdp sudo[1214997]: pam_unix(sudo:session): session closed for user root
Sep  2 04:56:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep  2 04:56:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:01 nativespace-cdp sudo[1215005]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep  2 04:57:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:02 nativespace-cdp sudo[1215033]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont Mime list_redirects --output=json
Sep  2 04:57:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:03 nativespace-cdp sudo[1215043]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DirectoryPrivacy is_directory_protected dir=/home/onlycont/public_html/wp --output=json
Sep  2 04:57:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:06 nativespace-cdp sudo[1215104]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  2 04:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 04:57:09 nativespace-cdp sudo[1215217]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 04:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep  2 04:57:09 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep  2 04:57:09 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep  2 04:57:09 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 04:57:10 nativespace-cdp sudo[1215223]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 04:57:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  2 04:57:10 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  2 04:57:10 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  2 04:57:10 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:57:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 04:57:11 nativespace-cdp sudo[1215230]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 04:57:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  2 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  2 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  2 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:57:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 04:57:13 nativespace-cdp sudo[1215238]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 04:57:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  2 04:57:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 04:57:22 nativespace-cdp sudo[1215422]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:57:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 04:57:22 nativespace-cdp sudo[1215429]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:57:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 04:57:22 nativespace-cdp sudo[1215435]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  2 04:57:22 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:57:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 04:57:22 nativespace-cdp sudo[1215441]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 04:57:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  2 04:57:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:24 nativespace-cdp sudo[1215493]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep  2 04:57:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:24 nativespace-cdp sudo[1215497]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  2 04:57:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:57:41 nativespace-cdp sudo[1215579]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:57:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  2 04:57:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:41 nativespace-cdp sudo[1215586]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep  2 04:57:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:42 nativespace-cdp sudo[1215591]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep  2 04:57:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:43 nativespace-cdp sudo[1215598]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  2 04:57:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:43 nativespace-cdp sudo[1215606]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep  2 04:57:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:46 nativespace-cdp sudo[1215624]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep  2 04:57:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:46 nativespace-cdp sudo[1215629]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep  2 04:57:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:57:54 nativespace-cdp sudo[1215698]: pam_unix(sudo:session): session closed for user root
Sep  2 04:57:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  2 04:57:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:57:57 nativespace-cdp sudo[1215754]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:57:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  2 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  2 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  2 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:57:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:57:57 nativespace-cdp sudo[1215760]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:57:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  2 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  2 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  2 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:57:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:58:16 nativespace-cdp sudo[1215768]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:58:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  2 04:58:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:58:24 nativespace-cdp sudo[1215948]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:58:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  2 04:58:24 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  2 04:58:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  2 04:58:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:58:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:58:24 nativespace-cdp sudo[1215954]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:58:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  2 04:58:24 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  2 04:58:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  2 04:58:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:58:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:58:24 nativespace-cdp sudo[1215960]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:58:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  2 04:58:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:58:26 nativespace-cdp sudo[1215997]: pam_unix(sudo:session): session closed for user root
Sep  2 04:58:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep  2 04:58:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:58:26 nativespace-cdp sudo[1216001]: pam_unix(sudo:session): session closed for user root
Sep  2 04:58:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  2 04:58:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 04:58:37 nativespace-cdp sudo[1216074]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 04:58:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep  2 04:58:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:58:38 nativespace-cdp sudo[1216080]: pam_unix(sudo:session): session closed for user root
Sep  2 04:58:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep  2 04:58:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:58:38 nativespace-cdp sudo[1216084]: pam_unix(sudo:session): session closed for user root
Sep  2 04:58:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  2 04:58:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:58:38 nativespace-cdp sudo[1216088]: pam_unix(sudo:session): session closed for user root
Sep  2 04:58:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep  2 04:58:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:58:40 nativespace-cdp sudo[1216102]: pam_unix(sudo:session): session closed for user root
Sep  2 04:58:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep  2 04:58:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:58:40 nativespace-cdp sudo[1216107]: pam_unix(sudo:session): session closed for user root
Sep  2 04:58:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep  2 04:58:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:58:45 nativespace-cdp sudo[1216177]: pam_unix(sudo:session): session closed for user root
Sep  2 04:58:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  2 04:58:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 04:58:48 nativespace-cdp sudo[1216236]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 04:58:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  2 04:58:48 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  2 04:58:48 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  2 04:58:48 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:58:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 04:58:48 nativespace-cdp sudo[1216243]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 04:58:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  2 04:58:48 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  2 04:58:48 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  2 04:58:48 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:58:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 04:59:00 nativespace-cdp sudo[1216249]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 04:59:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  2 04:59:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  2 04:59:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  2 04:59:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:59:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 04:59:01 nativespace-cdp sudo[1216281]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 04:59:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  2 04:59:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 04:59:07 nativespace-cdp sudo[1216408]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 04:59:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  2 04:59:07 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  2 04:59:07 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  2 04:59:07 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:59:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 04:59:07 nativespace-cdp sudo[1216414]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 04:59:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  2 04:59:07 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  2 04:59:07 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  2 04:59:07 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:59:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 04:59:08 nativespace-cdp sudo[1216420]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 04:59:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  2 04:59:08 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  2 04:59:08 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  2 04:59:08 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:59:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 04:59:08 nativespace-cdp sudo[1216426]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 04:59:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  2 04:59:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:10 nativespace-cdp sudo[1216460]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep  2 04:59:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:10 nativespace-cdp sudo[1216464]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep  2 04:59:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:11 nativespace-cdp sudo[1216480]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep  2 04:59:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:11 nativespace-cdp sudo[1216485]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  2 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  2 04:59:12 nativespace-cdp sudo[1216495]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  2 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep  2 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:12 nativespace-cdp sudo[1216502]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep  2 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:13 nativespace-cdp sudo[1216507]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  2 04:59:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:13 nativespace-cdp sudo[1216511]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  2 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:59:21 nativespace-cdp sudo[1216567]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  2 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:21 nativespace-cdp sudo[1216573]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  2 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:21 nativespace-cdp sudo[1216577]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep  2 04:59:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:23 nativespace-cdp sudo[1216600]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep  2 04:59:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:27 nativespace-cdp sudo[1216665]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  2 04:59:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:59:30 nativespace-cdp sudo[1216723]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:59:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  2 04:59:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  2 04:59:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  2 04:59:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:59:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:59:31 nativespace-cdp sudo[1216730]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:59:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  2 04:59:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  2 04:59:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  2 04:59:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:59:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:59:45 nativespace-cdp sudo[1216738]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:59:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  2 04:59:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:59:50 nativespace-cdp sudo[1216871]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:59:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  2 04:59:50 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  2 04:59:50 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  2 04:59:50 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:59:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:59:50 nativespace-cdp sudo[1216878]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:59:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  2 04:59:50 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  2 04:59:50 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  2 04:59:50 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  2 04:59:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 04:59:50 nativespace-cdp sudo[1216884]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 04:59:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  2 04:59:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:53 nativespace-cdp sudo[1216923]: pam_unix(sudo:session): session closed for user root
Sep  2 04:59:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep  2 04:59:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 04:59:53 nativespace-cdp sudo[1216927]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  2 05:00:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  2 05:00:01 nativespace-cdp sudo[1216982]: pam_unix(sudo:session): session closed for user fortunaz
Sep  2 05:00:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep  2 05:00:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:02 nativespace-cdp sudo[1216988]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep  2 05:00:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:02 nativespace-cdp sudo[1217046]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  2 05:00:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:02 nativespace-cdp sudo[1217118]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep  2 05:00:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:06 nativespace-cdp sudo[1217183]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  2 05:00:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:06 nativespace-cdp sudo[1217189]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep  2 05:00:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:12 nativespace-cdp sudo[1217259]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=ctedorgu WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "Advanced Form Integration" on ONE | OAR (https://oneoar.co.uk). Installed version: 1.64.0. Available version: 1.90.1.<br/><br/>' installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>'
Sep  2 05:00:25 nativespace-cdp sudo: wp-toolkit : (command continued) --output=json
Sep  2 05:00:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:26 nativespace-cdp sudo[1217511]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep  2 05:00:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:34 nativespace-cdp sudo[1217633]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217636]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217639]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217642]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217645]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217648]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217651]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217654]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217657]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217661]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217664]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217667]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217670]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217673]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217676]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217679]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217682]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217685]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217688]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217692]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217695]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217698]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:35 nativespace-cdp sudo[1217701]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217704]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217707]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217710]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217713]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217716]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217719]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217722]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217725]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217728]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217731]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217734]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217737]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217740]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217743]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217746]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217749]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217752]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217755]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217759]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217763]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217767]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217770]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217773]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217776]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217779]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217782]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217785]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217788]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217791]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217794]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217797]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217800]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217803]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:36 nativespace-cdp sudo[1217806]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217809]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217812]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217815]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217818]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217821]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217824]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217827]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217830]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217833]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217836]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217839]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217842]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217845]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217848]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217851]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217854]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217857]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217860]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217863]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217866]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217869]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217875]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217878]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217881]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217884]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217887]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217890]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217893]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217896]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217899]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217902]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:37 nativespace-cdp sudo[1217905]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217908]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217911]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217914]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217917]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217920]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217923]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217927]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217930]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217933]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217936]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217939]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217943]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217946]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217949]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217952]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217955]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217958]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217961]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217965]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217968]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217972]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217975]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217978]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217981]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217984]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217987]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217990]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217993]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1217996]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1218000]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1218003]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1218006]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1218009]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:38 nativespace-cdp sudo[1218012]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218015]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218018]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218021]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218024]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218027]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218030]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218033]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218036]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218039]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218042]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218045]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218048]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218051]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218054]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218057]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218060]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218063]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218066]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218069]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218072]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218075]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218078]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218081]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218085]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218088]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218091]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218094]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218097]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218100]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218103]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218106]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218109]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218112]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218115]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218118]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218121]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218124]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:39 nativespace-cdp sudo[1218127]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218130]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218133]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218136]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218139]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218143]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218146]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218149]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218152]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218155]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218158]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218161]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218164]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218167]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218170]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218173]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218176]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218179]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218182]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218185]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218188]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218192]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218195]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218198]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218201]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218204]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218207]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218210]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218213]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218216]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218219]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218222]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218225]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218228]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:40 nativespace-cdp sudo[1218231]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218234]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218237]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218240]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218243]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218246]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218249]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218252]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218255]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218258]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218261]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218264]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218268]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218272]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218277]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218280]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218283]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218286]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218289]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218292]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218295]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218298]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218301]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218304]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218308]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218311]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218314]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218317]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218320]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218323]: pam_unix(sudo:session): session closed for user root
Sep  2 05:00:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  2 05:00:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:00:41 nativespace-cdp sudo[1218326]: pam_unix(sudo:session): session closed for user root
Sep  2 05:01:33 nativespace-cdp sshd[1218482]: Connection closed by 159.100.136.21 port 47300 [preauth]
Sep  2 05:06:33 nativespace-cdp sshd[1219614]: Connection closed by 159.100.136.21 port 57620 [preauth]
Sep  2 05:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 05:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:21 nativespace-cdp sudo[1220132]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 05:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:21 nativespace-cdp sudo[1220135]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 05:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:22 nativespace-cdp sudo[1220138]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 05:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:22 nativespace-cdp sudo[1220142]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 05:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:25 nativespace-cdp sudo[1220145]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:25 nativespace-cdp sudo[1220162]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:25 nativespace-cdp sudo[1220165]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:25 nativespace-cdp sudo[1220168]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:25 nativespace-cdp sudo[1220171]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:25 nativespace-cdp sudo[1220174]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:25 nativespace-cdp sudo[1220177]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 05:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:27 nativespace-cdp sudo[1220185]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 05:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:27 nativespace-cdp sudo[1220189]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nsceres user-2=fawcettd user-3=burydropin user-4=dhyana user-5=darkstar user-6=eatspam user-7=beauty user-8=asandcoc user-9=sibtoncc user-10=steve user-11=zebrapho user-12=bwppodcast user-13=cwsocial user-14=paulmca1 user-15=howardon user-16=pugwash user-17=ninejimm user-18=reliable user-19=cathski user-20=cambria1 user-21=courseme user-22=eugincou user-23=hirefootballgame user-24=steakbridieme user-25=donnychicago user-26=firstre5 user-27=philmcph user-28=ctedorgu user-29=lkpier user-30=leftie user-31=foods user-32=fortunaz user-33=health2045 user-34=nscdp user-35=putterfc user-36=barbersh user-37=tigerlet user-38=nomistakes user-39=hidden user-40=smrszyqg user-41=isleofwi user-42=onlycont user-43=lucy user-44=attlebor user-45=romaldki user-46=branko user-47=outdoorc user-48=ranxterc
Sep  2 05:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=hodgsonmail user-50=jennimil user-51=tomandle user-52=pars user-53=david user-54=careers user-55=nbhavers user-56=mcdermos user-57=chrisdal user-58=nvihkvu user-59=havantho user-60=cath user-61=sketchy user-62=what user-63=oubpgvbx user-64=tstardom user-65=design user-66=kategilpin user-67=stagingerris user-68=dancinggardener user-69=ladburyp user-70=boldover user-71=nove user-72=crrtipdl user-73=sosevalu user-74=bakery user-75=theblack user-76=hodgesonweb user-77=spectrum user-78=jarvisin user-79=leereyn1 user-80=stephani user-81=agproduc user-82=still user-83=lbscrmod user-84=maflemin user-85=vantagep user-86=athenare user-87=connect9 user-88=foundation user-89=markward user-90=booff user-91=ulsukarm user-92=ptkxhsbt user-93=dickemery123 user-94=martsblo user-95=magichat user-96=hhdugcor user-97=lbhyisi user-98=atestord user-99=sarafoundation user-100=strathar user-101=brmrjxl user-102=lakesan1
Sep  2 05:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=megacards user-104=musorguk user-105=wilsonsw user-106=fetch user-107=carsinyo user-108=hubmaster user-109=putterfi user-110=elecleis user-111=gilpin user-112=milloyco user-113=thqkgnbz user-114=connectedshoppin user-115=ianrayne user-116=accooper user-117=opaiscyx user-118=coursemc user-119=firstres user-120=ultbcrra user-121=jonhartl user-122=seftvta user-123=highlegh user-124=southlon user-125=firstred user-126=costestimatorco user-127=clarkass user-128=firstrel user-129=alexadmin user-130=skyfirec user-131=nativene user-132=stuartge user-133=askhform user-134=innovat1 user-135=oneoarco user-136=battlere user-137=vivienn1 user-138=firstre2 user-139=nstriton user-140=brighto1 user-141=bemadonn user-142=newstoda user-143=belle user-144=ggaaorgu user-145=bedfords feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 05:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 05:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:27 nativespace-cdp sudo[1220193]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 05:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:28 nativespace-cdp sudo[1220198]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-p34ogpHREICZKFto.~
Sep  2 05:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:28 nativespace-cdp sudo[1220202]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-p34ogpHREICZKFto.~'
Sep  2 05:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:28 nativespace-cdp sudo[1220205]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-p34ogpHREICZKFto.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 05:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:28 nativespace-cdp sudo[1220209]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 05:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:28 nativespace-cdp sudo[1220213]: pam_unix(sudo:session): session closed for user root
Sep  2 05:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 05:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 05:09:29 nativespace-cdp sudo[1220232]: pam_unix(sudo:session): session closed for user root
Sep  2 05:11:33 nativespace-cdp sshd[1220911]: Connection closed by 159.100.136.21 port 39348 [preauth]
Sep  2 05:16:34 nativespace-cdp sshd[1221929]: Connection closed by 159.100.136.21 port 49568 [preauth]
Sep  2 05:21:33 nativespace-cdp sshd[1223025]: Connection closed by 159.100.136.21 port 59524 [preauth]
Sep  2 05:26:33 nativespace-cdp sshd[1224098]: Connection closed by 159.100.136.21 port 41564 [preauth]
Sep  2 05:31:33 nativespace-cdp sshd[1225314]: Connection closed by 159.100.136.21 port 51612 [preauth]
Sep  2 05:35:10 nativespace-cdp su: pam_unix(su:session): session opened for user philmcph by (uid=0)
Sep  2 05:35:10 nativespace-cdp su[1226147]: pam_unix(su:session): session closed for user philmcph
Sep  2 05:36:33 nativespace-cdp sshd[1226417]: Connection closed by 159.100.136.21 port 33488 [preauth]
Sep  2 05:41:33 nativespace-cdp sshd[1227699]: Connection closed by 159.100.136.21 port 43466 [preauth]
Sep  2 05:46:33 nativespace-cdp sshd[1228880]: Connection closed by 159.100.136.21 port 53664 [preauth]
Sep  2 05:51:33 nativespace-cdp sshd[1230014]: Connection closed by 159.100.136.21 port 35428 [preauth]
Sep  2 05:56:33 nativespace-cdp sshd[1231234]: Connection closed by 159.100.136.21 port 45690 [preauth]
Sep  2 06:01:33 nativespace-cdp sshd[1232370]: Connection closed by 159.100.136.21 port 55656 [preauth]
Sep  2 06:06:33 nativespace-cdp sshd[1233423]: Connection closed by 159.100.136.21 port 37758 [preauth]
Sep  2 06:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 06:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:19 nativespace-cdp sudo[1233988]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 06:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:19 nativespace-cdp sudo[1233991]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 06:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:20 nativespace-cdp sudo[1233994]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 06:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:20 nativespace-cdp sudo[1234000]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 06:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:21 nativespace-cdp sudo[1234003]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:21 nativespace-cdp sudo[1234016]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:21 nativespace-cdp sudo[1234019]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:21 nativespace-cdp sudo[1234022]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:21 nativespace-cdp sudo[1234025]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:21 nativespace-cdp sudo[1234029]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:21 nativespace-cdp sudo[1234033]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 06:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:23 nativespace-cdp sudo[1234040]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 06:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:23 nativespace-cdp sudo[1234044]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nscdp user-2=putterfc user-3=foods user-4=leftie user-5=fortunaz user-6=health2045 user-7=lkpier user-8=donnychicago user-9=steakbridieme user-10=firstre5 user-11=philmcph user-12=ctedorgu user-13=smrszyqg user-14=isleofwi user-15=nomistakes user-16=hidden user-17=barbersh user-18=tigerlet user-19=cathski user-20=cambria1 user-21=ninejimm user-22=reliable user-23=cwsocial user-24=pugwash user-25=paulmca1 user-26=howardon user-27=hirefootballgame user-28=eugincou user-29=courseme user-30=sibtoncc user-31=asandcoc user-32=bwppodcast user-33=zebrapho user-34=steve user-35=fawcettd user-36=burydropin user-37=nsceres user-38=beauty user-39=darkstar user-40=eatspam user-41=dhyana user-42=nove user-43=boldover user-44=bakery user-45=crrtipdl user-46=sosevalu user-47=tstardom user-48=oubpgvbx
Sep  2 06:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=what user-50=havantho user-51=cath user-52=sketchy user-53=nvihkvu user-54=dancinggardener user-55=stagingerris user-56=ladburyp user-57=kategilpin user-58=design user-59=tomandle user-60=jennimil user-61=chrisdal user-62=mcdermos user-63=pars user-64=david user-65=nbhavers user-66=careers user-67=lucy user-68=attlebor user-69=onlycont user-70=ranxterc user-71=outdoorc user-72=hodgsonmail user-73=branko user-74=romaldki user-75=lakesan1 user-76=brmrjxl user-77=strathar user-78=atestord user-79=sarafoundation user-80=wilsonsw user-81=megacards user-82=musorguk user-83=martsblo user-84=dickemery123 user-85=ptkxhsbt user-86=hhdugcor user-87=lbhyisi user-88=magichat user-89=booff user-90=markward user-91=foundation user-92=vantagep user-93=athenare user-94=connect9 user-95=lbscrmod user-96=maflemin user-97=ulsukarm user-98=jarvisin user-99=spectrum user-100=hodgesonweb user-101=theblack user-102=agproduc
Sep  2 06:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=still user-104=stephani user-105=leereyn1 user-106=nstriton user-107=brighto1 user-108=vivienn1 user-109=firstre2 user-110=oneoarco user-111=battlere user-112=bedfords user-113=newstoda user-114=belle user-115=ggaaorgu user-116=bemadonn user-117=alexadmin user-118=skyfirec user-119=innovat1 user-120=askhform user-121=stuartge user-122=nativene user-123=ultbcrra user-124=seftvta user-125=jonhartl user-126=firstres user-127=opaiscyx user-128=coursemc user-129=clarkass user-130=firstrel user-131=costestimatorco user-132=firstred user-133=highlegh user-134=southlon user-135=gilpin user-136=milloyco user-137=elecleis user-138=hubmaster user-139=putterfi user-140=fetch user-141=carsinyo user-142=accooper user-143=ianrayne user-144=connectedshoppin user-145=thqkgnbz feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 06:09:23 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 06:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:24 nativespace-cdp sudo[1234049]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 06:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:24 nativespace-cdp sudo[1234054]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-XCPwznRibobwwl4Q.~
Sep  2 06:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:24 nativespace-cdp sudo[1234057]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-XCPwznRibobwwl4Q.~'
Sep  2 06:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:24 nativespace-cdp sudo[1234060]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-XCPwznRibobwwl4Q.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 06:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:24 nativespace-cdp sudo[1234064]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 06:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:24 nativespace-cdp sudo[1234067]: pam_unix(sudo:session): session closed for user root
Sep  2 06:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 06:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:09:28 nativespace-cdp sudo[1234101]: pam_unix(sudo:session): session closed for user root
Sep  2 06:11:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 06:11:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 06:11:01 nativespace-cdp sudo[1234598]: pam_unix(sudo:session): session closed for user root
Sep  2 06:11:33 nativespace-cdp sshd[1234675]: Connection closed by 159.100.136.21 port 47744 [preauth]
Sep  2 06:16:33 nativespace-cdp sshd[1235862]: Connection closed by 159.100.136.21 port 57926 [preauth]
Sep  2 06:21:33 nativespace-cdp sshd[1236997]: Connection closed by 159.100.136.21 port 39676 [preauth]
Sep  2 06:23:25 nativespace-cdp sshd[1237379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.55.247  user=root
Sep  2 06:23:25 nativespace-cdp sshd[1237379]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 06:23:27 nativespace-cdp sshd[1237379]: Failed password for root from 206.189.55.247 port 57632 ssh2
Sep  2 06:23:27 nativespace-cdp sshd[1237379]: Received disconnect from 206.189.55.247 port 57632:11: Bye Bye [preauth]
Sep  2 06:23:27 nativespace-cdp sshd[1237379]: Disconnected from 206.189.55.247 port 57632 [preauth]
Sep  2 06:25:21 nativespace-cdp sshd[1237987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.31.118.11  user=root
Sep  2 06:25:21 nativespace-cdp sshd[1237987]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 06:25:23 nativespace-cdp sshd[1237987]: Failed password for root from 103.31.118.11 port 44270 ssh2
Sep  2 06:25:24 nativespace-cdp sshd[1237987]: Received disconnect from 103.31.118.11 port 44270:11: Bye Bye [preauth]
Sep  2 06:25:24 nativespace-cdp sshd[1237987]: Disconnected from 103.31.118.11 port 44270 [preauth]
Sep  2 06:26:33 nativespace-cdp sshd[1238241]: Connection closed by 159.100.136.21 port 49940 [preauth]
Sep  2 06:29:08 nativespace-cdp sshd[1238731]: Invalid user chezmoi from 206.189.55.247 port 55666
Sep  2 06:29:08 nativespace-cdp sshd[1238731]: input_userauth_request: invalid user chezmoi [preauth]
Sep  2 06:29:08 nativespace-cdp sshd[1238731]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 06:29:08 nativespace-cdp sshd[1238731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.55.247
Sep  2 06:29:10 nativespace-cdp sshd[1238731]: Failed password for invalid user chezmoi from 206.189.55.247 port 55666 ssh2
Sep  2 06:29:10 nativespace-cdp sshd[1238731]: Received disconnect from 206.189.55.247 port 55666:11: Bye Bye [preauth]
Sep  2 06:29:10 nativespace-cdp sshd[1238731]: Disconnected from 206.189.55.247 port 55666 [preauth]
Sep  2 06:30:01 nativespace-cdp sshd[1238836]: Invalid user guest from 206.189.55.247 port 48136
Sep  2 06:30:01 nativespace-cdp sshd[1238836]: input_userauth_request: invalid user guest [preauth]
Sep  2 06:30:01 nativespace-cdp sshd[1238836]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 06:30:01 nativespace-cdp sshd[1238836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.55.247
Sep  2 06:30:02 nativespace-cdp sshd[1238836]: Failed password for invalid user guest from 206.189.55.247 port 48136 ssh2
Sep  2 06:30:02 nativespace-cdp sshd[1238836]: Received disconnect from 206.189.55.247 port 48136:11: Bye Bye [preauth]
Sep  2 06:30:02 nativespace-cdp sshd[1238836]: Disconnected from 206.189.55.247 port 48136 [preauth]
Sep  2 06:30:17 nativespace-cdp sshd[1239074]: Invalid user uu from 103.31.118.11 port 53310
Sep  2 06:30:17 nativespace-cdp sshd[1239074]: input_userauth_request: invalid user uu [preauth]
Sep  2 06:30:17 nativespace-cdp sshd[1239074]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 06:30:17 nativespace-cdp sshd[1239074]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.31.118.11
Sep  2 06:30:19 nativespace-cdp sshd[1239074]: Failed password for invalid user uu from 103.31.118.11 port 53310 ssh2
Sep  2 06:30:19 nativespace-cdp sshd[1239074]: Received disconnect from 103.31.118.11 port 53310:11: Bye Bye [preauth]
Sep  2 06:30:19 nativespace-cdp sshd[1239074]: Disconnected from 103.31.118.11 port 53310 [preauth]
Sep  2 06:31:09 nativespace-cdp sshd[1239294]: Invalid user fred from 103.31.118.11 port 38630
Sep  2 06:31:09 nativespace-cdp sshd[1239294]: input_userauth_request: invalid user fred [preauth]
Sep  2 06:31:09 nativespace-cdp sshd[1239294]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 06:31:09 nativespace-cdp sshd[1239294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.31.118.11
Sep  2 06:31:11 nativespace-cdp sshd[1239294]: Failed password for invalid user fred from 103.31.118.11 port 38630 ssh2
Sep  2 06:31:12 nativespace-cdp sshd[1239294]: Received disconnect from 103.31.118.11 port 38630:11: Bye Bye [preauth]
Sep  2 06:31:12 nativespace-cdp sshd[1239294]: Disconnected from 103.31.118.11 port 38630 [preauth]
Sep  2 06:31:33 nativespace-cdp sshd[1239389]: Connection closed by 159.100.136.21 port 59980 [preauth]
Sep  2 06:36:33 nativespace-cdp sshd[1240526]: Connection closed by 159.100.136.21 port 42010 [preauth]
Sep  2 06:41:33 nativespace-cdp sshd[1242266]: Connection closed by 159.100.136.21 port 51978 [preauth]
Sep  2 06:43:38 nativespace-cdp sshd[1242755]: Accepted publickey for root from 185.67.178.249 port 41922 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  2 06:43:38 nativespace-cdp sshd[1242755]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  2 06:46:33 nativespace-cdp sshd[1243399]: Connection closed by 159.100.136.21 port 33962 [preauth]
Sep  2 06:51:33 nativespace-cdp sshd[1244579]: Connection closed by 159.100.136.21 port 43948 [preauth]
Sep  2 06:56:33 nativespace-cdp sshd[1245667]: Connection closed by 159.100.136.21 port 54222 [preauth]
Sep  2 07:01:33 nativespace-cdp sshd[1247135]: Connection closed by 159.100.136.21 port 35974 [preauth]
Sep  2 07:06:33 nativespace-cdp sshd[1248435]: Connection closed by 159.100.136.21 port 46308 [preauth]
Sep  2 07:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 07:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:20 nativespace-cdp sudo[1249146]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 07:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:20 nativespace-cdp sudo[1249149]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 07:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:20 nativespace-cdp sudo[1249152]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 07:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:21 nativespace-cdp sudo[1249156]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 07:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:23 nativespace-cdp sudo[1249159]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 07:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:23 nativespace-cdp sudo[1249171]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 07:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:23 nativespace-cdp sudo[1249174]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 07:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:23 nativespace-cdp sudo[1249177]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 07:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:23 nativespace-cdp sudo[1249180]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 07:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:23 nativespace-cdp sudo[1249183]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 07:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:23 nativespace-cdp sudo[1249187]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 07:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:25 nativespace-cdp sudo[1249199]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 07:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:25 nativespace-cdp sudo[1249203]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=design user-2=kategilpin user-3=ladburyp user-4=stagingerris user-5=dancinggardener user-6=nvihkvu user-7=sketchy user-8=cath user-9=havantho user-10=what user-11=oubpgvbx user-12=tstardom user-13=sosevalu user-14=crrtipdl user-15=bakery user-16=boldover user-17=nove user-18=romaldki user-19=branko user-20=outdoorc user-21=hodgsonmail user-22=ranxterc user-23=onlycont user-24=attlebor user-25=lucy user-26=careers user-27=nbhavers user-28=david user-29=pars user-30=mcdermos user-31=chrisdal user-32=jennimil user-33=tomandle user-34=courseme user-35=eugincou user-36=hirefootballgame user-37=howardon user-38=paulmca1 user-39=pugwash user-40=cwsocial user-41=reliable user-42=ninejimm user-43=cathski user-44=cambria1 user-45=tigerlet user-46=barbersh user-47=hidden user-48=nomistakes user-49=isleofwi
Sep  2 07:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=smrszyqg user-51=ctedorgu user-52=philmcph user-53=steakbridieme user-54=donnychicago user-55=firstre5 user-56=lkpier user-57=fortunaz user-58=health2045 user-59=foods user-60=leftie user-61=putterfc user-62=nscdp user-63=dhyana user-64=eatspam user-65=darkstar user-66=beauty user-67=nsceres user-68=burydropin user-69=fawcettd user-70=steve user-71=zebrapho user-72=bwppodcast user-73=asandcoc user-74=sibtoncc user-75=nativene user-76=askhform user-77=stuartge user-78=innovat1 user-79=skyfirec user-80=alexadmin user-81=bemadonn user-82=ggaaorgu user-83=belle user-84=newstoda user-85=bedfords user-86=battlere user-87=oneoarco user-88=firstre2 user-89=vivienn1 user-90=brighto1 user-91=nstriton user-92=thqkgnbz user-93=connectedshoppin user-94=ianrayne user-95=accooper user-96=carsinyo user-97=fetch user-98=hubmaster user-99=putterfi user-100=elecleis user-101=milloyco user-102=gilpin user-103=southlon
Sep  2 07:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=highlegh user-105=firstred user-106=costestimatorco user-107=clarkass user-108=firstrel user-109=coursemc user-110=opaiscyx user-111=firstres user-112=seftvta user-113=jonhartl user-114=ultbcrra user-115=magichat user-116=lbhyisi user-117=hhdugcor user-118=ptkxhsbt user-119=dickemery123 user-120=martsblo user-121=musorguk user-122=megacards user-123=wilsonsw user-124=sarafoundation user-125=atestord user-126=strathar user-127=lakesan1 user-128=brmrjxl user-129=leereyn1 user-130=stephani user-131=still user-132=agproduc user-133=theblack user-134=hodgesonweb user-135=spectrum user-136=jarvisin user-137=ulsukarm user-138=maflemin user-139=lbscrmod user-140=athenare user-141=connect9 user-142=vantagep user-143=markward user-144=foundation user-145=booff feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 07:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 07:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:26 nativespace-cdp sudo[1249208]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 07:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:26 nativespace-cdp sudo[1249213]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UjGGvczWOWKdoeQG.~
Sep  2 07:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:26 nativespace-cdp sudo[1249216]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UjGGvczWOWKdoeQG.~'
Sep  2 07:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:26 nativespace-cdp sudo[1249219]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UjGGvczWOWKdoeQG.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 07:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:26 nativespace-cdp sudo[1249223]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 07:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:26 nativespace-cdp sudo[1249226]: pam_unix(sudo:session): session closed for user root
Sep  2 07:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 07:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 07:09:27 nativespace-cdp sudo[1249245]: pam_unix(sudo:session): session closed for user root
Sep  2 07:11:33 nativespace-cdp sshd[1249990]: Connection closed by 159.100.136.21 port 56304 [preauth]
Sep  2 07:16:33 nativespace-cdp sshd[1251070]: Connection closed by 159.100.136.21 port 38326 [preauth]
Sep  2 07:17:44 nativespace-cdp sshd[1242755]: Received disconnect from 185.67.178.249 port 41922:11: Normal Shutdown
Sep  2 07:17:44 nativespace-cdp sshd[1242755]: Disconnected from 185.67.178.249 port 41922
Sep  2 07:17:44 nativespace-cdp sshd[1242755]: pam_unix(sshd:session): session closed for user root
Sep  2 07:21:33 nativespace-cdp sshd[1252150]: Connection closed by 159.100.136.21 port 48292 [preauth]
Sep  2 07:26:33 nativespace-cdp sshd[1253380]: Connection closed by 159.100.136.21 port 58574 [preauth]
Sep  2 07:31:33 nativespace-cdp sshd[1254564]: Connection closed by 159.100.136.21 port 40400 [preauth]
Sep  2 07:36:33 nativespace-cdp sshd[1255642]: Connection closed by 159.100.136.21 port 50688 [preauth]
Sep  2 07:39:45 nativespace-cdp sshd[1256595]: Did not receive identification string from 206.168.34.112 port 60198
Sep  2 07:40:03 nativespace-cdp sshd[1256605]: Connection closed by 206.168.34.112 port 33864 [preauth]
Sep  2 07:41:33 nativespace-cdp sshd[1257192]: Connection closed by 159.100.136.21 port 60670 [preauth]
Sep  2 07:42:14 nativespace-cdp sshd[1257552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.150.124.201  user=root
Sep  2 07:42:14 nativespace-cdp sshd[1257552]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 07:42:15 nativespace-cdp sshd[1257552]: Failed password for root from 103.150.124.201 port 50266 ssh2
Sep  2 07:42:16 nativespace-cdp sshd[1257552]: Received disconnect from 103.150.124.201 port 50266:11: Bye Bye [preauth]
Sep  2 07:42:16 nativespace-cdp sshd[1257552]: Disconnected from 103.150.124.201 port 50266 [preauth]
Sep  2 07:44:22 nativespace-cdp sshd[1258040]: Invalid user minera from 103.150.124.201 port 43054
Sep  2 07:44:22 nativespace-cdp sshd[1258040]: input_userauth_request: invalid user minera [preauth]
Sep  2 07:44:22 nativespace-cdp sshd[1258040]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 07:44:22 nativespace-cdp sshd[1258040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.150.124.201
Sep  2 07:44:25 nativespace-cdp sshd[1258040]: Failed password for invalid user minera from 103.150.124.201 port 43054 ssh2
Sep  2 07:44:25 nativespace-cdp sshd[1258040]: Received disconnect from 103.150.124.201 port 43054:11: Bye Bye [preauth]
Sep  2 07:44:25 nativespace-cdp sshd[1258040]: Disconnected from 103.150.124.201 port 43054 [preauth]
Sep  2 07:45:25 nativespace-cdp sshd[1258446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.150.124.201  user=root
Sep  2 07:45:25 nativespace-cdp sshd[1258446]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 07:45:27 nativespace-cdp sshd[1258446]: Failed password for root from 103.150.124.201 port 57228 ssh2
Sep  2 07:45:27 nativespace-cdp sshd[1258446]: Received disconnect from 103.150.124.201 port 57228:11: Bye Bye [preauth]
Sep  2 07:45:27 nativespace-cdp sshd[1258446]: Disconnected from 103.150.124.201 port 57228 [preauth]
Sep  2 07:46:33 nativespace-cdp sshd[1258727]: Connection closed by 159.100.136.21 port 42684 [preauth]
Sep  2 07:51:33 nativespace-cdp sshd[1259925]: Connection closed by 159.100.136.21 port 52682 [preauth]
Sep  2 07:56:33 nativespace-cdp sshd[1261233]: Connection closed by 159.100.136.21 port 34780 [preauth]
Sep  2 08:01:33 nativespace-cdp sshd[1262714]: Connection closed by 159.100.136.21 port 44792 [preauth]
Sep  2 08:06:33 nativespace-cdp sshd[1264139]: Connection closed by 159.100.136.21 port 55114 [preauth]
Sep  2 08:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 08:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:19 nativespace-cdp sudo[1264763]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 08:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:19 nativespace-cdp sudo[1264768]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 08:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:20 nativespace-cdp sudo[1264774]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 08:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:20 nativespace-cdp sudo[1264780]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 08:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:23 nativespace-cdp sudo[1264786]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 08:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:23 nativespace-cdp sudo[1264805]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 08:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:23 nativespace-cdp sudo[1264810]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 08:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:23 nativespace-cdp sudo[1264814]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 08:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:23 nativespace-cdp sudo[1264819]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 08:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:23 nativespace-cdp sudo[1264824]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 08:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:23 nativespace-cdp sudo[1264830]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 08:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:25 nativespace-cdp sudo[1264841]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 08:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:25 nativespace-cdp sudo[1264847]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=coursemc user-2=opaiscyx user-3=ultbcrra user-4=seftvta user-5=jonhartl user-6=firstres user-7=firstred user-8=highlegh user-9=southlon user-10=firstrel user-11=clarkass user-12=costestimatorco user-13=hubmaster user-14=putterfi user-15=fetch user-16=carsinyo user-17=gilpin user-18=milloyco user-19=elecleis user-20=connectedshoppin user-21=thqkgnbz user-22=accooper user-23=ianrayne user-24=vivienn1 user-25=firstre2 user-26=oneoarco user-27=battlere user-28=nstriton user-29=brighto1 user-30=newstoda user-31=ggaaorgu user-32=belle user-33=bemadonn user-34=bedfords user-35=alexadmin user-36=skyfirec user-37=nativene user-38=innovat1 user-39=stuartge user-40=askhform user-41=vantagep user-42=connect9 user-43=athenare user-44=lbscrmod user-45=maflemin user-46=foundation user-47=markward user-48=booff
Sep  2 08:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=spectrum user-51=hodgesonweb user-52=theblack user-53=jarvisin user-54=stephani user-55=leereyn1 user-56=agproduc user-57=still user-58=strathar user-59=atestord user-60=sarafoundation user-61=brmrjxl user-62=lakesan1 user-63=megacards user-64=musorguk user-65=wilsonsw user-66=dickemery123 user-67=ptkxhsbt user-68=martsblo user-69=magichat user-70=hhdugcor user-71=lbhyisi user-72=jennimil user-73=tomandle user-74=pars user-75=david user-76=careers user-77=nbhavers user-78=chrisdal user-79=mcdermos user-80=onlycont user-81=lucy user-82=attlebor user-83=romaldki user-84=ranxterc user-85=outdoorc user-86=hodgsonmail user-87=branko user-88=boldover user-89=nove user-90=bakery user-91=crrtipdl user-92=sosevalu user-93=havantho user-94=sketchy user-95=cath user-96=nvihkvu user-97=tstardom user-98=oubpgvbx user-99=what user-100=design user-101=dancinggardener user-102=stagingerris
Sep  2 08:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ladburyp user-104=kategilpin user-105=asandcoc user-106=sibtoncc user-107=steve user-108=bwppodcast user-109=zebrapho user-110=nsceres user-111=fawcettd user-112=burydropin user-113=dhyana user-114=beauty user-115=darkstar user-116=eatspam user-117=lkpier user-118=donnychicago user-119=firstre5 user-120=steakbridieme user-121=ctedorgu user-122=philmcph user-123=nscdp user-124=putterfc user-125=leftie user-126=foods user-127=fortunaz user-128=health2045 user-129=nomistakes user-130=hidden user-131=tigerlet user-132=barbersh user-133=isleofwi user-134=smrszyqg user-135=cwsocial user-136=paulmca1 user-137=howardon user-138=pugwash user-139=cathski user-140=cambria1 user-141=ninejimm user-142=reliable user-143=eugincou user-144=courseme user-145=hirefootballgame feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 08:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 08:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:26 nativespace-cdp sudo[1264854]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:26 nativespace-cdp sudo[1264869]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6gzuQdcYhecfCTyu.~
Sep  2 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:26 nativespace-cdp sudo[1264874]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6gzuQdcYhecfCTyu.~'
Sep  2 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:26 nativespace-cdp sudo[1264879]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6gzuQdcYhecfCTyu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:26 nativespace-cdp sudo[1264886]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:26 nativespace-cdp sudo[1264891]: pam_unix(sudo:session): session closed for user root
Sep  2 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 08:09:28 nativespace-cdp sudo[1264916]: pam_unix(sudo:session): session closed for user root
Sep  2 08:11:33 nativespace-cdp sshd[1265629]: Connection closed by 159.100.136.21 port 36894 [preauth]
Sep  2 08:16:33 nativespace-cdp sshd[1266965]: Connection closed by 159.100.136.21 port 47098 [preauth]
Sep  2 08:21:33 nativespace-cdp sshd[1268104]: Connection closed by 159.100.136.21 port 57084 [preauth]
Sep  2 08:26:33 nativespace-cdp sshd[1269417]: Connection closed by 159.100.136.21 port 39136 [preauth]
Sep  2 08:31:33 nativespace-cdp sshd[1270868]: Connection closed by 159.100.136.21 port 49168 [preauth]
Sep  2 08:36:33 nativespace-cdp sshd[1272038]: Connection closed by 159.100.136.21 port 59482 [preauth]
Sep  2 08:41:33 nativespace-cdp sshd[1273322]: Connection closed by 159.100.136.21 port 41234 [preauth]
Sep  2 08:46:33 nativespace-cdp sshd[1274791]: Connection closed by 159.100.136.21 port 51456 [preauth]
Sep  2 08:51:34 nativespace-cdp sshd[1276134]: Connection closed by 159.100.136.21 port 33232 [preauth]
Sep  2 08:56:33 nativespace-cdp sshd[1277478]: Connection closed by 159.100.136.21 port 43506 [preauth]
Sep  2 09:01:33 nativespace-cdp sshd[1279132]: Connection closed by 159.100.136.21 port 53506 [preauth]
Sep  2 09:06:33 nativespace-cdp sshd[1280661]: Connection closed by 159.100.136.21 port 35602 [preauth]
Sep  2 09:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 09:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:30 nativespace-cdp sudo[1281386]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 09:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:30 nativespace-cdp sudo[1281390]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 09:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:32 nativespace-cdp sudo[1281395]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 09:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:32 nativespace-cdp sudo[1281408]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 09:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:35 nativespace-cdp sudo[1281414]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 09:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:36 nativespace-cdp sudo[1281429]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 09:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:36 nativespace-cdp sudo[1281434]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 09:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:36 nativespace-cdp sudo[1281438]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 09:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:36 nativespace-cdp sudo[1281443]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 09:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:36 nativespace-cdp sudo[1281449]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 09:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:36 nativespace-cdp sudo[1281454]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 09:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:38 nativespace-cdp sudo[1281472]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 09:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:39 nativespace-cdp sudo[1281478]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=megacards user-2=musorguk user-3=wilsonsw user-4=atestord user-5=sarafoundation user-6=strathar user-7=lakesan1 user-8=brmrjxl user-9=magichat user-10=hhdugcor user-11=lbhyisi user-12=ptkxhsbt user-13=dickemery123 user-14=martsblo user-15=ulsukarm user-16=lbscrmod user-17=maflemin user-18=vantagep user-19=connect9 user-20=athenare user-21=markward user-22=foundation user-23=booff user-24=leereyn1 user-25=stephani user-26=agproduc user-27=still user-28=hodgesonweb user-29=theblack user-30=spectrum user-31=jarvisin user-32=bemadonn user-33=newstoda user-34=belle user-35=ggaaorgu user-36=bedfords user-37=oneoarco user-38=battlere user-39=vivienn1 user-40=firstre2 user-41=nstriton user-42=brighto1 user-43=nativene user-44=askhform user-45=stuartge user-46=innovat1 user-47=alexadmin user-48=skyfirec
Sep  2 09:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=highlegh user-50=southlon user-51=firstred user-52=costestimatorco user-53=firstrel user-54=clarkass user-55=opaiscyx user-56=coursemc user-57=firstres user-58=ultbcrra user-59=jonhartl user-60=seftvta user-61=thqkgnbz user-62=connectedshoppin user-63=ianrayne user-64=accooper user-65=fetch user-66=carsinyo user-67=putterfi user-68=hubmaster user-69=elecleis user-70=gilpin user-71=milloyco user-72=tigerlet user-73=barbersh user-74=nomistakes user-75=hidden user-76=smrszyqg user-77=isleofwi user-78=donnychicago user-79=steakbridieme user-80=firstre5 user-81=philmcph user-82=ctedorgu user-83=lkpier user-84=leftie user-85=foods user-86=fortunaz user-87=health2045 user-88=nscdp user-89=putterfc user-90=courseme user-91=eugincou user-92=hirefootballgame user-93=cwsocial user-94=paulmca1 user-95=pugwash user-96=howardon user-97=reliable user-98=ninejimm user-99=cathski user-100=cambria1 user-101=steve
Sep  2 09:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=zebrapho user-103=bwppodcast user-104=sibtoncc user-105=asandcoc user-106=dhyana user-107=darkstar user-108=eatspam user-109=beauty user-110=nsceres user-111=fawcettd user-112=burydropin user-113=crrtipdl user-114=sosevalu user-115=bakery user-116=boldover user-117=nove user-118=design user-119=kategilpin user-120=dancinggardener user-121=stagingerris user-122=ladburyp user-123=nvihkvu user-124=havantho user-125=sketchy user-126=cath user-127=what user-128=tstardom user-129=oubpgvbx user-130=david user-131=pars user-132=careers user-133=nbhavers user-134=mcdermos user-135=chrisdal user-136=jennimil user-137=tomandle user-138=romaldki user-139=branko user-140=outdoorc user-141=hodgsonmail user-142=ranxterc user-143=onlycont user-144=lucy user-145=attlebor feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 09:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 09:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:41 nativespace-cdp sudo[1281487]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 09:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:41 nativespace-cdp sudo[1281501]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ct4rqiprHEFdU3XM.~
Sep  2 09:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:41 nativespace-cdp sudo[1281507]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ct4rqiprHEFdU3XM.~'
Sep  2 09:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:41 nativespace-cdp sudo[1281512]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ct4rqiprHEFdU3XM.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 09:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:41 nativespace-cdp sudo[1281518]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 09:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:41 nativespace-cdp sudo[1281523]: pam_unix(sudo:session): session closed for user root
Sep  2 09:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 09:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 09:09:43 nativespace-cdp sudo[1281544]: pam_unix(sudo:session): session closed for user root
Sep  2 09:11:33 nativespace-cdp sshd[1282169]: Connection closed by 159.100.136.21 port 45572 [preauth]
Sep  2 09:16:33 nativespace-cdp sshd[1283763]: Connection closed by 159.100.136.21 port 55810 [preauth]
Sep  2 09:21:33 nativespace-cdp sshd[1285056]: Connection closed by 159.100.136.21 port 37572 [preauth]
Sep  2 09:26:33 nativespace-cdp sshd[1286336]: Connection closed by 159.100.136.21 port 47836 [preauth]
Sep  2 09:31:33 nativespace-cdp sshd[1287781]: Connection closed by 159.100.136.21 port 57950 [preauth]
Sep  2 09:36:33 nativespace-cdp sshd[1289089]: Connection closed by 159.100.136.21 port 40074 [preauth]
Sep  2 09:39:54 nativespace-cdp sshd[1289782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.101.245.3  user=root
Sep  2 09:39:54 nativespace-cdp sshd[1289782]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 09:39:56 nativespace-cdp sshd[1289782]: Failed password for root from 34.101.245.3 port 3101 ssh2
Sep  2 09:39:56 nativespace-cdp sshd[1289782]: Received disconnect from 34.101.245.3 port 3101:11: Bye Bye [preauth]
Sep  2 09:39:56 nativespace-cdp sshd[1289782]: Disconnected from 34.101.245.3 port 3101 [preauth]
Sep  2 09:41:17 nativespace-cdp sshd[1290287]: Invalid user sysadmin from 81.133.106.57 port 40515
Sep  2 09:41:17 nativespace-cdp sshd[1290287]: input_userauth_request: invalid user sysadmin [preauth]
Sep  2 09:41:17 nativespace-cdp sshd[1290287]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 09:41:17 nativespace-cdp sshd[1290287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.133.106.57
Sep  2 09:41:19 nativespace-cdp sshd[1290293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.86.39.162  user=root
Sep  2 09:41:19 nativespace-cdp sshd[1290293]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 09:41:19 nativespace-cdp sshd[1290287]: Failed password for invalid user sysadmin from 81.133.106.57 port 40515 ssh2
Sep  2 09:41:19 nativespace-cdp sshd[1290287]: Received disconnect from 81.133.106.57 port 40515:11: Bye Bye [preauth]
Sep  2 09:41:19 nativespace-cdp sshd[1290287]: Disconnected from 81.133.106.57 port 40515 [preauth]
Sep  2 09:41:21 nativespace-cdp sshd[1290293]: Failed password for root from 140.86.39.162 port 24529 ssh2
Sep  2 09:41:21 nativespace-cdp sshd[1290293]: Received disconnect from 140.86.39.162 port 24529:11: Bye Bye [preauth]
Sep  2 09:41:21 nativespace-cdp sshd[1290293]: Disconnected from 140.86.39.162 port 24529 [preauth]
Sep  2 09:41:33 nativespace-cdp sshd[1290327]: Connection closed by 159.100.136.21 port 50068 [preauth]
Sep  2 09:42:53 nativespace-cdp sshd[1290684]: Invalid user nalbornoz from 200.95.174.180 port 33830
Sep  2 09:42:53 nativespace-cdp sshd[1290684]: input_userauth_request: invalid user nalbornoz [preauth]
Sep  2 09:42:53 nativespace-cdp sshd[1290684]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 09:42:53 nativespace-cdp sshd[1290684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.95.174.180
Sep  2 09:42:55 nativespace-cdp sshd[1290684]: Failed password for invalid user nalbornoz from 200.95.174.180 port 33830 ssh2
Sep  2 09:42:56 nativespace-cdp sshd[1290684]: Received disconnect from 200.95.174.180 port 33830:11: Bye Bye [preauth]
Sep  2 09:42:56 nativespace-cdp sshd[1290684]: Disconnected from 200.95.174.180 port 33830 [preauth]
Sep  2 09:44:04 nativespace-cdp sshd[1290971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.101.245.3  user=root
Sep  2 09:44:04 nativespace-cdp sshd[1290971]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 09:44:06 nativespace-cdp sshd[1290971]: Failed password for root from 34.101.245.3 port 3083 ssh2
Sep  2 09:44:07 nativespace-cdp sshd[1290971]: Received disconnect from 34.101.245.3 port 3083:11: Bye Bye [preauth]
Sep  2 09:44:07 nativespace-cdp sshd[1290971]: Disconnected from 34.101.245.3 port 3083 [preauth]
Sep  2 09:44:26 nativespace-cdp sshd[1291149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.133.106.57  user=root
Sep  2 09:44:26 nativespace-cdp sshd[1291149]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 09:44:27 nativespace-cdp sshd[1291149]: Failed password for root from 81.133.106.57 port 54345 ssh2
Sep  2 09:44:27 nativespace-cdp sshd[1291149]: Received disconnect from 81.133.106.57 port 54345:11: Bye Bye [preauth]
Sep  2 09:44:27 nativespace-cdp sshd[1291149]: Disconnected from 81.133.106.57 port 54345 [preauth]
Sep  2 09:44:54 nativespace-cdp sshd[1291250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.101.245.3  user=root
Sep  2 09:44:54 nativespace-cdp sshd[1291250]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 09:44:57 nativespace-cdp sshd[1291250]: Failed password for root from 34.101.245.3 port 3080 ssh2
Sep  2 09:44:57 nativespace-cdp sshd[1291288]: Invalid user anam from 140.86.39.162 port 38750
Sep  2 09:44:57 nativespace-cdp sshd[1291288]: input_userauth_request: invalid user anam [preauth]
Sep  2 09:44:57 nativespace-cdp sshd[1291288]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 09:44:57 nativespace-cdp sshd[1291288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.86.39.162
Sep  2 09:45:00 nativespace-cdp sshd[1291288]: Failed password for invalid user anam from 140.86.39.162 port 38750 ssh2
Sep  2 09:45:00 nativespace-cdp sshd[1291288]: Received disconnect from 140.86.39.162 port 38750:11: Bye Bye [preauth]
Sep  2 09:45:00 nativespace-cdp sshd[1291288]: Disconnected from 140.86.39.162 port 38750 [preauth]
Sep  2 09:45:11 nativespace-cdp sshd[1291469]: Invalid user web from 81.133.106.57 port 60843
Sep  2 09:45:11 nativespace-cdp sshd[1291469]: input_userauth_request: invalid user web [preauth]
Sep  2 09:45:11 nativespace-cdp sshd[1291469]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 09:45:11 nativespace-cdp sshd[1291469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.133.106.57
Sep  2 09:45:13 nativespace-cdp sshd[1291469]: Failed password for invalid user web from 81.133.106.57 port 60843 ssh2
Sep  2 09:45:13 nativespace-cdp sshd[1291469]: Received disconnect from 81.133.106.57 port 60843:11: Bye Bye [preauth]
Sep  2 09:45:13 nativespace-cdp sshd[1291469]: Disconnected from 81.133.106.57 port 60843 [preauth]
Sep  2 09:46:33 nativespace-cdp sshd[1291771]: Connection closed by 159.100.136.21 port 60344 [preauth]
Sep  2 09:46:51 nativespace-cdp sshd[1291836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.86.39.162  user=root
Sep  2 09:46:51 nativespace-cdp sshd[1291836]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 09:46:54 nativespace-cdp sshd[1291836]: Failed password for root from 140.86.39.162 port 50435 ssh2
Sep  2 09:46:54 nativespace-cdp sshd[1291836]: Received disconnect from 140.86.39.162 port 50435:11: Bye Bye [preauth]
Sep  2 09:46:54 nativespace-cdp sshd[1291836]: Disconnected from 140.86.39.162 port 50435 [preauth]
Sep  2 09:51:33 nativespace-cdp sshd[1293138]: Connection closed by 159.100.136.21 port 42148 [preauth]
Sep  2 09:53:25 nativespace-cdp sshd[1293500]: Invalid user test1 from 200.95.174.180 port 33222
Sep  2 09:53:25 nativespace-cdp sshd[1293500]: input_userauth_request: invalid user test1 [preauth]
Sep  2 09:53:25 nativespace-cdp sshd[1293500]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 09:53:25 nativespace-cdp sshd[1293500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.95.174.180
Sep  2 09:53:27 nativespace-cdp sshd[1293500]: Failed password for invalid user test1 from 200.95.174.180 port 33222 ssh2
Sep  2 09:53:27 nativespace-cdp sshd[1293500]: Received disconnect from 200.95.174.180 port 33222:11: Bye Bye [preauth]
Sep  2 09:53:27 nativespace-cdp sshd[1293500]: Disconnected from 200.95.174.180 port 33222 [preauth]
Sep  2 09:54:34 nativespace-cdp sshd[1293964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.95.174.180  user=root
Sep  2 09:54:34 nativespace-cdp sshd[1293964]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 09:54:35 nativespace-cdp sshd[1293964]: Failed password for root from 200.95.174.180 port 54040 ssh2
Sep  2 09:54:36 nativespace-cdp sshd[1293964]: Received disconnect from 200.95.174.180 port 54040:11: Bye Bye [preauth]
Sep  2 09:54:36 nativespace-cdp sshd[1293964]: Disconnected from 200.95.174.180 port 54040 [preauth]
Sep  2 09:56:33 nativespace-cdp sshd[1294541]: Connection closed by 159.100.136.21 port 52444 [preauth]
Sep  2 10:01:33 nativespace-cdp sshd[1295894]: Connection closed by 159.100.136.21 port 34270 [preauth]
Sep  2 10:06:33 nativespace-cdp sshd[1297377]: Connection closed by 159.100.136.21 port 44620 [preauth]
Sep  2 10:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 10:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:26 nativespace-cdp sudo[1298050]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:27 nativespace-cdp sudo[1298054]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:28 nativespace-cdp sudo[1298059]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 10:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:28 nativespace-cdp sudo[1298065]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 10:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:31 nativespace-cdp sudo[1298072]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:32 nativespace-cdp sudo[1298094]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:32 nativespace-cdp sudo[1298099]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:32 nativespace-cdp sudo[1298103]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:32 nativespace-cdp sudo[1298108]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:32 nativespace-cdp sudo[1298114]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:32 nativespace-cdp sudo[1298119]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 10:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:34 nativespace-cdp sudo[1298129]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 10:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:35 nativespace-cdp sudo[1298136]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=chrisdal user-2=mcdermos user-3=david user-4=pars user-5=careers user-6=nbhavers user-7=tomandle user-8=jennimil user-9=ranxterc user-10=outdoorc user-11=hodgsonmail user-12=branko user-13=romaldki user-14=lucy user-15=attlebor user-16=onlycont user-17=bakery user-18=crrtipdl user-19=sosevalu user-20=nove user-21=boldover user-22=dancinggardener user-23=stagingerris user-24=ladburyp user-25=kategilpin user-26=design user-27=oubpgvbx user-28=tstardom user-29=what user-30=havantho user-31=cath user-32=sketchy user-33=nvihkvu user-34=bwppodcast user-35=zebrapho user-36=steve user-37=sibtoncc user-38=asandcoc user-39=beauty user-40=darkstar user-41=eatspam user-42=dhyana user-43=fawcettd user-44=burydropin user-45=nsceres user-46=isleofwi user-47=smrszyqg user-48=nomistakes user-49=hidden
Sep  2 10:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=tigerlet user-51=barbersh user-52=nscdp user-53=putterfc user-54=leftie user-55=foods user-56=fortunaz user-57=health2045 user-58=lkpier user-59=donnychicago user-60=steakbridieme user-61=firstre5 user-62=ctedorgu user-63=philmcph user-64=hirefootballgame user-65=eugincou user-66=courseme user-67=cambria1 user-68=cathski user-69=reliable user-70=ninejimm user-71=cwsocial user-72=pugwash user-73=paulmca1 user-74=howardon user-75=clarkass user-76=firstrel user-77=costestimatorco user-78=firstred user-79=highlegh user-80=southlon user-81=ultbcrra user-82=jonhartl user-83=seftvta user-84=firstres user-85=coursemc user-86=opaiscyx user-87=accooper user-88=ianrayne user-89=connectedshoppin user-90=thqkgnbz user-91=milloyco user-92=gilpin user-93=elecleis user-94=putterfi user-95=hubmaster user-96=fetch user-97=carsinyo user-98=bedfords user-99=newstoda user-100=ggaaorgu user-101=belle user-102=bemadonn
Sep  2 10:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=nstriton user-104=brighto1 user-105=vivienn1 user-106=firstre2 user-107=oneoarco user-108=battlere user-109=innovat1 user-110=askhform user-111=stuartge user-112=nativene user-113=skyfirec user-114=alexadmin user-115=ulsukarm user-116=booff user-117=foundation user-118=markward user-119=vantagep user-120=athenare user-121=connect9 user-122=lbscrmod user-123=maflemin user-124=agproduc user-125=still user-126=stephani user-127=leereyn1 user-128=jarvisin user-129=spectrum user-130=hodgesonweb user-131=theblack user-132=wilsonsw user-133=megacards user-134=musorguk user-135=brmrjxl user-136=lakesan1 user-137=strathar user-138=atestord user-139=sarafoundation user-140=hhdugcor user-141=lbhyisi user-142=magichat user-143=martsblo user-144=dickemery123 user-145=ptkxhsbt feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 10:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 10:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:36 nativespace-cdp sudo[1298150]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:37 nativespace-cdp sudo[1298167]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mh15wD6cRXt6N6cZ.~
Sep  2 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:37 nativespace-cdp sudo[1298172]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mh15wD6cRXt6N6cZ.~'
Sep  2 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:37 nativespace-cdp sudo[1298176]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mh15wD6cRXt6N6cZ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:37 nativespace-cdp sudo[1298182]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:37 nativespace-cdp sudo[1298187]: pam_unix(sudo:session): session closed for user root
Sep  2 10:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 10:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 10:09:39 nativespace-cdp sudo[1298212]: pam_unix(sudo:session): session closed for user root
Sep  2 10:11:33 nativespace-cdp sshd[1298965]: Connection closed by 159.100.136.21 port 54650 [preauth]
Sep  2 10:16:33 nativespace-cdp sshd[1300261]: Connection closed by 159.100.136.21 port 36694 [preauth]
Sep  2 10:21:33 nativespace-cdp sshd[1301461]: Connection closed by 159.100.136.21 port 46722 [preauth]
Sep  2 10:26:33 nativespace-cdp sshd[1303051]: Connection closed by 159.100.136.21 port 57022 [preauth]
Sep  2 10:31:33 nativespace-cdp sshd[1304665]: Connection closed by 159.100.136.21 port 38876 [preauth]
Sep  2 10:36:33 nativespace-cdp sshd[1306014]: Connection closed by 159.100.136.21 port 49208 [preauth]
Sep  2 10:41:33 nativespace-cdp sshd[1307383]: Connection closed by 159.100.136.21 port 59186 [preauth]
Sep  2 10:46:33 nativespace-cdp sshd[1309012]: Connection closed by 159.100.136.21 port 41216 [preauth]
Sep  2 10:51:33 nativespace-cdp sshd[1310201]: Connection closed by 159.100.136.21 port 51270 [preauth]
Sep  2 10:56:33 nativespace-cdp sshd[1311622]: Connection closed by 159.100.136.21 port 33324 [preauth]
Sep  2 11:01:33 nativespace-cdp sshd[1312868]: Connection closed by 159.100.136.21 port 43346 [preauth]
Sep  2 11:06:33 nativespace-cdp sshd[1314120]: Connection closed by 159.100.136.21 port 53692 [preauth]
Sep  2 11:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 11:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:20 nativespace-cdp sudo[1314653]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 11:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:20 nativespace-cdp sudo[1314658]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 11:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:21 nativespace-cdp sudo[1314663]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 11:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:21 nativespace-cdp sudo[1314669]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 11:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:24 nativespace-cdp sudo[1314676]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 11:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:24 nativespace-cdp sudo[1314690]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 11:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:24 nativespace-cdp sudo[1314695]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 11:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:24 nativespace-cdp sudo[1314699]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 11:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:24 nativespace-cdp sudo[1314704]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 11:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:24 nativespace-cdp sudo[1314710]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 11:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:24 nativespace-cdp sudo[1314715]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 11:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:26 nativespace-cdp sudo[1314727]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 11:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:27 nativespace-cdp sudo[1314734]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lbscrmod user-2=maflemin user-3=vantagep user-4=athenare user-5=connect9 user-6=foundation user-7=booff user-8=markward user-9=ulsukarm user-10=theblack user-11=hodgesonweb user-12=spectrum user-13=jarvisin user-14=leereyn1 user-15=stephani user-16=agproduc user-17=still user-18=atestord user-19=sarafoundation user-20=strathar user-21=lakesan1 user-22=brmrjxl user-23=megacards user-24=musorguk user-25=wilsonsw user-26=ptkxhsbt user-27=dickemery123 user-28=martsblo user-29=magichat user-30=hhdugcor user-31=lbhyisi user-32=coursemc user-33=opaiscyx user-34=firstres user-35=ultbcrra user-36=jonhartl user-37=seftvta user-38=highlegh user-39=southlon user-40=firstred user-41=costestimatorco user-42=firstrel user-43=clarkass user-44=fetch user-45=carsinyo user-46=hubmaster user-47=putterfi
Sep  2 11:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=elecleis user-49=gilpin user-50=milloyco user-51=thqkgnbz user-52=connectedshoppin user-53=ianrayne user-54=accooper user-55=oneoarco user-56=battlere user-57=vivienn1 user-58=firstre2 user-59=nstriton user-60=brighto1 user-61=bemadonn user-62=newstoda user-63=ggaaorgu user-64=belle user-65=bedfords user-66=alexadmin user-67=skyfirec user-68=nativene user-69=askhform user-70=stuartge user-71=innovat1 user-72=sibtoncc user-73=asandcoc user-74=steve user-75=zebrapho user-76=bwppodcast user-77=nsceres user-78=fawcettd user-79=burydropin user-80=dhyana user-81=darkstar user-82=eatspam user-83=beauty user-84=firstre5 user-85=donnychicago user-86=steakbridieme user-87=philmcph user-88=ctedorgu user-89=lkpier user-90=foods user-91=leftie user-92=health2045 user-93=fortunaz user-94=nscdp user-95=putterfc user-96=barbersh user-97=tigerlet user-98=nomistakes user-99=hidden user-100=isleofwi user-101=smrszyqg
Sep  2 11:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=cwsocial user-103=paulmca1 user-104=pugwash user-105=howardon user-106=reliable user-107=ninejimm user-108=cathski user-109=cambria1 user-110=courseme user-111=eugincou user-112=hirefootballgame user-113=jennimil user-114=tomandle user-115=pars user-116=david user-117=careers user-118=nbhavers user-119=mcdermos user-120=chrisdal user-121=onlycont user-122=lucy user-123=attlebor user-124=romaldki user-125=branko user-126=outdoorc user-127=ranxterc user-128=hodgsonmail user-129=boldover user-130=nove user-131=crrtipdl user-132=sosevalu user-133=bakery user-134=nvihkvu user-135=havantho user-136=cath user-137=sketchy user-138=what user-139=oubpgvbx user-140=tstardom user-141=design user-142=kategilpin user-143=stagingerris user-144=dancinggardener user-145=ladburyp feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 11:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 11:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:28 nativespace-cdp sudo[1314742]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  2 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:29 nativespace-cdp sudo[1314758]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep  2 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  2 11:09:29 nativespace-cdp sudo[1314767]: pam_unix(sudo:session): session closed for user onlycont
Sep  2 11:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  2 11:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:31 nativespace-cdp sudo[1314783]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  2 11:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 11:09:31 nativespace-cdp sudo[1314794]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  2 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:33 nativespace-cdp sudo[1314816]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep  2 11:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  2 11:09:33 nativespace-cdp sudo[1314827]: pam_unix(sudo:session): session closed for user lkpier
Sep  2 11:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  2 11:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:34 nativespace-cdp sudo[1314865]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep  2 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  2 11:09:34 nativespace-cdp sudo[1314903]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  2 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  2 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  2 11:09:34 nativespace-cdp sudo[1314918]: pam_unix(sudo:session): session closed for user oneoarco
Sep  2 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  2 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:35 nativespace-cdp sudo[1314948]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep  2 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  2 11:09:35 nativespace-cdp sudo[1314963]: pam_unix(sudo:session): session closed for user fortunaz
Sep  2 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep  2 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:35 nativespace-cdp sudo[1314976]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:35 nativespace-cdp sudo[1314980]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep  2 11:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:53 nativespace-cdp sudo[1315951]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep  2 11:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:53 nativespace-cdp sudo[1315956]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:54 nativespace-cdp sudo[1315970]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4rRss1ipDL9OcWov.~
Sep  2 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:54 nativespace-cdp sudo[1315975]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4rRss1ipDL9OcWov.~'
Sep  2 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:54 nativespace-cdp sudo[1315979]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4rRss1ipDL9OcWov.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:54 nativespace-cdp sudo[1315985]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:54 nativespace-cdp sudo[1315990]: pam_unix(sudo:session): session closed for user root
Sep  2 11:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 11:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 11:09:56 nativespace-cdp sudo[1316015]: pam_unix(sudo:session): session closed for user root
Sep  2 11:11:33 nativespace-cdp sshd[1316726]: Connection closed by 159.100.136.21 port 35454 [preauth]
Sep  2 11:16:33 nativespace-cdp sshd[1317942]: Connection closed by 159.100.136.21 port 45716 [preauth]
Sep  2 11:21:33 nativespace-cdp sshd[1319366]: Connection closed by 159.100.136.21 port 55714 [preauth]
Sep  2 11:26:33 nativespace-cdp sshd[1320667]: Connection closed by 159.100.136.21 port 37748 [preauth]
Sep  2 11:31:33 nativespace-cdp sshd[1322174]: Connection closed by 159.100.136.21 port 47810 [preauth]
Sep  2 11:36:33 nativespace-cdp sshd[1323334]: Connection closed by 159.100.136.21 port 58128 [preauth]
Sep  2 11:41:33 nativespace-cdp sshd[1324551]: Connection closed by 159.100.136.21 port 39872 [preauth]
Sep  2 11:46:33 nativespace-cdp sshd[1326095]: Connection closed by 159.100.136.21 port 50148 [preauth]
Sep  2 11:51:33 nativespace-cdp sshd[1327329]: Connection closed by 159.100.136.21 port 60162 [preauth]
Sep  2 11:56:33 nativespace-cdp sshd[1328904]: Connection closed by 159.100.136.21 port 42256 [preauth]
Sep  2 12:01:33 nativespace-cdp sshd[1330383]: Connection closed by 159.100.136.21 port 52290 [preauth]
Sep  2 12:06:33 nativespace-cdp sshd[1331688]: Connection closed by 159.100.136.21 port 34390 [preauth]
Sep  2 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:25 nativespace-cdp sudo[1332273]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:25 nativespace-cdp sudo[1332277]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:26 nativespace-cdp sudo[1332282]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 12:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:26 nativespace-cdp sudo[1332289]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 12:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:28 nativespace-cdp sudo[1332295]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:28 nativespace-cdp sudo[1332307]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:28 nativespace-cdp sudo[1332313]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:28 nativespace-cdp sudo[1332317]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:28 nativespace-cdp sudo[1332322]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:28 nativespace-cdp sudo[1332327]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:28 nativespace-cdp sudo[1332333]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 12:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:30 nativespace-cdp sudo[1332347]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 12:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:31 nativespace-cdp sudo[1332354]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=skyfirec user-2=alexadmin user-3=nativene user-4=stuartge user-5=askhform user-6=innovat1 user-7=oneoarco user-8=battlere user-9=vivienn1 user-10=firstre2 user-11=nstriton user-12=brighto1 user-13=bemadonn user-14=newstoda user-15=belle user-16=ggaaorgu user-17=bedfords user-18=fetch user-19=carsinyo user-20=putterfi user-21=hubmaster user-22=elecleis user-23=gilpin user-24=milloyco user-25=thqkgnbz user-26=connectedshoppin user-27=ianrayne user-28=accooper user-29=opaiscyx user-30=coursemc user-31=firstres user-32=ultbcrra user-33=seftvta user-34=jonhartl user-35=highlegh user-36=southlon user-37=firstred user-38=costestimatorco user-39=clarkass user-40=firstrel user-41=ptkxhsbt user-42=dickemery123 user-43=martsblo user-44=magichat user-45=hhdugcor user-46=lbhyisi user-47=atestord
Sep  2 12:09:31 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=sarafoundation user-49=strathar user-50=brmrjxl user-51=lakesan1 user-52=megacards user-53=musorguk user-54=wilsonsw user-55=hodgesonweb user-56=theblack user-57=spectrum user-58=jarvisin user-59=leereyn1 user-60=stephani user-61=agproduc user-62=still user-63=lbscrmod user-64=maflemin user-65=vantagep user-66=athenare user-67=connect9 user-68=booff user-69=foundation user-70=markward user-71=ulsukarm user-72=nvihkvu user-73=havantho user-74=sketchy user-75=cath user-76=what user-77=oubpgvbx user-78=tstardom user-79=design user-80=kategilpin user-81=stagingerris user-82=dancinggardener user-83=ladburyp user-84=boldover user-85=nove user-86=crrtipdl user-87=sosevalu user-88=bakery user-89=onlycont user-90=lucy user-91=attlebor user-92=romaldki user-93=branko user-94=hodgsonmail user-95=outdoorc user-96=ranxterc user-97=jennimil user-98=tomandle user-99=pars user-100=david user-101=careers user-102=nbhavers
Sep  2 12:09:31 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=mcdermos user-104=chrisdal user-105=cwsocial user-106=paulmca1 user-107=pugwash user-108=howardon user-109=reliable user-110=ninejimm user-111=cambria1 user-112=cathski user-113=courseme user-114=eugincou user-115=hirefootballgame user-116=donnychicago user-117=firstre5 user-118=steakbridieme user-119=philmcph user-120=ctedorgu user-121=lkpier user-122=leftie user-123=foods user-124=health2045 user-125=fortunaz user-126=nscdp user-127=putterfc user-128=tigerlet user-129=barbersh user-130=nomistakes user-131=hidden user-132=isleofwi user-133=smrszyqg user-134=nsceres user-135=fawcettd user-136=burydropin user-137=dhyana user-138=darkstar user-139=eatspam user-140=beauty user-141=asandcoc user-142=sibtoncc user-143=steve user-144=zebrapho user-145=bwppodcast feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 12:09:31 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 12:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:32 nativespace-cdp sudo[1332362]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 12:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:33 nativespace-cdp sudo[1332371]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-K36AD9tYjsCK6knH.~
Sep  2 12:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:33 nativespace-cdp sudo[1332376]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-K36AD9tYjsCK6knH.~'
Sep  2 12:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:33 nativespace-cdp sudo[1332380]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-K36AD9tYjsCK6knH.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 12:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:33 nativespace-cdp sudo[1332386]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 12:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:33 nativespace-cdp sudo[1332391]: pam_unix(sudo:session): session closed for user root
Sep  2 12:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 12:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 12:09:34 nativespace-cdp sudo[1332416]: pam_unix(sudo:session): session closed for user root
Sep  2 12:11:33 nativespace-cdp sshd[1333200]: Connection closed by 159.100.136.21 port 44418 [preauth]
Sep  2 12:16:33 nativespace-cdp sshd[1334546]: Connection closed by 159.100.136.21 port 54670 [preauth]
Sep  2 12:21:33 nativespace-cdp sshd[1335654]: Connection closed by 159.100.136.21 port 36440 [preauth]
Sep  2 12:25:24 nativespace-cdp sshd[1336562]: Invalid user cti from 203.145.34.222 port 53546
Sep  2 12:25:24 nativespace-cdp sshd[1336562]: input_userauth_request: invalid user cti [preauth]
Sep  2 12:25:24 nativespace-cdp sshd[1336562]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:25:24 nativespace-cdp sshd[1336562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.145.34.222
Sep  2 12:25:27 nativespace-cdp sshd[1336562]: Failed password for invalid user cti from 203.145.34.222 port 53546 ssh2
Sep  2 12:25:27 nativespace-cdp sshd[1336562]: Received disconnect from 203.145.34.222 port 53546:11: Bye Bye [preauth]
Sep  2 12:25:27 nativespace-cdp sshd[1336562]: Disconnected from 203.145.34.222 port 53546 [preauth]
Sep  2 12:26:33 nativespace-cdp sshd[1336817]: Connection closed by 159.100.136.21 port 46752 [preauth]
Sep  2 12:28:08 nativespace-cdp sshd[1337510]: Invalid user vikrant from 104.199.217.25 port 48238
Sep  2 12:28:08 nativespace-cdp sshd[1337510]: input_userauth_request: invalid user vikrant [preauth]
Sep  2 12:28:08 nativespace-cdp sshd[1337510]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:28:08 nativespace-cdp sshd[1337510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.199.217.25
Sep  2 12:28:09 nativespace-cdp sshd[1337510]: Failed password for invalid user vikrant from 104.199.217.25 port 48238 ssh2
Sep  2 12:28:10 nativespace-cdp sshd[1337510]: Received disconnect from 104.199.217.25 port 48238:11: Bye Bye [preauth]
Sep  2 12:28:10 nativespace-cdp sshd[1337510]: Disconnected from 104.199.217.25 port 48238 [preauth]
Sep  2 12:30:16 nativespace-cdp sshd[1338405]: Invalid user dmc from 104.199.217.25 port 54736
Sep  2 12:30:16 nativespace-cdp sshd[1338405]: input_userauth_request: invalid user dmc [preauth]
Sep  2 12:30:17 nativespace-cdp sshd[1338405]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:30:17 nativespace-cdp sshd[1338405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.199.217.25
Sep  2 12:30:19 nativespace-cdp sshd[1338405]: Failed password for invalid user dmc from 104.199.217.25 port 54736 ssh2
Sep  2 12:30:19 nativespace-cdp sshd[1338405]: Received disconnect from 104.199.217.25 port 54736:11: Bye Bye [preauth]
Sep  2 12:30:19 nativespace-cdp sshd[1338405]: Disconnected from 104.199.217.25 port 54736 [preauth]
Sep  2 12:30:41 nativespace-cdp sshd[1338495]: Invalid user jinling from 203.145.34.222 port 38634
Sep  2 12:30:41 nativespace-cdp sshd[1338495]: input_userauth_request: invalid user jinling [preauth]
Sep  2 12:30:41 nativespace-cdp sshd[1338495]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:30:41 nativespace-cdp sshd[1338495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.145.34.222
Sep  2 12:30:44 nativespace-cdp sshd[1338495]: Failed password for invalid user jinling from 203.145.34.222 port 38634 ssh2
Sep  2 12:30:44 nativespace-cdp sshd[1338495]: Received disconnect from 203.145.34.222 port 38634:11: Bye Bye [preauth]
Sep  2 12:30:44 nativespace-cdp sshd[1338495]: Disconnected from 203.145.34.222 port 38634 [preauth]
Sep  2 12:31:02 nativespace-cdp sshd[1338608]: Invalid user t from 104.199.217.25 port 57576
Sep  2 12:31:02 nativespace-cdp sshd[1338608]: input_userauth_request: invalid user t [preauth]
Sep  2 12:31:02 nativespace-cdp sshd[1338608]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:31:02 nativespace-cdp sshd[1338608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.199.217.25
Sep  2 12:31:04 nativespace-cdp sshd[1338608]: Failed password for invalid user t from 104.199.217.25 port 57576 ssh2
Sep  2 12:31:04 nativespace-cdp sshd[1338608]: Received disconnect from 104.199.217.25 port 57576:11: Bye Bye [preauth]
Sep  2 12:31:04 nativespace-cdp sshd[1338608]: Disconnected from 104.199.217.25 port 57576 [preauth]
Sep  2 12:31:33 nativespace-cdp sshd[1338758]: Connection closed by 159.100.136.21 port 56832 [preauth]
Sep  2 12:31:43 nativespace-cdp sshd[1338783]: Invalid user hadoop from 203.145.34.222 port 46692
Sep  2 12:31:43 nativespace-cdp sshd[1338783]: input_userauth_request: invalid user hadoop [preauth]
Sep  2 12:31:43 nativespace-cdp sshd[1338783]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:31:43 nativespace-cdp sshd[1338783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.145.34.222
Sep  2 12:31:44 nativespace-cdp sshd[1338783]: Failed password for invalid user hadoop from 203.145.34.222 port 46692 ssh2
Sep  2 12:31:44 nativespace-cdp sshd[1338783]: Received disconnect from 203.145.34.222 port 46692:11: Bye Bye [preauth]
Sep  2 12:31:44 nativespace-cdp sshd[1338783]: Disconnected from 203.145.34.222 port 46692 [preauth]
Sep  2 12:36:33 nativespace-cdp sshd[1339941]: Connection closed by 159.100.136.21 port 38934 [preauth]
Sep  2 12:41:33 nativespace-cdp sshd[1341143]: Connection closed by 159.100.136.21 port 48948 [preauth]
Sep  2 12:42:18 nativespace-cdp sshd[1341292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.69.236.207  user=root
Sep  2 12:42:18 nativespace-cdp sshd[1341292]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 12:42:20 nativespace-cdp sshd[1341292]: Failed password for root from 200.69.236.207 port 58998 ssh2
Sep  2 12:42:20 nativespace-cdp sshd[1341292]: Received disconnect from 200.69.236.207 port 58998:11: Bye Bye [preauth]
Sep  2 12:42:20 nativespace-cdp sshd[1341292]: Disconnected from 200.69.236.207 port 58998 [preauth]
Sep  2 12:42:57 nativespace-cdp sshd[1341395]: Invalid user nut from 121.163.199.97 port 55263
Sep  2 12:42:57 nativespace-cdp sshd[1341395]: input_userauth_request: invalid user nut [preauth]
Sep  2 12:42:57 nativespace-cdp sshd[1341395]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:42:57 nativespace-cdp sshd[1341395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.163.199.97
Sep  2 12:42:58 nativespace-cdp sshd[1341395]: Failed password for invalid user nut from 121.163.199.97 port 55263 ssh2
Sep  2 12:42:59 nativespace-cdp sshd[1341395]: Received disconnect from 121.163.199.97 port 55263:11: Bye Bye [preauth]
Sep  2 12:42:59 nativespace-cdp sshd[1341395]: Disconnected from 121.163.199.97 port 55263 [preauth]
Sep  2 12:46:33 nativespace-cdp sshd[1342516]: Connection closed by 159.100.136.21 port 59178 [preauth]
Sep  2 12:47:20 nativespace-cdp sshd[1342663]: Invalid user admin from 121.163.199.97 port 44278
Sep  2 12:47:20 nativespace-cdp sshd[1342663]: input_userauth_request: invalid user admin [preauth]
Sep  2 12:47:20 nativespace-cdp sshd[1342663]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:47:20 nativespace-cdp sshd[1342663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.163.199.97
Sep  2 12:47:22 nativespace-cdp sshd[1342663]: Failed password for invalid user admin from 121.163.199.97 port 44278 ssh2
Sep  2 12:47:22 nativespace-cdp sshd[1342663]: Received disconnect from 121.163.199.97 port 44278:11: Bye Bye [preauth]
Sep  2 12:47:22 nativespace-cdp sshd[1342663]: Disconnected from 121.163.199.97 port 44278 [preauth]
Sep  2 12:47:53 nativespace-cdp sshd[1342764]: Invalid user ore(TM)2 from 200.69.236.207 port 51937
Sep  2 12:47:53 nativespace-cdp sshd[1342764]: input_userauth_request: invalid user ore(TM)2 [preauth]
Sep  2 12:47:53 nativespace-cdp sshd[1342764]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:47:53 nativespace-cdp sshd[1342764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.69.236.207
Sep  2 12:47:55 nativespace-cdp sshd[1342764]: Failed password for invalid user ore(TM)2 from 200.69.236.207 port 51937 ssh2
Sep  2 12:47:55 nativespace-cdp sshd[1342764]: Received disconnect from 200.69.236.207 port 51937:11: Bye Bye [preauth]
Sep  2 12:47:55 nativespace-cdp sshd[1342764]: Disconnected from 200.69.236.207 port 51937 [preauth]
Sep  2 12:48:08 nativespace-cdp sshd[1342832]: Invalid user ftpup from 121.163.199.97 port 50765
Sep  2 12:48:08 nativespace-cdp sshd[1342832]: input_userauth_request: invalid user ftpup [preauth]
Sep  2 12:48:08 nativespace-cdp sshd[1342832]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:48:08 nativespace-cdp sshd[1342832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.163.199.97
Sep  2 12:48:10 nativespace-cdp sshd[1342832]: Failed password for invalid user ftpup from 121.163.199.97 port 50765 ssh2
Sep  2 12:48:10 nativespace-cdp sshd[1342832]: Received disconnect from 121.163.199.97 port 50765:11: Bye Bye [preauth]
Sep  2 12:48:10 nativespace-cdp sshd[1342832]: Disconnected from 121.163.199.97 port 50765 [preauth]
Sep  2 12:48:51 nativespace-cdp sshd[1343135]: Invalid user ts from 200.69.236.207 port 58445
Sep  2 12:48:51 nativespace-cdp sshd[1343135]: input_userauth_request: invalid user ts [preauth]
Sep  2 12:48:51 nativespace-cdp sshd[1343135]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 12:48:51 nativespace-cdp sshd[1343135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.69.236.207
Sep  2 12:48:53 nativespace-cdp sshd[1343135]: Failed password for invalid user ts from 200.69.236.207 port 58445 ssh2
Sep  2 12:51:33 nativespace-cdp sshd[1343934]: Connection closed by 159.100.136.21 port 40992 [preauth]
Sep  2 12:55:19 nativespace-cdp sshd[1344766]: Did not receive identification string from 87.236.176.163 port 40589
Sep  2 12:55:20 nativespace-cdp sshd[1344770]: Connection closed by 87.236.176.163 port 52691 [preauth]
Sep  2 12:56:33 nativespace-cdp sshd[1345116]: Connection closed by 159.100.136.21 port 51286 [preauth]
Sep  2 13:01:33 nativespace-cdp sshd[1346707]: Connection closed by 159.100.136.21 port 33102 [preauth]
Sep  2 13:06:33 nativespace-cdp sshd[1348028]: Connection closed by 159.100.136.21 port 43470 [preauth]
Sep  2 13:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 13:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:26 nativespace-cdp sudo[1348585]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 13:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:26 nativespace-cdp sudo[1348589]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 13:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:27 nativespace-cdp sudo[1348594]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 13:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:27 nativespace-cdp sudo[1348600]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 13:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:30 nativespace-cdp sudo[1348606]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 13:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:30 nativespace-cdp sudo[1348623]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 13:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:30 nativespace-cdp sudo[1348628]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 13:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:30 nativespace-cdp sudo[1348632]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 13:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:30 nativespace-cdp sudo[1348637]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 13:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:30 nativespace-cdp sudo[1348642]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 13:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:30 nativespace-cdp sudo[1348649]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 13:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:32 nativespace-cdp sudo[1348660]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 13:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:32 nativespace-cdp sudo[1348666]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=firstre2 user-2=vivienn1 user-3=battlere user-4=oneoarco user-5=brighto1 user-6=nstriton user-7=belle user-8=ggaaorgu user-9=newstoda user-10=bemadonn user-11=bedfords user-12=alexadmin user-13=skyfirec user-14=nativene user-15=innovat1 user-16=stuartge user-17=askhform user-18=opaiscyx user-19=coursemc user-20=jonhartl user-21=seftvta user-22=ultbcrra user-23=firstres user-24=firstred user-25=southlon user-26=highlegh user-27=clarkass user-28=firstrel user-29=costestimatorco user-30=hubmaster user-31=putterfi user-32=carsinyo user-33=fetch user-34=milloyco user-35=gilpin user-36=elecleis user-37=connectedshoppin user-38=thqkgnbz user-39=accooper user-40=ianrayne user-41=strathar user-42=sarafoundation user-43=atestord user-44=lakesan1 user-45=brmrjxl user-46=musorguk user-47=megacards
Sep  2 13:09:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=wilsonsw user-49=dickemery123 user-50=ptkxhsbt user-51=martsblo user-52=magichat user-53=lbhyisi user-54=hhdugcor user-55=athenare user-56=connect9 user-57=vantagep user-58=maflemin user-59=lbscrmod user-60=markward user-61=foundation user-62=booff user-63=ulsukarm user-64=spectrum user-65=theblack user-66=hodgesonweb user-67=jarvisin user-68=stephani user-69=leereyn1 user-70=still user-71=agproduc user-72=boldover user-73=nove user-74=bakery user-75=sosevalu user-76=crrtipdl user-77=cath user-78=sketchy user-79=havantho user-80=nvihkvu user-81=oubpgvbx user-82=tstardom user-83=what user-84=design user-85=ladburyp user-86=stagingerris user-87=dancinggardener user-88=kategilpin user-89=jennimil user-90=tomandle user-91=nbhavers user-92=careers user-93=david user-94=pars user-95=chrisdal user-96=mcdermos user-97=onlycont user-98=attlebor user-99=lucy user-100=romaldki user-101=hodgsonmail user-102=outdoorc
Sep  2 13:09:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ranxterc user-104=branko user-105=lkpier user-106=ctedorgu user-107=philmcph user-108=firstre5 user-109=donnychicago user-110=steakbridieme user-111=putterfc user-112=nscdp user-113=health2045 user-114=fortunaz user-115=foods user-116=leftie user-117=hidden user-118=nomistakes user-119=tigerlet user-120=barbersh user-121=smrszyqg user-122=isleofwi user-123=paulmca1 user-124=howardon user-125=pugwash user-126=cwsocial user-127=cambria1 user-128=cathski user-129=ninejimm user-130=reliable user-131=eugincou user-132=courseme user-133=hirefootballgame user-134=asandcoc user-135=sibtoncc user-136=steve user-137=bwppodcast user-138=zebrapho user-139=nsceres user-140=burydropin user-141=fawcettd user-142=dhyana user-143=beauty user-144=eatspam user-145=darkstar feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 13:09:32 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 13:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:33 nativespace-cdp sudo[1348673]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 13:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:34 nativespace-cdp sudo[1348688]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VJEH60ckfUPY8ztE.~
Sep  2 13:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:34 nativespace-cdp sudo[1348693]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VJEH60ckfUPY8ztE.~'
Sep  2 13:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:34 nativespace-cdp sudo[1348697]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VJEH60ckfUPY8ztE.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 13:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:34 nativespace-cdp sudo[1348703]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 13:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:34 nativespace-cdp sudo[1348708]: pam_unix(sudo:session): session closed for user root
Sep  2 13:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 13:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:09:46 nativespace-cdp sudo[1348765]: pam_unix(sudo:session): session closed for user root
Sep  2 13:11:33 nativespace-cdp sshd[1349701]: Connection closed by 159.100.136.21 port 53448 [preauth]
Sep  2 13:16:33 nativespace-cdp sshd[1352241]: Connection closed by 159.100.136.21 port 35438 [preauth]
Sep  2 13:21:33 nativespace-cdp sshd[1354929]: Connection closed by 159.100.136.21 port 45440 [preauth]
Sep  2 13:26:33 nativespace-cdp sshd[1358206]: Connection closed by 159.100.136.21 port 55720 [preauth]
Sep  2 13:31:33 nativespace-cdp sshd[1361119]: Connection closed by 159.100.136.21 port 37564 [preauth]
Sep  2 13:36:33 nativespace-cdp sshd[1362295]: Connection closed by 159.100.136.21 port 47868 [preauth]
Sep  2 13:39:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 13:39:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:39:24 nativespace-cdp sudo[1363019]: pam_unix(sudo:session): session closed for user root
Sep  2 13:39:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 13:39:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:39:24 nativespace-cdp sudo[1363027]: pam_unix(sudo:session): session closed for user root
Sep  2 13:39:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/pars/parsgroup.co.uk/wp-toolkit.conf
Sep  2 13:39:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:39:24 nativespace-cdp sudo[1363041]: pam_unix(sudo:session): session closed for user root
Sep  2 13:39:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/pars/parsgroup.co.uk/wp-toolkit.conf
Sep  2 13:39:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:39:24 nativespace-cdp sudo[1363046]: pam_unix(sudo:session): session closed for user root
Sep  2 13:39:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/pars/parsgroup.co.uk/wp-toolkit.conf
Sep  2 13:39:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 13:39:24 nativespace-cdp sudo[1363050]: pam_unix(sudo:session): session closed for user root
Sep  2 13:41:33 nativespace-cdp sshd[1363893]: Connection closed by 159.100.136.21 port 57848 [preauth]
Sep  2 13:46:33 nativespace-cdp sshd[1365441]: Connection closed by 159.100.136.21 port 39872 [preauth]
Sep  2 13:51:33 nativespace-cdp sshd[1366725]: Connection closed by 159.100.136.21 port 49880 [preauth]
Sep  2 13:56:33 nativespace-cdp sshd[1368072]: Connection closed by 159.100.136.21 port 60102 [preauth]
Sep  2 14:01:33 nativespace-cdp sshd[1369635]: Connection closed by 159.100.136.21 port 41872 [preauth]
Sep  2 14:06:33 nativespace-cdp sshd[1371219]: Connection closed by 159.100.136.21 port 52214 [preauth]
Sep  2 14:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 14:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:24 nativespace-cdp sudo[1371903]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 14:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:24 nativespace-cdp sudo[1371908]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 14:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:24 nativespace-cdp sudo[1371913]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 14:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:25 nativespace-cdp sudo[1371924]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 14:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:27 nativespace-cdp sudo[1371932]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 14:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:28 nativespace-cdp sudo[1371950]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 14:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:28 nativespace-cdp sudo[1371955]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 14:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:28 nativespace-cdp sudo[1371959]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 14:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:28 nativespace-cdp sudo[1371964]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 14:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:28 nativespace-cdp sudo[1371971]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 14:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:28 nativespace-cdp sudo[1371976]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 14:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:30 nativespace-cdp sudo[1372042]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 14:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:30 nativespace-cdp sudo[1372056]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=fetch user-2=carsinyo user-3=putterfi user-4=hubmaster user-5=elecleis user-6=gilpin user-7=milloyco user-8=thqkgnbz user-9=connectedshoppin user-10=ianrayne user-11=accooper user-12=opaiscyx user-13=coursemc user-14=firstres user-15=ultbcrra user-16=jonhartl user-17=seftvta user-18=highlegh user-19=southlon user-20=firstred user-21=costestimatorco user-22=clarkass user-23=firstrel user-24=skyfirec user-25=alexadmin user-26=nativene user-27=stuartge user-28=askhform user-29=innovat1 user-30=oneoarco user-31=battlere user-32=vivienn1 user-33=firstre2 user-34=nstriton user-35=brighto1 user-36=bemadonn user-37=newstoda user-38=ggaaorgu user-39=belle user-40=bedfords user-41=theblack user-42=hodgesonweb user-43=spectrum user-44=jarvisin user-45=leereyn1 user-46=stephani user-47=agproduc
Sep  2 14:09:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=still user-49=lbscrmod user-50=maflemin user-51=vantagep user-52=connect9 user-53=athenare user-54=booff user-55=foundation user-56=markward user-57=ulsukarm user-58=ptkxhsbt user-59=dickemery123 user-60=martsblo user-61=magichat user-62=hhdugcor user-63=lbhyisi user-64=atestord user-65=sarafoundation user-66=strathar user-67=brmrjxl user-68=lakesan1 user-69=megacards user-70=musorguk user-71=wilsonsw user-72=onlycont user-73=lucy user-74=attlebor user-75=romaldki user-76=branko user-77=hodgsonmail user-78=outdoorc user-79=ranxterc user-80=jennimil user-81=tomandle user-82=david user-83=nbhavers user-84=careers user-85=mcdermos user-86=chrisdal user-87=nvihkvu user-88=havantho user-89=cath user-90=sketchy user-91=what user-92=tstardom user-93=oubpgvbx user-94=design user-95=kategilpin user-96=dancinggardener user-97=stagingerris user-98=ladburyp user-99=boldover user-100=nove user-101=crrtipdl
Sep  2 14:09:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sosevalu user-103=bakery user-104=nsceres user-105=fawcettd user-106=burydropin user-107=dhyana user-108=darkstar user-109=eatspam user-110=beauty user-111=sibtoncc user-112=asandcoc user-113=steve user-114=zebrapho user-115=bwppodcast user-116=cwsocial user-117=paulmca1 user-118=pugwash user-119=howardon user-120=reliable user-121=ninejimm user-122=cathski user-123=cambria1 user-124=courseme user-125=eugincou user-126=hirefootballgame user-127=steakbridieme user-128=donnychicago user-129=firstre5 user-130=philmcph user-131=ctedorgu user-132=lkpier user-133=foods user-134=leftie user-135=fortunaz user-136=health2045 user-137=nscdp user-138=putterfc user-139=tigerlet user-140=barbersh user-141=nomistakes user-142=hidden user-143=isleofwi user-144=smrszyqg feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  2 14:09:30 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 14:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:31 nativespace-cdp sudo[1372071]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 14:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:32 nativespace-cdp sudo[1372082]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vsgp9YGWdooMX2rI.~
Sep  2 14:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:32 nativespace-cdp sudo[1372087]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vsgp9YGWdooMX2rI.~'
Sep  2 14:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:32 nativespace-cdp sudo[1372091]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vsgp9YGWdooMX2rI.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 14:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:32 nativespace-cdp sudo[1372097]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 14:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:32 nativespace-cdp sudo[1372103]: pam_unix(sudo:session): session closed for user root
Sep  2 14:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 14:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 14:09:44 nativespace-cdp sudo[1372156]: pam_unix(sudo:session): session closed for user root
Sep  2 14:11:33 nativespace-cdp sshd[1372949]: Connection closed by 159.100.136.21 port 33984 [preauth]
Sep  2 14:16:33 nativespace-cdp sshd[1374478]: Connection closed by 159.100.136.21 port 44176 [preauth]
Sep  2 14:21:33 nativespace-cdp sshd[1375701]: Connection closed by 159.100.136.21 port 54170 [preauth]
Sep  2 14:25:40 nativespace-cdp sshd[1376746]: Invalid user mk from 135.181.64.42 port 43294
Sep  2 14:25:40 nativespace-cdp sshd[1376746]: input_userauth_request: invalid user mk [preauth]
Sep  2 14:25:40 nativespace-cdp sshd[1376746]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:25:40 nativespace-cdp sshd[1376746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=135.181.64.42
Sep  2 14:25:42 nativespace-cdp sshd[1376746]: Failed password for invalid user mk from 135.181.64.42 port 43294 ssh2
Sep  2 14:25:43 nativespace-cdp sshd[1376746]: Received disconnect from 135.181.64.42 port 43294:11: Bye Bye [preauth]
Sep  2 14:25:43 nativespace-cdp sshd[1376746]: Disconnected from 135.181.64.42 port 43294 [preauth]
Sep  2 14:26:26 nativespace-cdp sshd[1377131]: Invalid user ypy from 141.95.53.205 port 34792
Sep  2 14:26:26 nativespace-cdp sshd[1377131]: input_userauth_request: invalid user ypy [preauth]
Sep  2 14:26:26 nativespace-cdp sshd[1377131]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:26:26 nativespace-cdp sshd[1377131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.95.53.205
Sep  2 14:26:28 nativespace-cdp sshd[1377131]: Failed password for invalid user ypy from 141.95.53.205 port 34792 ssh2
Sep  2 14:26:28 nativespace-cdp sshd[1377131]: Received disconnect from 141.95.53.205 port 34792:11: Bye Bye [preauth]
Sep  2 14:26:28 nativespace-cdp sshd[1377131]: Disconnected from 141.95.53.205 port 34792 [preauth]
Sep  2 14:26:33 nativespace-cdp sshd[1377202]: Connection closed by 159.100.136.21 port 35640 [preauth]
Sep  2 14:30:11 nativespace-cdp sshd[1378357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.161.118  user=root
Sep  2 14:30:11 nativespace-cdp sshd[1378357]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 14:30:13 nativespace-cdp sshd[1378357]: Failed password for root from 159.65.161.118 port 58954 ssh2
Sep  2 14:30:13 nativespace-cdp sshd[1378357]: Received disconnect from 159.65.161.118 port 58954:11: Bye Bye [preauth]
Sep  2 14:30:13 nativespace-cdp sshd[1378357]: Disconnected from 159.65.161.118 port 58954 [preauth]
Sep  2 14:31:33 nativespace-cdp sshd[1378747]: Connection closed by 159.100.136.21 port 45696 [preauth]
Sep  2 14:31:36 nativespace-cdp sshd[1378758]: Invalid user bird from 144.217.158.198 port 34494
Sep  2 14:31:36 nativespace-cdp sshd[1378758]: input_userauth_request: invalid user bird [preauth]
Sep  2 14:31:36 nativespace-cdp sshd[1378758]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:31:36 nativespace-cdp sshd[1378758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.158.198
Sep  2 14:31:38 nativespace-cdp sshd[1378758]: Failed password for invalid user bird from 144.217.158.198 port 34494 ssh2
Sep  2 14:31:38 nativespace-cdp sshd[1378758]: Received disconnect from 144.217.158.198 port 34494:11: Bye Bye [preauth]
Sep  2 14:31:38 nativespace-cdp sshd[1378758]: Disconnected from 144.217.158.198 port 34494 [preauth]
Sep  2 14:31:46 nativespace-cdp sshd[1378853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.110.238.50  user=root
Sep  2 14:31:46 nativespace-cdp sshd[1378853]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 14:31:49 nativespace-cdp sshd[1378853]: Failed password for root from 187.110.238.50 port 41850 ssh2
Sep  2 14:31:49 nativespace-cdp sshd[1378853]: Received disconnect from 187.110.238.50 port 41850:11: Bye Bye [preauth]
Sep  2 14:31:49 nativespace-cdp sshd[1378853]: Disconnected from 187.110.238.50 port 41850 [preauth]
Sep  2 14:33:14 nativespace-cdp sshd[1379160]: Invalid user runner from 141.95.53.205 port 55436
Sep  2 14:33:14 nativespace-cdp sshd[1379160]: input_userauth_request: invalid user runner [preauth]
Sep  2 14:33:14 nativespace-cdp sshd[1379160]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:33:14 nativespace-cdp sshd[1379160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.95.53.205
Sep  2 14:33:15 nativespace-cdp sshd[1379160]: Failed password for invalid user runner from 141.95.53.205 port 55436 ssh2
Sep  2 14:33:15 nativespace-cdp sshd[1379160]: Received disconnect from 141.95.53.205 port 55436:11: Bye Bye [preauth]
Sep  2 14:33:15 nativespace-cdp sshd[1379160]: Disconnected from 141.95.53.205 port 55436 [preauth]
Sep  2 14:33:32 nativespace-cdp sshd[1379224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.158.198  user=root
Sep  2 14:33:32 nativespace-cdp sshd[1379224]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 14:33:34 nativespace-cdp sshd[1379224]: Failed password for root from 144.217.158.198 port 41150 ssh2
Sep  2 14:33:34 nativespace-cdp sshd[1379224]: Received disconnect from 144.217.158.198 port 41150:11: Bye Bye [preauth]
Sep  2 14:33:34 nativespace-cdp sshd[1379224]: Disconnected from 144.217.158.198 port 41150 [preauth]
Sep  2 14:33:53 nativespace-cdp sshd[1379285]: Invalid user bn from 141.95.53.205 port 53466
Sep  2 14:33:53 nativespace-cdp sshd[1379285]: input_userauth_request: invalid user bn [preauth]
Sep  2 14:33:53 nativespace-cdp sshd[1379285]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:33:53 nativespace-cdp sshd[1379285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.95.53.205
Sep  2 14:33:55 nativespace-cdp sshd[1379285]: Failed password for invalid user bn from 141.95.53.205 port 53466 ssh2
Sep  2 14:33:55 nativespace-cdp sshd[1379285]: Received disconnect from 141.95.53.205 port 53466:11: Bye Bye [preauth]
Sep  2 14:33:55 nativespace-cdp sshd[1379285]: Disconnected from 141.95.53.205 port 53466 [preauth]
Sep  2 14:33:56 nativespace-cdp sshd[1379291]: Invalid user runner from 159.65.161.118 port 40500
Sep  2 14:33:56 nativespace-cdp sshd[1379291]: input_userauth_request: invalid user runner [preauth]
Sep  2 14:33:56 nativespace-cdp sshd[1379291]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:33:56 nativespace-cdp sshd[1379291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.161.118
Sep  2 14:33:58 nativespace-cdp sshd[1379291]: Failed password for invalid user runner from 159.65.161.118 port 40500 ssh2
Sep  2 14:33:58 nativespace-cdp sshd[1379291]: Received disconnect from 159.65.161.118 port 40500:11: Bye Bye [preauth]
Sep  2 14:33:58 nativespace-cdp sshd[1379291]: Disconnected from 159.65.161.118 port 40500 [preauth]
Sep  2 14:34:08 nativespace-cdp sshd[1379367]: Invalid user skan from 187.110.238.50 port 35954
Sep  2 14:34:08 nativespace-cdp sshd[1379367]: input_userauth_request: invalid user skan [preauth]
Sep  2 14:34:08 nativespace-cdp sshd[1379367]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:34:08 nativespace-cdp sshd[1379367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.110.238.50
Sep  2 14:34:10 nativespace-cdp sshd[1379367]: Failed password for invalid user skan from 187.110.238.50 port 35954 ssh2
Sep  2 14:34:10 nativespace-cdp sshd[1379367]: Received disconnect from 187.110.238.50 port 35954:11: Bye Bye [preauth]
Sep  2 14:34:10 nativespace-cdp sshd[1379367]: Disconnected from 187.110.238.50 port 35954 [preauth]
Sep  2 14:34:13 nativespace-cdp sshd[1379381]: Invalid user test1 from 144.217.158.198 port 50026
Sep  2 14:34:13 nativespace-cdp sshd[1379381]: input_userauth_request: invalid user test1 [preauth]
Sep  2 14:34:13 nativespace-cdp sshd[1379381]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:34:13 nativespace-cdp sshd[1379381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.158.198
Sep  2 14:34:14 nativespace-cdp sshd[1379381]: Failed password for invalid user test1 from 144.217.158.198 port 50026 ssh2
Sep  2 14:34:39 nativespace-cdp sshd[1379476]: Invalid user test1 from 159.65.161.118 port 38364
Sep  2 14:34:39 nativespace-cdp sshd[1379476]: input_userauth_request: invalid user test1 [preauth]
Sep  2 14:34:39 nativespace-cdp sshd[1379476]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:34:39 nativespace-cdp sshd[1379476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.161.118
Sep  2 14:34:41 nativespace-cdp sshd[1379476]: Failed password for invalid user test1 from 159.65.161.118 port 38364 ssh2
Sep  2 14:34:41 nativespace-cdp sshd[1379476]: Received disconnect from 159.65.161.118 port 38364:11: Bye Bye [preauth]
Sep  2 14:34:41 nativespace-cdp sshd[1379476]: Disconnected from 159.65.161.118 port 38364 [preauth]
Sep  2 14:34:54 nativespace-cdp sshd[1379547]: Invalid user ln from 187.110.238.50 port 49016
Sep  2 14:34:54 nativespace-cdp sshd[1379547]: input_userauth_request: invalid user ln [preauth]
Sep  2 14:34:54 nativespace-cdp sshd[1379547]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:34:54 nativespace-cdp sshd[1379547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.110.238.50
Sep  2 14:34:57 nativespace-cdp sshd[1379547]: Failed password for invalid user ln from 187.110.238.50 port 49016 ssh2
Sep  2 14:34:57 nativespace-cdp sshd[1379547]: Received disconnect from 187.110.238.50 port 49016:11: Bye Bye [preauth]
Sep  2 14:34:57 nativespace-cdp sshd[1379547]: Disconnected from 187.110.238.50 port 49016 [preauth]
Sep  2 14:36:11 nativespace-cdp sshd[1380080]: Invalid user luo from 135.181.64.42 port 34642
Sep  2 14:36:11 nativespace-cdp sshd[1380080]: input_userauth_request: invalid user luo [preauth]
Sep  2 14:36:11 nativespace-cdp sshd[1380080]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:36:11 nativespace-cdp sshd[1380080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=135.181.64.42
Sep  2 14:36:13 nativespace-cdp sshd[1380080]: Failed password for invalid user luo from 135.181.64.42 port 34642 ssh2
Sep  2 14:36:14 nativespace-cdp sshd[1380080]: Received disconnect from 135.181.64.42 port 34642:11: Bye Bye [preauth]
Sep  2 14:36:14 nativespace-cdp sshd[1380080]: Disconnected from 135.181.64.42 port 34642 [preauth]
Sep  2 14:36:24 nativespace-cdp sshd[1380133]: Invalid user john from 135.181.64.42 port 53128
Sep  2 14:36:24 nativespace-cdp sshd[1380133]: input_userauth_request: invalid user john [preauth]
Sep  2 14:36:24 nativespace-cdp sshd[1380133]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:36:24 nativespace-cdp sshd[1380133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=135.181.64.42
Sep  2 14:36:26 nativespace-cdp sshd[1380133]: Failed password for invalid user john from 135.181.64.42 port 53128 ssh2
Sep  2 14:36:26 nativespace-cdp sshd[1380133]: Received disconnect from 135.181.64.42 port 53128:11: Bye Bye [preauth]
Sep  2 14:36:26 nativespace-cdp sshd[1380133]: Disconnected from 135.181.64.42 port 53128 [preauth]
Sep  2 14:36:33 nativespace-cdp sshd[1380234]: Connection closed by 159.100.136.21 port 56030 [preauth]
Sep  2 14:41:33 nativespace-cdp sshd[1381742]: Connection closed by 159.100.136.21 port 37758 [preauth]
Sep  2 14:44:41 nativespace-cdp sshd[1382394]: Invalid user telefon from 190.85.15.251 port 49547
Sep  2 14:44:41 nativespace-cdp sshd[1382394]: input_userauth_request: invalid user telefon [preauth]
Sep  2 14:44:41 nativespace-cdp sshd[1382394]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 14:44:41 nativespace-cdp sshd[1382394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.85.15.251
Sep  2 14:44:43 nativespace-cdp sshd[1382394]: Failed password for invalid user telefon from 190.85.15.251 port 49547 ssh2
Sep  2 14:44:43 nativespace-cdp sshd[1382394]: Received disconnect from 190.85.15.251 port 49547:11: Bye Bye [preauth]
Sep  2 14:44:43 nativespace-cdp sshd[1382394]: Disconnected from 190.85.15.251 port 49547 [preauth]
Sep  2 14:46:00 nativespace-cdp sshd[1382854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.85.15.251  user=root
Sep  2 14:46:00 nativespace-cdp sshd[1382854]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 14:46:03 nativespace-cdp sshd[1382854]: Failed password for root from 190.85.15.251 port 50384 ssh2
Sep  2 14:46:03 nativespace-cdp sshd[1382854]: Received disconnect from 190.85.15.251 port 50384:11: Bye Bye [preauth]
Sep  2 14:46:03 nativespace-cdp sshd[1382854]: Disconnected from 190.85.15.251 port 50384 [preauth]
Sep  2 14:46:33 nativespace-cdp sshd[1383128]: Connection closed by 159.100.136.21 port 48016 [preauth]
Sep  2 14:47:30 nativespace-cdp sshd[1383308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.85.15.251  user=root
Sep  2 14:47:30 nativespace-cdp sshd[1383308]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 14:47:32 nativespace-cdp sshd[1383308]: Failed password for root from 190.85.15.251 port 60085 ssh2
Sep  2 14:47:32 nativespace-cdp sshd[1383308]: Received disconnect from 190.85.15.251 port 60085:11: Bye Bye [preauth]
Sep  2 14:47:32 nativespace-cdp sshd[1383308]: Disconnected from 190.85.15.251 port 60085 [preauth]
Sep  2 14:51:33 nativespace-cdp sshd[1384527]: Connection closed by 159.100.136.21 port 58022 [preauth]
Sep  2 14:56:33 nativespace-cdp sshd[1386227]: Connection closed by 159.100.136.21 port 40090 [preauth]
Sep  2 15:01:33 nativespace-cdp sshd[1387612]: Connection closed by 159.100.136.21 port 50094 [preauth]
Sep  2 15:05:23 nativespace-cdp sshd[1388593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.20.186.237  user=root
Sep  2 15:05:23 nativespace-cdp sshd[1388593]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 15:05:25 nativespace-cdp sshd[1388593]: Failed password for root from 160.20.186.237 port 52506 ssh2
Sep  2 15:05:25 nativespace-cdp sshd[1388593]: Received disconnect from 160.20.186.237 port 52506:11: Bye Bye [preauth]
Sep  2 15:05:25 nativespace-cdp sshd[1388593]: Disconnected from 160.20.186.237 port 52506 [preauth]
Sep  2 15:06:33 nativespace-cdp sshd[1388972]: Connection closed by 159.100.136.21 port 60406 [preauth]
Sep  2 15:06:36 nativespace-cdp sshd[1388969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.238.246.122  user=root
Sep  2 15:06:36 nativespace-cdp sshd[1388969]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 15:06:39 nativespace-cdp sshd[1388969]: Failed password for root from 160.238.246.122 port 22253 ssh2
Sep  2 15:06:39 nativespace-cdp sshd[1388969]: Received disconnect from 160.238.246.122 port 22253:11: Bye Bye [preauth]
Sep  2 15:06:39 nativespace-cdp sshd[1388969]: Disconnected from 160.238.246.122 port 22253 [preauth]
Sep  2 15:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 15:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:26 nativespace-cdp sudo[1389718]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 15:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:26 nativespace-cdp sudo[1389722]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 15:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:28 nativespace-cdp sudo[1389727]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 15:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:28 nativespace-cdp sudo[1389736]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 15:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:31 nativespace-cdp sudo[1389742]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 15:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:31 nativespace-cdp sudo[1389761]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 15:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:31 nativespace-cdp sudo[1389767]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 15:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:31 nativespace-cdp sudo[1389771]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 15:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:31 nativespace-cdp sudo[1389776]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 15:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:31 nativespace-cdp sudo[1389782]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 15:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:31 nativespace-cdp sudo[1389787]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:39 nativespace-cdp sudo[1389817]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 15:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:41 nativespace-cdp sudo[1389827]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=mcdermos user-4=chrisdal user-5=david user-6=careers user-7=nbhavers user-8=lucy user-9=attlebor user-10=onlycont user-11=branko user-12=hodgsonmail user-13=ranxterc user-14=outdoorc user-15=romaldki user-16=nove user-17=boldover user-18=crrtipdl user-19=sosevalu user-20=bakery user-21=what user-22=tstardom user-23=oubpgvbx user-24=nvihkvu user-25=havantho user-26=cath user-27=sketchy user-28=kategilpin user-29=dancinggardener user-30=stagingerris user-31=ladburyp user-32=design user-33=asandcoc user-34=sibtoncc user-35=zebrapho user-36=bwppodcast user-37=steve user-38=fawcettd user-39=burydropin user-40=nsceres user-41=darkstar user-42=eatspam user-43=beauty user-44=dhyana user-45=leftie user-46=foods user-47=health2045 user-48=fortunaz user-49=nscdp
Sep  2 15:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=putterfc user-51=steakbridieme user-52=donnychicago user-53=firstre5 user-54=philmcph user-55=ctedorgu user-56=lkpier user-57=isleofwi user-58=smrszyqg user-59=barbersh user-60=tigerlet user-61=nomistakes user-62=hidden user-63=ninejimm user-64=reliable user-65=cambria1 user-66=cathski user-67=cwsocial user-68=howardon user-69=paulmca1 user-70=pugwash user-71=hirefootballgame user-72=courseme user-73=eugincou user-74=firstres user-75=ultbcrra user-76=seftvta user-77=jonhartl user-78=opaiscyx user-79=coursemc user-80=costestimatorco user-81=firstrel user-82=clarkass user-83=highlegh user-84=southlon user-85=firstred user-86=elecleis user-87=milloyco user-88=gilpin user-89=fetch user-90=carsinyo user-91=hubmaster user-92=putterfi user-93=ianrayne user-94=accooper user-95=thqkgnbz user-96=connectedshoppin user-97=nstriton user-98=brighto1 user-99=oneoarco user-100=battlere user-101=vivienn1 user-102=firstre2
Sep  2 15:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=bemadonn user-105=newstoda user-106=belle user-107=ggaaorgu user-108=alexadmin user-109=skyfirec user-110=stuartge user-111=askhform user-112=innovat1 user-113=nativene user-114=booff user-115=foundation user-116=markward user-117=lbscrmod user-118=maflemin user-119=vantagep user-120=connect9 user-121=athenare user-122=ulsukarm user-123=jarvisin user-124=theblack user-125=hodgesonweb user-126=spectrum user-127=agproduc user-128=still user-129=leereyn1 user-130=stephani user-131=brmrjxl user-132=lakesan1 user-133=atestord user-134=sarafoundation user-135=strathar user-136=wilsonsw user-137=megacards user-138=musorguk user-139=martsblo user-140=ptkxhsbt user-141=dickemery123 user-142=hhdugcor user-143=lbhyisi user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 15:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:44 nativespace-cdp sudo[1389842]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 15:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:45 nativespace-cdp sudo[1389860]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qsBCgmtgM0jdGrfN.~
Sep  2 15:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:45 nativespace-cdp sudo[1389866]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qsBCgmtgM0jdGrfN.~'
Sep  2 15:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:45 nativespace-cdp sudo[1389870]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qsBCgmtgM0jdGrfN.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 15:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:45 nativespace-cdp sudo[1389876]: pam_unix(sudo:session): session closed for user root
Sep  2 15:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 15:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:09:45 nativespace-cdp sudo[1389882]: pam_unix(sudo:session): session closed for user root
Sep  2 15:10:04 nativespace-cdp sshd[1390064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.63.9.36  user=root
Sep  2 15:10:04 nativespace-cdp sshd[1390064]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 15:10:07 nativespace-cdp sshd[1390064]: Failed password for root from 41.63.9.36 port 51554 ssh2
Sep  2 15:10:07 nativespace-cdp sshd[1390064]: Received disconnect from 41.63.9.36 port 51554:11: Bye Bye [preauth]
Sep  2 15:10:07 nativespace-cdp sshd[1390064]: Disconnected from 41.63.9.36 port 51554 [preauth]
Sep  2 15:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 15:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 15:10:11 nativespace-cdp sudo[1390132]: pam_unix(sudo:session): session closed for user root
Sep  2 15:10:18 nativespace-cdp sshd[1390161]: Invalid user kaori from 23.240.170.4 port 9069
Sep  2 15:10:18 nativespace-cdp sshd[1390161]: input_userauth_request: invalid user kaori [preauth]
Sep  2 15:10:18 nativespace-cdp sshd[1390161]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:10:18 nativespace-cdp sshd[1390161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.240.170.4
Sep  2 15:10:19 nativespace-cdp sshd[1390161]: Failed password for invalid user kaori from 23.240.170.4 port 9069 ssh2
Sep  2 15:10:19 nativespace-cdp sshd[1390161]: Received disconnect from 23.240.170.4 port 9069:11: Bye Bye [preauth]
Sep  2 15:10:19 nativespace-cdp sshd[1390161]: Disconnected from 23.240.170.4 port 9069 [preauth]
Sep  2 15:11:33 nativespace-cdp sshd[1390591]: Connection closed by 159.100.136.21 port 41588 [preauth]
Sep  2 15:13:03 nativespace-cdp sshd[1391046]: Invalid user user from 160.20.186.237 port 45742
Sep  2 15:13:03 nativespace-cdp sshd[1391046]: input_userauth_request: invalid user user [preauth]
Sep  2 15:13:03 nativespace-cdp sshd[1391046]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:13:03 nativespace-cdp sshd[1391046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.20.186.237
Sep  2 15:13:05 nativespace-cdp sshd[1391046]: Failed password for invalid user user from 160.20.186.237 port 45742 ssh2
Sep  2 15:13:05 nativespace-cdp sshd[1391046]: Received disconnect from 160.20.186.237 port 45742:11: Bye Bye [preauth]
Sep  2 15:13:05 nativespace-cdp sshd[1391046]: Disconnected from 160.20.186.237 port 45742 [preauth]
Sep  2 15:13:39 nativespace-cdp sshd[1391177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.240.170.4  user=root
Sep  2 15:13:39 nativespace-cdp sshd[1391177]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 15:13:41 nativespace-cdp sshd[1391177]: Failed password for root from 23.240.170.4 port 9077 ssh2
Sep  2 15:13:42 nativespace-cdp sshd[1391177]: Received disconnect from 23.240.170.4 port 9077:11: Bye Bye [preauth]
Sep  2 15:13:42 nativespace-cdp sshd[1391177]: Disconnected from 23.240.170.4 port 9077 [preauth]
Sep  2 15:13:54 nativespace-cdp sshd[1391219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.20.186.237  user=root
Sep  2 15:13:54 nativespace-cdp sshd[1391219]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 15:13:56 nativespace-cdp sshd[1391219]: Failed password for root from 160.20.186.237 port 49830 ssh2
Sep  2 15:13:57 nativespace-cdp sshd[1391219]: Received disconnect from 160.20.186.237 port 49830:11: Bye Bye [preauth]
Sep  2 15:13:57 nativespace-cdp sshd[1391219]: Disconnected from 160.20.186.237 port 49830 [preauth]
Sep  2 15:14:10 nativespace-cdp sshd[1391325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.63.9.36  user=root
Sep  2 15:14:10 nativespace-cdp sshd[1391325]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 15:14:12 nativespace-cdp sshd[1391325]: Failed password for root from 41.63.9.36 port 37318 ssh2
Sep  2 15:14:12 nativespace-cdp sshd[1391325]: Received disconnect from 41.63.9.36 port 37318:11: Bye Bye [preauth]
Sep  2 15:14:12 nativespace-cdp sshd[1391325]: Disconnected from 41.63.9.36 port 37318 [preauth]
Sep  2 15:14:29 nativespace-cdp sshd[1391417]: Invalid user howard from 160.238.246.122 port 47077
Sep  2 15:14:29 nativespace-cdp sshd[1391417]: input_userauth_request: invalid user howard [preauth]
Sep  2 15:14:29 nativespace-cdp sshd[1391417]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:14:29 nativespace-cdp sshd[1391417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.238.246.122
Sep  2 15:14:32 nativespace-cdp sshd[1391417]: Failed password for invalid user howard from 160.238.246.122 port 47077 ssh2
Sep  2 15:14:33 nativespace-cdp sshd[1391417]: Received disconnect from 160.238.246.122 port 47077:11: Bye Bye [preauth]
Sep  2 15:14:33 nativespace-cdp sshd[1391417]: Disconnected from 160.238.246.122 port 47077 [preauth]
Sep  2 15:15:17 nativespace-cdp sshd[1391728]: Invalid user cloud-user from 41.63.9.36 port 54598
Sep  2 15:15:17 nativespace-cdp sshd[1391728]: input_userauth_request: invalid user cloud-user [preauth]
Sep  2 15:15:17 nativespace-cdp sshd[1391728]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:15:17 nativespace-cdp sshd[1391728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.63.9.36
Sep  2 15:15:19 nativespace-cdp sshd[1391728]: Failed password for invalid user cloud-user from 41.63.9.36 port 54598 ssh2
Sep  2 15:15:20 nativespace-cdp sshd[1391728]: Received disconnect from 41.63.9.36 port 54598:11: Bye Bye [preauth]
Sep  2 15:15:20 nativespace-cdp sshd[1391728]: Disconnected from 41.63.9.36 port 54598 [preauth]
Sep  2 15:15:46 nativespace-cdp sshd[1391960]: Invalid user cgx from 23.240.170.4 port 9083
Sep  2 15:15:46 nativespace-cdp sshd[1391960]: input_userauth_request: invalid user cgx [preauth]
Sep  2 15:15:46 nativespace-cdp sshd[1391960]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:15:46 nativespace-cdp sshd[1391960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.240.170.4
Sep  2 15:15:48 nativespace-cdp sshd[1391960]: Failed password for invalid user cgx from 23.240.170.4 port 9083 ssh2
Sep  2 15:15:48 nativespace-cdp sshd[1391960]: Received disconnect from 23.240.170.4 port 9083:11: Bye Bye [preauth]
Sep  2 15:15:48 nativespace-cdp sshd[1391960]: Disconnected from 23.240.170.4 port 9083 [preauth]
Sep  2 15:16:18 nativespace-cdp sshd[1392201]: Invalid user guohanning from 160.238.246.122 port 19767
Sep  2 15:16:18 nativespace-cdp sshd[1392201]: input_userauth_request: invalid user guohanning [preauth]
Sep  2 15:16:18 nativespace-cdp sshd[1392201]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:16:18 nativespace-cdp sshd[1392201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.238.246.122
Sep  2 15:16:20 nativespace-cdp sshd[1392201]: Failed password for invalid user guohanning from 160.238.246.122 port 19767 ssh2
Sep  2 15:16:21 nativespace-cdp sshd[1392201]: Received disconnect from 160.238.246.122 port 19767:11: Bye Bye [preauth]
Sep  2 15:16:21 nativespace-cdp sshd[1392201]: Disconnected from 160.238.246.122 port 19767 [preauth]
Sep  2 15:16:33 nativespace-cdp sshd[1392315]: Connection closed by 159.100.136.21 port 51810 [preauth]
Sep  2 15:21:33 nativespace-cdp sshd[1393712]: Connection closed by 159.100.136.21 port 33574 [preauth]
Sep  2 15:26:33 nativespace-cdp sshd[1395202]: Connection closed by 159.100.136.21 port 43088 [preauth]
Sep  2 15:31:33 nativespace-cdp sshd[1396814]: Connection closed by 159.100.136.21 port 53154 [preauth]
Sep  2 15:36:34 nativespace-cdp sshd[1398168]: Connection closed by 159.100.136.21 port 34842 [preauth]
Sep  2 15:40:57 nativespace-cdp sshd[1399526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.139.223  user=root
Sep  2 15:40:57 nativespace-cdp sshd[1399526]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 15:41:00 nativespace-cdp sshd[1399526]: Failed password for root from 170.64.139.223 port 34986 ssh2
Sep  2 15:41:00 nativespace-cdp sshd[1399526]: Received disconnect from 170.64.139.223 port 34986:11: Bye Bye [preauth]
Sep  2 15:41:00 nativespace-cdp sshd[1399526]: Disconnected from 170.64.139.223 port 34986 [preauth]
Sep  2 15:41:35 nativespace-cdp sshd[1399804]: Connection closed by 159.100.136.21 port 44800 [preauth]
Sep  2 15:42:06 nativespace-cdp sshd[1399888]: Invalid user tf from 124.198.59.254 port 44022
Sep  2 15:42:06 nativespace-cdp sshd[1399888]: input_userauth_request: invalid user tf [preauth]
Sep  2 15:42:06 nativespace-cdp sshd[1399888]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:42:06 nativespace-cdp sshd[1399888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.198.59.254
Sep  2 15:42:08 nativespace-cdp sshd[1399888]: Failed password for invalid user tf from 124.198.59.254 port 44022 ssh2
Sep  2 15:42:08 nativespace-cdp sshd[1399888]: Received disconnect from 124.198.59.254 port 44022:11: Bye Bye [preauth]
Sep  2 15:42:08 nativespace-cdp sshd[1399888]: Disconnected from 124.198.59.254 port 44022 [preauth]
Sep  2 15:43:08 nativespace-cdp sshd[1400102]: Invalid user ubuntu from 170.64.139.223 port 59374
Sep  2 15:43:08 nativespace-cdp sshd[1400102]: input_userauth_request: invalid user ubuntu [preauth]
Sep  2 15:43:08 nativespace-cdp sshd[1400102]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:43:08 nativespace-cdp sshd[1400102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.139.223
Sep  2 15:43:11 nativespace-cdp sshd[1400102]: Failed password for invalid user ubuntu from 170.64.139.223 port 59374 ssh2
Sep  2 15:43:11 nativespace-cdp sshd[1400102]: Received disconnect from 170.64.139.223 port 59374:11: Bye Bye [preauth]
Sep  2 15:43:11 nativespace-cdp sshd[1400102]: Disconnected from 170.64.139.223 port 59374 [preauth]
Sep  2 15:43:52 nativespace-cdp sshd[1400254]: Invalid user vijay from 124.198.59.254 port 41454
Sep  2 15:43:52 nativespace-cdp sshd[1400254]: input_userauth_request: invalid user vijay [preauth]
Sep  2 15:43:52 nativespace-cdp sshd[1400254]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:43:52 nativespace-cdp sshd[1400254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.198.59.254
Sep  2 15:43:53 nativespace-cdp sshd[1400254]: Failed password for invalid user vijay from 124.198.59.254 port 41454 ssh2
Sep  2 15:43:53 nativespace-cdp sshd[1400254]: Received disconnect from 124.198.59.254 port 41454:11: Bye Bye [preauth]
Sep  2 15:43:53 nativespace-cdp sshd[1400254]: Disconnected from 124.198.59.254 port 41454 [preauth]
Sep  2 15:44:08 nativespace-cdp sshd[1400280]: Invalid user rka from 170.64.139.223 port 41494
Sep  2 15:44:08 nativespace-cdp sshd[1400280]: input_userauth_request: invalid user rka [preauth]
Sep  2 15:44:08 nativespace-cdp sshd[1400280]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:44:08 nativespace-cdp sshd[1400280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.139.223
Sep  2 15:44:10 nativespace-cdp sshd[1400280]: Failed password for invalid user rka from 170.64.139.223 port 41494 ssh2
Sep  2 15:44:40 nativespace-cdp sshd[1400445]: Invalid user test from 124.198.59.254 port 38882
Sep  2 15:44:40 nativespace-cdp sshd[1400445]: input_userauth_request: invalid user test [preauth]
Sep  2 15:44:40 nativespace-cdp sshd[1400445]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 15:44:40 nativespace-cdp sshd[1400445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.198.59.254
Sep  2 15:44:42 nativespace-cdp sshd[1400445]: Failed password for invalid user test from 124.198.59.254 port 38882 ssh2
Sep  2 15:44:42 nativespace-cdp sshd[1400445]: Received disconnect from 124.198.59.254 port 38882:11: Bye Bye [preauth]
Sep  2 15:44:42 nativespace-cdp sshd[1400445]: Disconnected from 124.198.59.254 port 38882 [preauth]
Sep  2 15:46:33 nativespace-cdp sshd[1401151]: Connection closed by 159.100.136.21 port 53634 [preauth]
Sep  2 15:51:33 nativespace-cdp sshd[1402493]: Connection closed by 159.100.136.21 port 34836 [preauth]
Sep  2 15:56:33 nativespace-cdp sshd[1403987]: Connection closed by 159.100.136.21 port 45122 [preauth]
Sep  2 16:01:33 nativespace-cdp sshd[1405798]: Connection closed by 159.100.136.21 port 55134 [preauth]
Sep  2 16:06:33 nativespace-cdp sshd[1407291]: Connection closed by 159.100.136.21 port 37294 [preauth]
Sep  2 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:37 nativespace-cdp sudo[1408020]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:37 nativespace-cdp sudo[1408025]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:40 nativespace-cdp sudo[1408030]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 16:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:40 nativespace-cdp sudo[1408045]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 16:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:46 nativespace-cdp sudo[1408051]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 16:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:46 nativespace-cdp sudo[1408077]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 16:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:46 nativespace-cdp sudo[1408082]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 16:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:46 nativespace-cdp sudo[1408086]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 16:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:46 nativespace-cdp sudo[1408091]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 16:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:46 nativespace-cdp sudo[1408097]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 16:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:46 nativespace-cdp sudo[1408103]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 16:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:49 nativespace-cdp sudo[1408114]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 16:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:51 nativespace-cdp sudo[1408124]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=asandcoc user-2=sibtoncc user-3=steve user-4=zebrapho user-5=bwppodcast user-6=nsceres user-7=burydropin user-8=fawcettd user-9=dhyana user-10=eatspam user-11=darkstar user-12=beauty user-13=philmcph user-14=ctedorgu user-15=steakbridieme user-16=donnychicago user-17=firstre5 user-18=lkpier user-19=fortunaz user-20=health2045 user-21=foods user-22=leftie user-23=putterfc user-24=nscdp user-25=tigerlet user-26=barbersh user-27=hidden user-28=nomistakes user-29=isleofwi user-30=smrszyqg user-31=paulmca1 user-32=howardon user-33=pugwash user-34=cwsocial user-35=ninejimm user-36=reliable user-37=cambria1 user-38=cathski user-39=courseme user-40=eugincou user-41=hirefootballgame user-42=jennimil user-43=tomandle user-44=nbhavers user-45=careers user-46=david user-47=mcdermos user-48=chrisdal
Sep  2 16:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=attlebor user-51=lucy user-52=romaldki user-53=branko user-54=hodgsonmail user-55=outdoorc user-56=ranxterc user-57=boldover user-58=nove user-59=sosevalu user-60=crrtipdl user-61=bakery user-62=nvihkvu user-63=cath user-64=sketchy user-65=havantho user-66=what user-67=tstardom user-68=oubpgvbx user-69=design user-70=kategilpin user-71=ladburyp user-72=stagingerris user-73=dancinggardener user-74=maflemin user-75=lbscrmod user-76=connect9 user-77=athenare user-78=vantagep user-79=foundation user-80=markward user-81=booff user-82=ulsukarm user-83=theblack user-84=hodgesonweb user-85=spectrum user-86=jarvisin user-87=leereyn1 user-88=stephani user-89=still user-90=agproduc user-91=sarafoundation user-92=atestord user-93=strathar user-94=lakesan1 user-95=brmrjxl user-96=musorguk user-97=megacards user-98=wilsonsw user-99=ptkxhsbt user-100=dickemery123 user-101=martsblo user-102=magichat
Sep  2 16:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=lbhyisi user-104=hhdugcor user-105=coursemc user-106=opaiscyx user-107=firstres user-108=jonhartl user-109=seftvta user-110=ultbcrra user-111=southlon user-112=highlegh user-113=firstred user-114=costestimatorco user-115=firstrel user-116=clarkass user-117=carsinyo user-118=fetch user-119=putterfi user-120=hubmaster user-121=elecleis user-122=milloyco user-123=gilpin user-124=thqkgnbz user-125=connectedshoppin user-126=ianrayne user-127=accooper user-128=battlere user-129=oneoarco user-130=firstre2 user-131=vivienn1 user-132=brighto1 user-133=nstriton user-134=bemadonn user-135=belle user-136=ggaaorgu user-137=newstoda user-138=bedfords user-139=skyfirec user-140=alexadmin user-141=nativene user-142=askhform user-143=stuartge user-144=innovat1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 16:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 16:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:52 nativespace-cdp sudo[1408132]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 16:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:53 nativespace-cdp sudo[1408144]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Fnn1aJzgtQasnpc3.~
Sep  2 16:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:54 nativespace-cdp sudo[1408149]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Fnn1aJzgtQasnpc3.~'
Sep  2 16:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:54 nativespace-cdp sudo[1408153]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Fnn1aJzgtQasnpc3.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 16:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:54 nativespace-cdp sudo[1408159]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 16:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:54 nativespace-cdp sudo[1408166]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 16:09:56 nativespace-cdp sudo[1408191]: pam_unix(sudo:session): session closed for user root
Sep  2 16:09:57 nativespace-cdp sshd[1408200]: Accepted publickey for root from 185.67.178.249 port 47526 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  2 16:09:57 nativespace-cdp sshd[1408200]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  2 16:11:33 nativespace-cdp sshd[1412303]: Connection closed by 159.100.136.21 port 47290 [preauth]
Sep  2 16:16:33 nativespace-cdp sshd[1427001]: Connection closed by 159.100.136.21 port 57546 [preauth]
Sep  2 16:21:33 nativespace-cdp sshd[1435950]: Connection closed by 159.100.136.21 port 39310 [preauth]
Sep  2 16:26:33 nativespace-cdp sshd[1440081]: Connection closed by 159.100.136.21 port 49554 [preauth]
Sep  2 16:31:33 nativespace-cdp sshd[1441874]: Connection closed by 159.100.136.21 port 59562 [preauth]
Sep  2 16:36:33 nativespace-cdp sshd[1443269]: Connection closed by 159.100.136.21 port 41626 [preauth]
Sep  2 16:41:33 nativespace-cdp sshd[1444823]: Connection closed by 159.100.136.21 port 51604 [preauth]
Sep  2 16:46:33 nativespace-cdp sshd[1446155]: Connection closed by 159.100.136.21 port 33556 [preauth]
Sep  2 16:49:43 nativespace-cdp sshd[1446968]: Bad protocol version identification 'GET / HTTP/1.1' from 185.242.226.50 port 48062
Sep  2 16:51:33 nativespace-cdp sshd[1447553]: Connection closed by 159.100.136.21 port 43572 [preauth]
Sep  2 16:56:33 nativespace-cdp sshd[1448939]: Connection closed by 159.100.136.21 port 53848 [preauth]
Sep  2 17:01:33 nativespace-cdp sshd[1450609]: Connection closed by 159.100.136.21 port 35566 [preauth]
Sep  2 17:06:33 nativespace-cdp sshd[1451845]: Connection closed by 159.100.136.21 port 45888 [preauth]
Sep  2 17:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 17:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:27 nativespace-cdp sudo[1452507]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 17:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:27 nativespace-cdp sudo[1452512]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 17:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:28 nativespace-cdp sudo[1452515]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 17:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:29 nativespace-cdp sudo[1452524]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 17:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:33 nativespace-cdp sudo[1452529]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 17:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:33 nativespace-cdp sudo[1452550]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 17:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:33 nativespace-cdp sudo[1452559]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 17:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:33 nativespace-cdp sudo[1452562]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 17:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:33 nativespace-cdp sudo[1452565]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 17:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:33 nativespace-cdp sudo[1452570]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 17:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:33 nativespace-cdp sudo[1452574]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 17:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:36 nativespace-cdp sudo[1452584]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 17:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:36 nativespace-cdp sudo[1452589]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hhdugcor user-2=lbhyisi user-3=magichat user-4=martsblo user-5=dickemery123 user-6=ptkxhsbt user-7=wilsonsw user-8=megacards user-9=musorguk user-10=brmrjxl user-11=lakesan1 user-12=strathar user-13=atestord user-14=sarafoundation user-15=agproduc user-16=still user-17=stephani user-18=leereyn1 user-19=jarvisin user-20=spectrum user-21=theblack user-22=hodgesonweb user-23=ulsukarm user-24=booff user-25=foundation user-26=markward user-27=vantagep user-28=connect9 user-29=athenare user-30=lbscrmod user-31=maflemin user-32=innovat1 user-33=stuartge user-34=askhform user-35=nativene user-36=alexadmin user-37=skyfirec user-38=bedfords user-39=newstoda user-40=ggaaorgu user-41=belle user-42=bemadonn user-43=nstriton user-44=brighto1 user-45=vivienn1 user-46=firstre2 user-47=oneoarco user-48=battlere
Sep  2 17:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=accooper user-50=ianrayne user-51=connectedshoppin user-52=thqkgnbz user-53=milloyco user-54=gilpin user-55=elecleis user-56=hubmaster user-57=putterfi user-58=fetch user-59=carsinyo user-60=firstrel user-61=clarkass user-62=costestimatorco user-63=firstred user-64=highlegh user-65=southlon user-66=ultbcrra user-67=seftvta user-68=jonhartl user-69=firstres user-70=opaiscyx user-71=coursemc user-72=hirefootballgame user-73=eugincou user-74=courseme user-75=cathski user-76=cambria1 user-77=ninejimm user-78=reliable user-79=cwsocial user-80=paulmca1 user-81=howardon user-82=pugwash user-83=smrszyqg user-84=isleofwi user-85=nomistakes user-86=hidden user-87=barbersh user-88=tigerlet user-89=nscdp user-90=putterfc user-91=foods user-92=leftie user-93=fortunaz user-94=health2045 user-95=lkpier user-96=donnychicago user-97=firstre5 user-98=steakbridieme user-99=ctedorgu user-100=philmcph user-101=beauty
Sep  2 17:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=darkstar user-103=eatspam user-104=dhyana user-105=fawcettd user-106=burydropin user-107=nsceres user-108=bwppodcast user-109=zebrapho user-110=steve user-111=asandcoc user-112=sibtoncc user-113=stagingerris user-114=dancinggardener user-115=ladburyp user-116=kategilpin user-117=design user-118=tstardom user-119=oubpgvbx user-120=what user-121=havantho user-122=cath user-123=sketchy user-124=nvihkvu user-125=bakery user-126=crrtipdl user-127=sosevalu user-128=nove user-129=boldover user-130=ranxterc user-131=hodgsonmail user-132=outdoorc user-133=branko user-134=romaldki user-135=lucy user-136=attlebor user-137=onlycont user-138=chrisdal user-139=mcdermos user-140=david user-141=careers user-142=nbhavers user-143=tomandle user-144=jennimil feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 17:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 17:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:38 nativespace-cdp sudo[1452594]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 17:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:38 nativespace-cdp sudo[1452604]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hRsB3uoHCQhRfICT.~
Sep  2 17:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:38 nativespace-cdp sudo[1452607]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hRsB3uoHCQhRfICT.~'
Sep  2 17:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:38 nativespace-cdp sudo[1452610]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hRsB3uoHCQhRfICT.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 17:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:38 nativespace-cdp sudo[1452614]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 17:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:38 nativespace-cdp sudo[1452617]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep  2 17:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:39 nativespace-cdp sudo[1452620]: pam_unix(sudo:session): session closed for user root
Sep  2 17:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 17:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 17:09:51 nativespace-cdp sudo[1452671]: pam_unix(sudo:session): session closed for user root
Sep  2 17:11:33 nativespace-cdp sshd[1453344]: Connection closed by 159.100.136.21 port 55840 [preauth]
Sep  2 17:16:33 nativespace-cdp sshd[1454654]: Connection closed by 159.100.136.21 port 37840 [preauth]
Sep  2 17:21:33 nativespace-cdp sshd[1455877]: Connection closed by 159.100.136.21 port 47814 [preauth]
Sep  2 17:26:33 nativespace-cdp sshd[1457310]: Connection closed by 159.100.136.21 port 58064 [preauth]
Sep  2 17:31:33 nativespace-cdp sshd[1458764]: Connection closed by 159.100.136.21 port 39866 [preauth]
Sep  2 17:32:35 nativespace-cdp sshd[1459031]: Bad protocol version identification '\003' from 2.57.149.186 port 64560
Sep  2 17:36:33 nativespace-cdp sshd[1459953]: Connection closed by 159.100.136.21 port 50164 [preauth]
Sep  2 17:39:02 nativespace-cdp sshd[1460604]: Invalid user support from 20.214.159.245 port 48066
Sep  2 17:39:02 nativespace-cdp sshd[1460604]: input_userauth_request: invalid user support [preauth]
Sep  2 17:39:02 nativespace-cdp sshd[1460604]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:39:02 nativespace-cdp sshd[1460604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.214.159.245
Sep  2 17:39:04 nativespace-cdp sshd[1460604]: Failed password for invalid user support from 20.214.159.245 port 48066 ssh2
Sep  2 17:39:04 nativespace-cdp sshd[1460604]: Received disconnect from 20.214.159.245 port 48066:11: Bye Bye [preauth]
Sep  2 17:39:04 nativespace-cdp sshd[1460604]: Disconnected from 20.214.159.245 port 48066 [preauth]
Sep  2 17:39:32 nativespace-cdp sshd[1460699]: Invalid user jolly from 184.168.122.184 port 40182
Sep  2 17:39:32 nativespace-cdp sshd[1460699]: input_userauth_request: invalid user jolly [preauth]
Sep  2 17:39:32 nativespace-cdp sshd[1460699]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:39:32 nativespace-cdp sshd[1460699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.168.122.184
Sep  2 17:39:35 nativespace-cdp sshd[1460699]: Failed password for invalid user jolly from 184.168.122.184 port 40182 ssh2
Sep  2 17:39:35 nativespace-cdp sshd[1460699]: Received disconnect from 184.168.122.184 port 40182:11: Bye Bye [preauth]
Sep  2 17:39:35 nativespace-cdp sshd[1460699]: Disconnected from 184.168.122.184 port 40182 [preauth]
Sep  2 17:39:50 nativespace-cdp sshd[1460758]: Invalid user efraim from 61.222.211.114 port 46132
Sep  2 17:39:50 nativespace-cdp sshd[1460758]: input_userauth_request: invalid user efraim [preauth]
Sep  2 17:39:50 nativespace-cdp sshd[1460758]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:39:50 nativespace-cdp sshd[1460758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.222.211.114
Sep  2 17:39:52 nativespace-cdp sshd[1460758]: Failed password for invalid user efraim from 61.222.211.114 port 46132 ssh2
Sep  2 17:39:52 nativespace-cdp sshd[1460758]: Received disconnect from 61.222.211.114 port 46132:11: Bye Bye [preauth]
Sep  2 17:39:52 nativespace-cdp sshd[1460758]: Disconnected from 61.222.211.114 port 46132 [preauth]
Sep  2 17:41:12 nativespace-cdp sshd[1461394]: Invalid user gio from 27.254.207.91 port 47465
Sep  2 17:41:12 nativespace-cdp sshd[1461394]: input_userauth_request: invalid user gio [preauth]
Sep  2 17:41:12 nativespace-cdp sshd[1461394]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:41:12 nativespace-cdp sshd[1461394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.254.207.91
Sep  2 17:41:14 nativespace-cdp sshd[1461394]: Failed password for invalid user gio from 27.254.207.91 port 47465 ssh2
Sep  2 17:41:15 nativespace-cdp sshd[1461394]: Received disconnect from 27.254.207.91 port 47465:11: Bye Bye [preauth]
Sep  2 17:41:15 nativespace-cdp sshd[1461394]: Disconnected from 27.254.207.91 port 47465 [preauth]
Sep  2 17:41:33 nativespace-cdp sshd[1461516]: Connection closed by 159.100.136.21 port 60114 [preauth]
Sep  2 17:42:21 nativespace-cdp sshd[1461747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.185.138  user=root
Sep  2 17:42:21 nativespace-cdp sshd[1461747]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 17:42:24 nativespace-cdp sshd[1461747]: Failed password for root from 64.227.185.138 port 43252 ssh2
Sep  2 17:42:24 nativespace-cdp sshd[1461747]: Received disconnect from 64.227.185.138 port 43252:11: Bye Bye [preauth]
Sep  2 17:42:24 nativespace-cdp sshd[1461747]: Disconnected from 64.227.185.138 port 43252 [preauth]
Sep  2 17:43:31 nativespace-cdp sshd[1462003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.222.211.114  user=root
Sep  2 17:43:31 nativespace-cdp sshd[1462003]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 17:43:33 nativespace-cdp sshd[1462003]: Failed password for root from 61.222.211.114 port 32906 ssh2
Sep  2 17:43:33 nativespace-cdp sshd[1462003]: Received disconnect from 61.222.211.114 port 32906:11: Bye Bye [preauth]
Sep  2 17:43:33 nativespace-cdp sshd[1462003]: Disconnected from 61.222.211.114 port 32906 [preauth]
Sep  2 17:43:52 nativespace-cdp sshd[1462301]: Invalid user efraim from 184.168.122.184 port 36502
Sep  2 17:43:52 nativespace-cdp sshd[1462301]: input_userauth_request: invalid user efraim [preauth]
Sep  2 17:43:52 nativespace-cdp sshd[1462301]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:43:52 nativespace-cdp sshd[1462301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.168.122.184
Sep  2 17:43:53 nativespace-cdp sshd[1462301]: Failed password for invalid user efraim from 184.168.122.184 port 36502 ssh2
Sep  2 17:43:54 nativespace-cdp sshd[1462301]: Received disconnect from 184.168.122.184 port 36502:11: Bye Bye [preauth]
Sep  2 17:43:54 nativespace-cdp sshd[1462301]: Disconnected from 184.168.122.184 port 36502 [preauth]
Sep  2 17:43:56 nativespace-cdp sshd[1462399]: Invalid user admin1 from 27.254.207.91 port 41481
Sep  2 17:43:56 nativespace-cdp sshd[1462399]: input_userauth_request: invalid user admin1 [preauth]
Sep  2 17:43:56 nativespace-cdp sshd[1462399]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:43:56 nativespace-cdp sshd[1462399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.254.207.91
Sep  2 17:43:58 nativespace-cdp sshd[1462399]: Failed password for invalid user admin1 from 27.254.207.91 port 41481 ssh2
Sep  2 17:43:58 nativespace-cdp sshd[1462399]: Received disconnect from 27.254.207.91 port 41481:11: Bye Bye [preauth]
Sep  2 17:43:58 nativespace-cdp sshd[1462399]: Disconnected from 27.254.207.91 port 41481 [preauth]
Sep  2 17:44:07 nativespace-cdp sshd[1462461]: Invalid user xinjie from 64.227.185.138 port 38042
Sep  2 17:44:07 nativespace-cdp sshd[1462461]: input_userauth_request: invalid user xinjie [preauth]
Sep  2 17:44:07 nativespace-cdp sshd[1462461]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:44:07 nativespace-cdp sshd[1462461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.185.138
Sep  2 17:44:09 nativespace-cdp sshd[1462461]: Failed password for invalid user xinjie from 64.227.185.138 port 38042 ssh2
Sep  2 17:44:09 nativespace-cdp sshd[1462461]: Received disconnect from 64.227.185.138 port 38042:11: Bye Bye [preauth]
Sep  2 17:44:09 nativespace-cdp sshd[1462461]: Disconnected from 64.227.185.138 port 38042 [preauth]
Sep  2 17:44:19 nativespace-cdp sshd[1462489]: Invalid user xinjie from 61.222.211.114 port 51248
Sep  2 17:44:19 nativespace-cdp sshd[1462489]: input_userauth_request: invalid user xinjie [preauth]
Sep  2 17:44:19 nativespace-cdp sshd[1462489]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:44:19 nativespace-cdp sshd[1462489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.222.211.114
Sep  2 17:44:21 nativespace-cdp sshd[1462489]: Failed password for invalid user xinjie from 61.222.211.114 port 51248 ssh2
Sep  2 17:44:21 nativespace-cdp sshd[1462489]: Received disconnect from 61.222.211.114 port 51248:11: Bye Bye [preauth]
Sep  2 17:44:21 nativespace-cdp sshd[1462489]: Disconnected from 61.222.211.114 port 51248 [preauth]
Sep  2 17:44:43 nativespace-cdp sshd[1462574]: Invalid user wqp from 184.168.122.184 port 58684
Sep  2 17:44:43 nativespace-cdp sshd[1462574]: input_userauth_request: invalid user wqp [preauth]
Sep  2 17:44:43 nativespace-cdp sshd[1462574]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:44:43 nativespace-cdp sshd[1462574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.168.122.184
Sep  2 17:44:45 nativespace-cdp sshd[1462574]: Failed password for invalid user wqp from 184.168.122.184 port 58684 ssh2
Sep  2 17:44:45 nativespace-cdp sshd[1462574]: Received disconnect from 184.168.122.184 port 58684:11: Bye Bye [preauth]
Sep  2 17:44:45 nativespace-cdp sshd[1462574]: Disconnected from 184.168.122.184 port 58684 [preauth]
Sep  2 17:44:49 nativespace-cdp sshd[1462619]: Invalid user evolution from 27.254.207.91 port 21832
Sep  2 17:44:49 nativespace-cdp sshd[1462619]: input_userauth_request: invalid user evolution [preauth]
Sep  2 17:44:49 nativespace-cdp sshd[1462619]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:44:49 nativespace-cdp sshd[1462619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.254.207.91
Sep  2 17:44:51 nativespace-cdp sshd[1462619]: Failed password for invalid user evolution from 27.254.207.91 port 21832 ssh2
Sep  2 17:44:51 nativespace-cdp sshd[1462619]: Received disconnect from 27.254.207.91 port 21832:11: Bye Bye [preauth]
Sep  2 17:44:51 nativespace-cdp sshd[1462619]: Disconnected from 27.254.207.91 port 21832 [preauth]
Sep  2 17:44:59 nativespace-cdp sshd[1462691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.185.138  user=root
Sep  2 17:44:59 nativespace-cdp sshd[1462691]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 17:45:01 nativespace-cdp sshd[1462691]: Failed password for root from 64.227.185.138 port 47254 ssh2
Sep  2 17:45:01 nativespace-cdp sshd[1462691]: Received disconnect from 64.227.185.138 port 47254:11: Bye Bye [preauth]
Sep  2 17:45:01 nativespace-cdp sshd[1462691]: Disconnected from 64.227.185.138 port 47254 [preauth]
Sep  2 17:45:05 nativespace-cdp sshd[1462861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.214.159.245  user=root
Sep  2 17:45:05 nativespace-cdp sshd[1462861]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 17:45:07 nativespace-cdp sshd[1462861]: Failed password for root from 20.214.159.245 port 48254 ssh2
Sep  2 17:45:07 nativespace-cdp sshd[1462861]: Received disconnect from 20.214.159.245 port 48254:11: Bye Bye [preauth]
Sep  2 17:45:07 nativespace-cdp sshd[1462861]: Disconnected from 20.214.159.245 port 48254 [preauth]
Sep  2 17:45:13 nativespace-cdp sshd[1462893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.249.49  user=root
Sep  2 17:45:13 nativespace-cdp sshd[1462893]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 17:45:15 nativespace-cdp sshd[1462893]: Failed password for root from 123.30.249.49 port 54343 ssh2
Sep  2 17:45:15 nativespace-cdp sshd[1462893]: Received disconnect from 123.30.249.49 port 54343:11: Bye Bye [preauth]
Sep  2 17:45:15 nativespace-cdp sshd[1462893]: Disconnected from 123.30.249.49 port 54343 [preauth]
Sep  2 17:45:26 nativespace-cdp sshd[1462926]: Invalid user frontrow from 51.15.4.140 port 49654
Sep  2 17:45:26 nativespace-cdp sshd[1462926]: input_userauth_request: invalid user frontrow [preauth]
Sep  2 17:45:26 nativespace-cdp sshd[1462926]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:45:26 nativespace-cdp sshd[1462926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.4.140
Sep  2 17:45:28 nativespace-cdp sshd[1462926]: Failed password for invalid user frontrow from 51.15.4.140 port 49654 ssh2
Sep  2 17:45:28 nativespace-cdp sshd[1462926]: Received disconnect from 51.15.4.140 port 49654:11: Bye Bye [preauth]
Sep  2 17:45:28 nativespace-cdp sshd[1462926]: Disconnected from 51.15.4.140 port 49654 [preauth]
Sep  2 17:46:09 nativespace-cdp sshd[1463131]: Invalid user da from 157.245.126.60 port 47442
Sep  2 17:46:09 nativespace-cdp sshd[1463131]: input_userauth_request: invalid user da [preauth]
Sep  2 17:46:09 nativespace-cdp sshd[1463131]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:46:09 nativespace-cdp sshd[1463131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.126.60
Sep  2 17:46:10 nativespace-cdp sshd[1463134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.214.159.245  user=root
Sep  2 17:46:10 nativespace-cdp sshd[1463134]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 17:46:11 nativespace-cdp sshd[1463131]: Failed password for invalid user da from 157.245.126.60 port 47442 ssh2
Sep  2 17:46:11 nativespace-cdp sshd[1463131]: Received disconnect from 157.245.126.60 port 47442:11: Bye Bye [preauth]
Sep  2 17:46:11 nativespace-cdp sshd[1463131]: Disconnected from 157.245.126.60 port 47442 [preauth]
Sep  2 17:46:13 nativespace-cdp sshd[1463134]: Failed password for root from 20.214.159.245 port 48326 ssh2
Sep  2 17:46:17 nativespace-cdp sshd[1463184]: Invalid user admin from 205.209.110.111 port 52450
Sep  2 17:46:17 nativespace-cdp sshd[1463184]: input_userauth_request: invalid user admin [preauth]
Sep  2 17:46:17 nativespace-cdp sshd[1463184]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:46:17 nativespace-cdp sshd[1463184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=205.209.110.111
Sep  2 17:46:19 nativespace-cdp sshd[1463184]: Failed password for invalid user admin from 205.209.110.111 port 52450 ssh2
Sep  2 17:46:19 nativespace-cdp sshd[1463184]: Received disconnect from 205.209.110.111 port 52450:11: Bye Bye [preauth]
Sep  2 17:46:19 nativespace-cdp sshd[1463184]: Disconnected from 205.209.110.111 port 52450 [preauth]
Sep  2 17:46:34 nativespace-cdp sshd[1463240]: Connection closed by 159.100.136.21 port 42108 [preauth]
Sep  2 17:50:13 nativespace-cdp sshd[1464076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.59.24.255  user=root
Sep  2 17:50:13 nativespace-cdp sshd[1464076]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 17:50:14 nativespace-cdp sshd[1464076]: Failed password for root from 116.59.24.255 port 47940 ssh2
Sep  2 17:50:15 nativespace-cdp sshd[1464076]: Received disconnect from 116.59.24.255 port 47940:11: Bye Bye [preauth]
Sep  2 17:50:15 nativespace-cdp sshd[1464076]: Disconnected from 116.59.24.255 port 47940 [preauth]
Sep  2 17:51:33 nativespace-cdp sshd[1464374]: Connection closed by 159.100.136.21 port 52078 [preauth]
Sep  2 17:52:00 nativespace-cdp sshd[1464451]: Invalid user vps from 123.30.249.49 port 52648
Sep  2 17:52:00 nativespace-cdp sshd[1464451]: input_userauth_request: invalid user vps [preauth]
Sep  2 17:52:00 nativespace-cdp sshd[1464451]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:52:00 nativespace-cdp sshd[1464451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.249.49
Sep  2 17:52:02 nativespace-cdp sshd[1464451]: Failed password for invalid user vps from 123.30.249.49 port 52648 ssh2
Sep  2 17:52:02 nativespace-cdp sshd[1464451]: Received disconnect from 123.30.249.49 port 52648:11: Bye Bye [preauth]
Sep  2 17:52:02 nativespace-cdp sshd[1464451]: Disconnected from 123.30.249.49 port 52648 [preauth]
Sep  2 17:52:06 nativespace-cdp sshd[1464562]: Invalid user wlantest from 205.209.110.111 port 34612
Sep  2 17:52:06 nativespace-cdp sshd[1464562]: input_userauth_request: invalid user wlantest [preauth]
Sep  2 17:52:06 nativespace-cdp sshd[1464562]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:52:06 nativespace-cdp sshd[1464562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=205.209.110.111
Sep  2 17:52:08 nativespace-cdp sshd[1464562]: Failed password for invalid user wlantest from 205.209.110.111 port 34612 ssh2
Sep  2 17:52:08 nativespace-cdp sshd[1464562]: Received disconnect from 205.209.110.111 port 34612:11: Bye Bye [preauth]
Sep  2 17:52:08 nativespace-cdp sshd[1464562]: Disconnected from 205.209.110.111 port 34612 [preauth]
Sep  2 17:52:20 nativespace-cdp sshd[1464615]: Invalid user tabadmin from 157.245.126.60 port 48928
Sep  2 17:52:20 nativespace-cdp sshd[1464615]: input_userauth_request: invalid user tabadmin [preauth]
Sep  2 17:52:20 nativespace-cdp sshd[1464615]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:52:20 nativespace-cdp sshd[1464615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.126.60
Sep  2 17:52:23 nativespace-cdp sshd[1464615]: Failed password for invalid user tabadmin from 157.245.126.60 port 48928 ssh2
Sep  2 17:52:23 nativespace-cdp sshd[1464615]: Received disconnect from 157.245.126.60 port 48928:11: Bye Bye [preauth]
Sep  2 17:52:23 nativespace-cdp sshd[1464615]: Disconnected from 157.245.126.60 port 48928 [preauth]
Sep  2 17:52:50 nativespace-cdp sshd[1464684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.249.49  user=root
Sep  2 17:52:50 nativespace-cdp sshd[1464684]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 17:52:51 nativespace-cdp sshd[1464690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=205.209.110.111  user=root
Sep  2 17:52:51 nativespace-cdp sshd[1464690]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 17:52:52 nativespace-cdp sshd[1464684]: Failed password for root from 123.30.249.49 port 60460 ssh2
Sep  2 17:52:53 nativespace-cdp sshd[1464690]: Failed password for root from 205.209.110.111 port 39802 ssh2
Sep  2 17:52:53 nativespace-cdp sshd[1464690]: Received disconnect from 205.209.110.111 port 39802:11: Bye Bye [preauth]
Sep  2 17:52:53 nativespace-cdp sshd[1464690]: Disconnected from 205.209.110.111 port 39802 [preauth]
Sep  2 17:52:56 nativespace-cdp sshd[1464741]: Invalid user gert from 51.15.4.140 port 54780
Sep  2 17:52:56 nativespace-cdp sshd[1464741]: input_userauth_request: invalid user gert [preauth]
Sep  2 17:52:56 nativespace-cdp sshd[1464741]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:52:56 nativespace-cdp sshd[1464741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.4.140
Sep  2 17:52:59 nativespace-cdp sshd[1464741]: Failed password for invalid user gert from 51.15.4.140 port 54780 ssh2
Sep  2 17:52:59 nativespace-cdp sshd[1464741]: Received disconnect from 51.15.4.140 port 54780:11: Bye Bye [preauth]
Sep  2 17:52:59 nativespace-cdp sshd[1464741]: Disconnected from 51.15.4.140 port 54780 [preauth]
Sep  2 17:53:02 nativespace-cdp sshd[1464780]: Invalid user saeed from 157.245.126.60 port 52754
Sep  2 17:53:02 nativespace-cdp sshd[1464780]: input_userauth_request: invalid user saeed [preauth]
Sep  2 17:53:02 nativespace-cdp sshd[1464780]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:53:02 nativespace-cdp sshd[1464780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.126.60
Sep  2 17:53:03 nativespace-cdp sshd[1464780]: Failed password for invalid user saeed from 157.245.126.60 port 52754 ssh2
Sep  2 17:53:04 nativespace-cdp sshd[1464780]: Received disconnect from 157.245.126.60 port 52754:11: Bye Bye [preauth]
Sep  2 17:53:04 nativespace-cdp sshd[1464780]: Disconnected from 157.245.126.60 port 52754 [preauth]
Sep  2 17:53:38 nativespace-cdp sshd[1464911]: Invalid user user from 51.15.4.140 port 58550
Sep  2 17:53:38 nativespace-cdp sshd[1464911]: input_userauth_request: invalid user user [preauth]
Sep  2 17:53:38 nativespace-cdp sshd[1464911]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 17:53:38 nativespace-cdp sshd[1464911]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.4.140
Sep  2 17:53:40 nativespace-cdp sshd[1464911]: Failed password for invalid user user from 51.15.4.140 port 58550 ssh2
Sep  2 17:53:40 nativespace-cdp sshd[1464911]: Received disconnect from 51.15.4.140 port 58550:11: Bye Bye [preauth]
Sep  2 17:53:40 nativespace-cdp sshd[1464911]: Disconnected from 51.15.4.140 port 58550 [preauth]
Sep  2 17:56:33 nativespace-cdp sshd[1465849]: Connection closed by 159.100.136.21 port 34120 [preauth]
Sep  2 18:01:33 nativespace-cdp sshd[1467040]: Connection closed by 159.100.136.21 port 44118 [preauth]
Sep  2 18:02:02 nativespace-cdp sshd[1467166]: Invalid user air from 116.59.24.255 port 46208
Sep  2 18:02:02 nativespace-cdp sshd[1467166]: input_userauth_request: invalid user air [preauth]
Sep  2 18:02:02 nativespace-cdp sshd[1467166]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 18:02:02 nativespace-cdp sshd[1467166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.59.24.255
Sep  2 18:02:05 nativespace-cdp sshd[1467166]: Failed password for invalid user air from 116.59.24.255 port 46208 ssh2
Sep  2 18:02:05 nativespace-cdp sshd[1467166]: Received disconnect from 116.59.24.255 port 46208:11: Bye Bye [preauth]
Sep  2 18:02:05 nativespace-cdp sshd[1467166]: Disconnected from 116.59.24.255 port 46208 [preauth]
Sep  2 18:06:33 nativespace-cdp sshd[1468279]: Connection closed by 159.100.136.21 port 54408 [preauth]
Sep  2 18:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 18:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:31 nativespace-cdp sudo[1468918]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 18:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:31 nativespace-cdp sudo[1468921]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 18:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:33 nativespace-cdp sudo[1468925]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 18:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:33 nativespace-cdp sudo[1468935]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 18:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:36 nativespace-cdp sudo[1468938]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 18:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:36 nativespace-cdp sudo[1468948]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 18:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:36 nativespace-cdp sudo[1468951]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 18:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:36 nativespace-cdp sudo[1468954]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 18:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:36 nativespace-cdp sudo[1468957]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 18:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:36 nativespace-cdp sudo[1468960]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 18:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:36 nativespace-cdp sudo[1468963]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:39 nativespace-cdp sudo[1468977]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:39 nativespace-cdp sudo[1468981]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=southlon user-2=highlegh user-3=firstred user-4=costestimatorco user-5=firstrel user-6=clarkass user-7=opaiscyx user-8=coursemc user-9=firstres user-10=seftvta user-11=jonhartl user-12=ultbcrra user-13=thqkgnbz user-14=connectedshoppin user-15=ianrayne user-16=accooper user-17=carsinyo user-18=fetch user-19=hubmaster user-20=putterfi user-21=elecleis user-22=gilpin user-23=milloyco user-24=bemadonn user-25=belle user-26=ggaaorgu user-27=newstoda user-28=bedfords user-29=battlere user-30=oneoarco user-31=firstre2 user-32=vivienn1 user-33=brighto1 user-34=nstriton user-35=nativene user-36=stuartge user-37=askhform user-38=innovat1 user-39=alexadmin user-40=skyfirec user-41=ulsukarm user-42=maflemin user-43=lbscrmod user-44=connect9 user-45=athenare user-46=vantagep user-47=booff user-48=markward
Sep  2 18:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=foundation user-50=leereyn1 user-51=stephani user-52=still user-53=agproduc user-54=hodgesonweb user-55=theblack user-56=spectrum user-57=jarvisin user-58=musorguk user-59=megacards user-60=wilsonsw user-61=sarafoundation user-62=atestord user-63=strathar user-64=brmrjxl user-65=lakesan1 user-66=magichat user-67=lbhyisi user-68=hhdugcor user-69=ptkxhsbt user-70=dickemery123 user-71=martsblo user-72=nbhavers user-73=careers user-74=david user-75=mcdermos user-76=chrisdal user-77=jennimil user-78=tomandle user-79=romaldki user-80=branko user-81=hodgsonmail user-82=ranxterc user-83=outdoorc user-84=onlycont user-85=attlebor user-86=lucy user-87=sosevalu user-88=crrtipdl user-89=bakery user-90=boldover user-91=nove user-92=design user-93=kategilpin user-94=ladburyp user-95=dancinggardener user-96=stagingerris user-97=nvihkvu user-98=cath user-99=sketchy user-100=havantho user-101=what user-102=oubpgvbx
Sep  2 18:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=tstardom user-104=steve user-105=zebrapho user-106=bwppodcast user-107=sibtoncc user-108=asandcoc user-109=dhyana user-110=eatspam user-111=darkstar user-112=beauty user-113=nsceres user-114=burydropin user-115=fawcettd user-116=tigerlet user-117=barbersh user-118=hidden user-119=nomistakes user-120=isleofwi user-121=smrszyqg user-122=philmcph user-123=ctedorgu user-124=donnychicago user-125=firstre5 user-126=steakbridieme user-127=lkpier user-128=health2045 user-129=fortunaz user-130=foods user-131=leftie user-132=putterfc user-133=nscdp user-134=courseme user-135=eugincou user-136=hirefootballgame user-137=paulmca1 user-138=pugwash user-139=howardon user-140=cwsocial user-141=reliable user-142=ninejimm user-143=cambria1 user-144=cathski feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 18:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:41 nativespace-cdp sudo[1468986]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:41 nativespace-cdp sudo[1469001]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-i9EOOG8tFXAaZmmw.~
Sep  2 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:41 nativespace-cdp sudo[1469004]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-i9EOOG8tFXAaZmmw.~'
Sep  2 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:41 nativespace-cdp sudo[1469007]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-i9EOOG8tFXAaZmmw.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:41 nativespace-cdp sudo[1469012]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:41 nativespace-cdp sudo[1469015]: pam_unix(sudo:session): session closed for user root
Sep  2 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 18:09:43 nativespace-cdp sudo[1469038]: pam_unix(sudo:session): session closed for user root
Sep  2 18:11:33 nativespace-cdp sshd[1469519]: Connection closed by 159.100.136.21 port 36168 [preauth]
Sep  2 18:16:33 nativespace-cdp sshd[1470923]: Connection closed by 159.100.136.21 port 46370 [preauth]
Sep  2 18:21:33 nativespace-cdp sshd[1472102]: Connection closed by 159.100.136.21 port 56340 [preauth]
Sep  2 18:21:59 nativespace-cdp sshd[1472195]: Invalid user test from 116.59.24.255 port 37592
Sep  2 18:21:59 nativespace-cdp sshd[1472195]: input_userauth_request: invalid user test [preauth]
Sep  2 18:21:59 nativespace-cdp sshd[1472195]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 18:21:59 nativespace-cdp sshd[1472195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.59.24.255
Sep  2 18:22:01 nativespace-cdp sshd[1472195]: Failed password for invalid user test from 116.59.24.255 port 37592 ssh2
Sep  2 18:22:01 nativespace-cdp sshd[1472195]: Received disconnect from 116.59.24.255 port 37592:11: Bye Bye [preauth]
Sep  2 18:22:01 nativespace-cdp sshd[1472195]: Disconnected from 116.59.24.255 port 37592 [preauth]
Sep  2 18:26:33 nativespace-cdp sshd[1473529]: Connection closed by 159.100.136.21 port 38358 [preauth]
Sep  2 18:31:33 nativespace-cdp sshd[1474734]: Connection closed by 159.100.136.21 port 48392 [preauth]
Sep  2 18:36:33 nativespace-cdp sshd[1475845]: Connection closed by 159.100.136.21 port 57896 [preauth]
Sep  2 18:41:33 nativespace-cdp sshd[1477308]: Connection closed by 159.100.136.21 port 39628 [preauth]
Sep  2 18:46:33 nativespace-cdp sshd[1478581]: Connection closed by 159.100.136.21 port 49856 [preauth]
Sep  2 18:49:37 nativespace-cdp sshd[1408200]: pam_unix(sshd:session): session closed for user root
Sep  2 18:51:33 nativespace-cdp sshd[1479666]: Connection closed by 159.100.136.21 port 59868 [preauth]
Sep  2 18:56:33 nativespace-cdp sshd[1480831]: Connection closed by 159.100.136.21 port 41904 [preauth]
Sep  2 19:01:33 nativespace-cdp sshd[1482231]: Connection closed by 159.100.136.21 port 51856 [preauth]
Sep  2 19:06:33 nativespace-cdp sshd[1483513]: Connection closed by 159.100.136.21 port 33954 [preauth]
Sep  2 19:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 19:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:27 nativespace-cdp sudo[1484218]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 19:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:27 nativespace-cdp sudo[1484223]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 19:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:28 nativespace-cdp sudo[1484228]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 19:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:28 nativespace-cdp sudo[1484235]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 19:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:31 nativespace-cdp sudo[1484241]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 19:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:31 nativespace-cdp sudo[1484258]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 19:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:31 nativespace-cdp sudo[1484263]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 19:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:31 nativespace-cdp sudo[1484267]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 19:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:31 nativespace-cdp sudo[1484272]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 19:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:31 nativespace-cdp sudo[1484278]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 19:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:32 nativespace-cdp sudo[1484284]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 19:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:34 nativespace-cdp sudo[1484294]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 19:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:34 nativespace-cdp sudo[1484302]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=wilsonsw user-2=megacards user-3=musorguk user-4=lakesan1 user-5=brmrjxl user-6=strathar user-7=atestord user-8=sarafoundation user-9=hhdugcor user-10=lbhyisi user-11=magichat user-12=martsblo user-13=dickemery123 user-14=ptkxhsbt user-15=ulsukarm user-16=foundation user-17=booff user-18=markward user-19=vantagep user-20=connect9 user-21=athenare user-22=lbscrmod user-23=maflemin user-24=agproduc user-25=still user-26=stephani user-27=leereyn1 user-28=jarvisin user-29=spectrum user-30=hodgesonweb user-31=theblack user-32=bedfords user-33=newstoda user-34=ggaaorgu user-35=belle user-36=bemadonn user-37=nstriton user-38=brighto1 user-39=vivienn1 user-40=firstre2 user-41=oneoarco user-42=battlere user-43=innovat1 user-44=stuartge user-45=askhform user-46=nativene user-47=alexadmin user-48=skyfirec
Sep  2 19:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=clarkass user-50=firstrel user-51=costestimatorco user-52=firstred user-53=highlegh user-54=southlon user-55=ultbcrra user-56=seftvta user-57=jonhartl user-58=firstres user-59=coursemc user-60=opaiscyx user-61=accooper user-62=ianrayne user-63=connectedshoppin user-64=thqkgnbz user-65=gilpin user-66=milloyco user-67=elecleis user-68=putterfi user-69=hubmaster user-70=fetch user-71=carsinyo user-72=smrszyqg user-73=isleofwi user-74=nomistakes user-75=hidden user-76=tigerlet user-77=barbersh user-78=nscdp user-79=putterfc user-80=foods user-81=leftie user-82=fortunaz user-83=health2045 user-84=lkpier user-85=donnychicago user-86=steakbridieme user-87=firstre5 user-88=philmcph user-89=ctedorgu user-90=hirefootballgame user-91=eugincou user-92=courseme user-93=cathski user-94=cambria1 user-95=ninejimm user-96=reliable user-97=cwsocial user-98=paulmca1 user-99=howardon user-100=pugwash user-101=bwppodcast
Sep  2 19:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=zebrapho user-103=steve user-104=asandcoc user-105=sibtoncc user-106=beauty user-107=darkstar user-108=eatspam user-109=dhyana user-110=fawcettd user-111=burydropin user-112=nsceres user-113=bakery user-114=crrtipdl user-115=sosevalu user-116=nove user-117=boldover user-118=stagingerris user-119=dancinggardener user-120=ladburyp user-121=kategilpin user-122=design user-123=tstardom user-124=oubpgvbx user-125=what user-126=havantho user-127=sketchy user-128=cath user-129=nvihkvu user-130=chrisdal user-131=mcdermos user-132=david user-133=careers user-134=nbhavers user-135=tomandle user-136=jennimil user-137=hodgsonmail user-138=ranxterc user-139=outdoorc user-140=branko user-141=romaldki user-142=lucy user-143=attlebor user-144=onlycont feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 19:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 19:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:35 nativespace-cdp sudo[1484310]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:36 nativespace-cdp sudo[1484322]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-TI0jlZ2tOBEAT51z.~
Sep  2 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:36 nativespace-cdp sudo[1484328]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-TI0jlZ2tOBEAT51z.~'
Sep  2 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:36 nativespace-cdp sudo[1484332]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-TI0jlZ2tOBEAT51z.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:36 nativespace-cdp sudo[1484338]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:36 nativespace-cdp sudo[1484344]: pam_unix(sudo:session): session closed for user root
Sep  2 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 19:09:37 nativespace-cdp sudo[1484364]: pam_unix(sudo:session): session closed for user root
Sep  2 19:11:33 nativespace-cdp sshd[1484979]: Connection closed by 159.100.136.21 port 43912 [preauth]
Sep  2 19:14:39 nativespace-cdp sshd[1485853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.250.94.62  user=root
Sep  2 19:14:39 nativespace-cdp sshd[1485853]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 19:14:41 nativespace-cdp sshd[1485853]: Failed password for root from 60.250.94.62 port 48714 ssh2
Sep  2 19:14:41 nativespace-cdp sshd[1485853]: Received disconnect from 60.250.94.62 port 48714:11: Bye Bye [preauth]
Sep  2 19:14:41 nativespace-cdp sshd[1485853]: Disconnected from 60.250.94.62 port 48714 [preauth]
Sep  2 19:16:33 nativespace-cdp sshd[1486772]: Connection closed by 159.100.136.21 port 54036 [preauth]
Sep  2 19:18:21 nativespace-cdp sshd[1487166]: Invalid user hui from 201.16.147.253 port 46242
Sep  2 19:18:21 nativespace-cdp sshd[1487166]: input_userauth_request: invalid user hui [preauth]
Sep  2 19:18:21 nativespace-cdp sshd[1487166]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 19:18:21 nativespace-cdp sshd[1487166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.16.147.253
Sep  2 19:18:23 nativespace-cdp sshd[1487166]: Failed password for invalid user hui from 201.16.147.253 port 46242 ssh2
Sep  2 19:18:23 nativespace-cdp sshd[1487166]: Received disconnect from 201.16.147.253 port 46242:11: Bye Bye [preauth]
Sep  2 19:18:23 nativespace-cdp sshd[1487166]: Disconnected from 201.16.147.253 port 46242 [preauth]
Sep  2 19:18:50 nativespace-cdp sshd[1487248]: Invalid user herman from 60.250.94.62 port 37557
Sep  2 19:18:50 nativespace-cdp sshd[1487248]: input_userauth_request: invalid user herman [preauth]
Sep  2 19:18:50 nativespace-cdp sshd[1487248]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 19:18:50 nativespace-cdp sshd[1487248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.250.94.62
Sep  2 19:18:52 nativespace-cdp sshd[1487248]: Failed password for invalid user herman from 60.250.94.62 port 37557 ssh2
Sep  2 19:18:52 nativespace-cdp sshd[1487248]: Received disconnect from 60.250.94.62 port 37557:11: Bye Bye [preauth]
Sep  2 19:18:52 nativespace-cdp sshd[1487248]: Disconnected from 60.250.94.62 port 37557 [preauth]
Sep  2 19:19:48 nativespace-cdp sshd[1487413]: Invalid user ubuntu from 60.250.94.62 port 44345
Sep  2 19:19:48 nativespace-cdp sshd[1487413]: input_userauth_request: invalid user ubuntu [preauth]
Sep  2 19:19:48 nativespace-cdp sshd[1487413]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 19:19:48 nativespace-cdp sshd[1487413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.250.94.62
Sep  2 19:19:50 nativespace-cdp sshd[1487413]: Failed password for invalid user ubuntu from 60.250.94.62 port 44345 ssh2
Sep  2 19:19:50 nativespace-cdp sshd[1487413]: Received disconnect from 60.250.94.62 port 44345:11: Bye Bye [preauth]
Sep  2 19:19:50 nativespace-cdp sshd[1487413]: Disconnected from 60.250.94.62 port 44345 [preauth]
Sep  2 19:20:26 nativespace-cdp sshd[1487710]: Invalid user admin from 201.16.147.253 port 49566
Sep  2 19:20:26 nativespace-cdp sshd[1487710]: input_userauth_request: invalid user admin [preauth]
Sep  2 19:20:26 nativespace-cdp sshd[1487710]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 19:20:26 nativespace-cdp sshd[1487710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.16.147.253
Sep  2 19:20:28 nativespace-cdp sshd[1487710]: Failed password for invalid user admin from 201.16.147.253 port 49566 ssh2
Sep  2 19:20:29 nativespace-cdp sshd[1487710]: Received disconnect from 201.16.147.253 port 49566:11: Bye Bye [preauth]
Sep  2 19:20:29 nativespace-cdp sshd[1487710]: Disconnected from 201.16.147.253 port 49566 [preauth]
Sep  2 19:21:11 nativespace-cdp sshd[1487822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.16.147.253  user=root
Sep  2 19:21:11 nativespace-cdp sshd[1487822]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 19:21:13 nativespace-cdp sshd[1487822]: Failed password for root from 201.16.147.253 port 54696 ssh2
Sep  2 19:21:33 nativespace-cdp sshd[1487903]: Connection closed by 159.100.136.21 port 35530 [preauth]
Sep  2 19:26:33 nativespace-cdp sshd[1489331]: Connection closed by 159.100.136.21 port 45820 [preauth]
Sep  2 19:31:33 nativespace-cdp sshd[1490687]: Connection closed by 159.100.136.21 port 55836 [preauth]
Sep  2 19:36:33 nativespace-cdp sshd[1491694]: Connection closed by 159.100.136.21 port 37944 [preauth]
Sep  2 19:41:33 nativespace-cdp sshd[1493741]: Connection closed by 159.100.136.21 port 47934 [preauth]
Sep  2 19:46:33 nativespace-cdp sshd[1496749]: Connection closed by 159.100.136.21 port 58154 [preauth]
Sep  2 19:51:33 nativespace-cdp sshd[1498000]: Connection closed by 159.100.136.21 port 39942 [preauth]
Sep  2 19:56:33 nativespace-cdp sshd[1499309]: Connection closed by 159.100.136.21 port 50254 [preauth]
Sep  2 20:01:33 nativespace-cdp sshd[1500772]: Connection closed by 159.100.136.21 port 60254 [preauth]
Sep  2 20:06:33 nativespace-cdp sshd[1502000]: Connection closed by 159.100.136.21 port 42372 [preauth]
Sep  2 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:35 nativespace-cdp sudo[1502678]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:35 nativespace-cdp sudo[1502683]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:36 nativespace-cdp sudo[1502688]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:36 nativespace-cdp sudo[1502696]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:40 nativespace-cdp sudo[1502702]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:40 nativespace-cdp sudo[1502724]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:40 nativespace-cdp sudo[1502729]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:40 nativespace-cdp sudo[1502734]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:40 nativespace-cdp sudo[1502739]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:40 nativespace-cdp sudo[1502744]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:40 nativespace-cdp sudo[1502750]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 20:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:44 nativespace-cdp sudo[1502767]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 20:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:44 nativespace-cdp sudo[1502776]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=wilsonsw user-2=megacards user-3=musorguk user-4=brmrjxl user-5=lakesan1 user-6=atestord user-7=sarafoundation user-8=strathar user-9=hhdugcor user-10=lbhyisi user-11=magichat user-12=martsblo user-13=ptkxhsbt user-14=dickemery123 user-15=ulsukarm user-16=booff user-17=foundation user-18=markward user-19=lbscrmod user-20=maflemin user-21=vantagep user-22=connect9 user-23=athenare user-24=agproduc user-25=still user-26=leereyn1 user-27=stephani user-28=jarvisin user-29=hodgesonweb user-30=theblack user-31=spectrum user-32=bedfords user-33=bemadonn user-34=newstoda user-35=belle user-36=ggaaorgu user-37=nstriton user-38=brighto1 user-39=oneoarco user-40=battlere user-41=vivienn1 user-42=firstre2 user-43=askhform user-44=stuartge user-45=innovat1 user-46=nativene user-47=alexadmin user-48=skyfirec
Sep  2 20:09:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=highlegh user-53=southlon user-54=firstred user-55=firstres user-56=ultbcrra user-57=seftvta user-58=jonhartl user-59=coursemc user-60=opaiscyx user-61=ianrayne user-62=accooper user-63=thqkgnbz user-64=connectedshoppin user-65=elecleis user-66=milloyco user-67=gilpin user-68=fetch user-69=carsinyo user-70=putterfi user-71=hubmaster user-72=isleofwi user-73=smrszyqg user-74=tigerlet user-75=barbersh user-76=nomistakes user-77=hidden user-78=leftie user-79=foods user-80=fortunaz user-81=health2045 user-82=nscdp user-83=putterfc user-84=steakbridieme user-85=donnychicago user-86=firstre5 user-87=philmcph user-88=ctedorgu user-89=lkpier user-90=hirefootballgame user-91=courseme user-92=eugincou user-93=ninejimm user-94=reliable user-95=cathski user-96=cambria1 user-97=cwsocial user-98=howardon user-99=paulmca1 user-100=pugwash user-101=zebrapho
Sep  2 20:09:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=bwppodcast user-103=steve user-104=sibtoncc user-105=asandcoc user-106=darkstar user-107=eatspam user-108=beauty user-109=dhyana user-110=fawcettd user-111=burydropin user-112=nsceres user-113=crrtipdl user-114=sosevalu user-115=bakery user-116=nove user-117=boldover user-118=kategilpin user-119=stagingerris user-120=dancinggardener user-121=ladburyp user-122=design user-123=what user-124=tstardom user-125=oubpgvbx user-126=nvihkvu user-127=havantho user-128=cath user-129=sketchy user-130=mcdermos user-131=chrisdal user-132=david user-133=nbhavers user-134=careers user-135=tomandle user-136=jennimil user-137=branko user-138=outdoorc user-139=hodgsonmail user-140=ranxterc user-141=romaldki user-142=lucy user-143=attlebor user-144=onlycont feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 20:09:44 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 20:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:45 nativespace-cdp sudo[1502785]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 20:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:46 nativespace-cdp sudo[1502792]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1jz1on6neVT23Lkm.~
Sep  2 20:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:46 nativespace-cdp sudo[1502797]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1jz1on6neVT23Lkm.~'
Sep  2 20:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:46 nativespace-cdp sudo[1502802]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1jz1on6neVT23Lkm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 20:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:46 nativespace-cdp sudo[1502808]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 20:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:46 nativespace-cdp sudo[1502813]: pam_unix(sudo:session): session closed for user root
Sep  2 20:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 20:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 20:09:48 nativespace-cdp sudo[1502837]: pam_unix(sudo:session): session closed for user root
Sep  2 20:11:33 nativespace-cdp sshd[1503581]: Connection closed by 159.100.136.21 port 52376 [preauth]
Sep  2 20:16:33 nativespace-cdp sshd[1504750]: Connection closed by 159.100.136.21 port 34352 [preauth]
Sep  2 20:21:33 nativespace-cdp sshd[1505891]: Connection closed by 159.100.136.21 port 44348 [preauth]
Sep  2 20:26:33 nativespace-cdp sshd[1507308]: Connection closed by 159.100.136.21 port 54634 [preauth]
Sep  2 20:31:34 nativespace-cdp sshd[1508481]: Connection closed by 159.100.136.21 port 36488 [preauth]
Sep  2 20:36:33 nativespace-cdp sshd[1509586]: Connection closed by 159.100.136.21 port 46766 [preauth]
Sep  2 20:41:33 nativespace-cdp sshd[1511023]: Connection closed by 159.100.136.21 port 56776 [preauth]
Sep  2 20:46:33 nativespace-cdp sshd[1512202]: Connection closed by 159.100.136.21 port 38784 [preauth]
Sep  2 20:51:33 nativespace-cdp sshd[1513367]: Connection closed by 159.100.136.21 port 48808 [preauth]
Sep  2 20:56:33 nativespace-cdp sshd[1514619]: Connection closed by 159.100.136.21 port 59084 [preauth]
Sep  2 21:01:33 nativespace-cdp sshd[1516028]: Connection closed by 159.100.136.21 port 40872 [preauth]
Sep  2 21:06:33 nativespace-cdp sshd[1517175]: Connection closed by 159.100.136.21 port 51206 [preauth]
Sep  2 21:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 21:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:35 nativespace-cdp sudo[1517932]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 21:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:35 nativespace-cdp sudo[1517937]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 21:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:36 nativespace-cdp sudo[1517942]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 21:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:37 nativespace-cdp sudo[1517950]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 21:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:39 nativespace-cdp sudo[1517956]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 21:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:39 nativespace-cdp sudo[1517971]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 21:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:39 nativespace-cdp sudo[1517976]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 21:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:39 nativespace-cdp sudo[1517981]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 21:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:39 nativespace-cdp sudo[1517986]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 21:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:39 nativespace-cdp sudo[1517991]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 21:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:39 nativespace-cdp sudo[1517997]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:41 nativespace-cdp sudo[1518009]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:42 nativespace-cdp sudo[1518015]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tigerlet user-2=barbersh user-3=nomistakes user-4=hidden user-5=isleofwi user-6=smrszyqg user-7=donnychicago user-8=steakbridieme user-9=firstre5 user-10=philmcph user-11=ctedorgu user-12=lkpier user-13=leftie user-14=foods user-15=health2045 user-16=fortunaz user-17=nscdp user-18=putterfc user-19=courseme user-20=eugincou user-21=hirefootballgame user-22=cwsocial user-23=pugwash user-24=paulmca1 user-25=howardon user-26=ninejimm user-27=reliable user-28=cambria1 user-29=cathski user-30=steve user-31=zebrapho user-32=bwppodcast user-33=sibtoncc user-34=asandcoc user-35=dhyana user-36=darkstar user-37=eatspam user-38=beauty user-39=nsceres user-40=fawcettd user-41=burydropin user-42=crrtipdl user-43=sosevalu user-44=bakery user-45=boldover user-46=nove user-47=design user-48=kategilpin
Sep  2 21:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=dancinggardener user-50=stagingerris user-51=ladburyp user-52=nvihkvu user-53=havantho user-54=sketchy user-55=cath user-56=what user-57=oubpgvbx user-58=tstardom user-59=david user-60=nbhavers user-61=careers user-62=mcdermos user-63=chrisdal user-64=jennimil user-65=tomandle user-66=romaldki user-67=branko user-68=hodgsonmail user-69=outdoorc user-70=ranxterc user-71=onlycont user-72=lucy user-73=attlebor user-74=megacards user-75=musorguk user-76=wilsonsw user-77=atestord user-78=sarafoundation user-79=strathar user-80=lakesan1 user-81=brmrjxl user-82=magichat user-83=hhdugcor user-84=lbhyisi user-85=ptkxhsbt user-86=dickemery123 user-87=martsblo user-88=ulsukarm user-89=lbscrmod user-90=maflemin user-91=vantagep user-92=connect9 user-93=athenare user-94=booff user-95=foundation user-96=markward user-97=leereyn1 user-98=stephani user-99=agproduc user-100=still user-101=hodgesonweb user-102=theblack
Sep  2 21:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=spectrum user-104=jarvisin user-105=bemadonn user-106=newstoda user-107=ggaaorgu user-108=belle user-109=bedfords user-110=oneoarco user-111=battlere user-112=vivienn1 user-113=firstre2 user-114=nstriton user-115=brighto1 user-116=nativene user-117=stuartge user-118=askhform user-119=innovat1 user-120=skyfirec user-121=alexadmin user-122=highlegh user-123=southlon user-124=firstred user-125=costestimatorco user-126=clarkass user-127=firstrel user-128=opaiscyx user-129=coursemc user-130=firstres user-131=ultbcrra user-132=seftvta user-133=jonhartl user-134=thqkgnbz user-135=connectedshoppin user-136=ianrayne user-137=accooper user-138=fetch user-139=carsinyo user-140=hubmaster user-141=putterfi user-142=elecleis user-143=gilpin user-144=milloyco feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 21:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:43 nativespace-cdp sudo[1518023]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:43 nativespace-cdp sudo[1518034]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yQ6bbHfS4S8av0W9.~
Sep  2 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:43 nativespace-cdp sudo[1518040]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yQ6bbHfS4S8av0W9.~'
Sep  2 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:43 nativespace-cdp sudo[1518044]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yQ6bbHfS4S8av0W9.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:43 nativespace-cdp sudo[1518050]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:43 nativespace-cdp sudo[1518055]: pam_unix(sudo:session): session closed for user root
Sep  2 21:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 21:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:09:45 nativespace-cdp sudo[1518077]: pam_unix(sudo:session): session closed for user root
Sep  2 21:11:33 nativespace-cdp sshd[1518797]: Connection closed by 159.100.136.21 port 32986 [preauth]
Sep  2 21:16:33 nativespace-cdp sshd[1520090]: Connection closed by 159.100.136.21 port 43220 [preauth]
Sep  2 21:21:33 nativespace-cdp sshd[1521346]: Connection closed by 159.100.136.21 port 53230 [preauth]
Sep  2 21:26:33 nativespace-cdp sshd[1522774]: Connection closed by 159.100.136.21 port 35264 [preauth]
Sep  2 21:31:33 nativespace-cdp sshd[1524195]: Connection closed by 159.100.136.21 port 45334 [preauth]
Sep  2 21:36:33 nativespace-cdp sshd[1525390]: Connection closed by 159.100.136.21 port 55622 [preauth]
Sep  2 21:40:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 21:40:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:40:53 nativespace-cdp sudo[1526762]: pam_unix(sudo:session): session closed for user root
Sep  2 21:40:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status athenare
Sep  2 21:40:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:40:56 nativespace-cdp sudo[1526820]: pam_unix(sudo:session): session closed for user root
Sep  2 21:40:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 21:40:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:40:58 nativespace-cdp sudo[1526929]: pam_unix(sudo:session): session closed for user root
Sep  2 21:40:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status athenare
Sep  2 21:40:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:40:59 nativespace-cdp sudo[1526936]: pam_unix(sudo:session): session closed for user root
Sep  2 21:41:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 21:41:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:41:00 nativespace-cdp sudo[1526968]: pam_unix(sudo:session): session closed for user root
Sep  2 21:41:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status athenare
Sep  2 21:41:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:41:01 nativespace-cdp sudo[1526978]: pam_unix(sudo:session): session closed for user root
Sep  2 21:41:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 21:41:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:41:02 nativespace-cdp sudo[1527030]: pam_unix(sudo:session): session closed for user root
Sep  2 21:41:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status athenare
Sep  2 21:41:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:41:02 nativespace-cdp sudo[1527036]: pam_unix(sudo:session): session closed for user root
Sep  2 21:41:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 21:41:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:41:04 nativespace-cdp sudo[1527075]: pam_unix(sudo:session): session closed for user root
Sep  2 21:41:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bemadonn
Sep  2 21:41:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:41:04 nativespace-cdp sudo[1527079]: pam_unix(sudo:session): session closed for user root
Sep  2 21:41:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 21:41:59 nativespace-cdp sshd[1527231]: Did not receive identification string from 159.100.136.21 port 37378
Sep  2 21:42:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:42:13 nativespace-cdp sudo[1527156]: pam_unix(sudo:session): session closed for user root
Sep  2 21:42:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status design
Sep  2 21:42:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:42:27 nativespace-cdp sudo[1527405]: pam_unix(sudo:session): session closed for user root
Sep  2 21:43:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 21:43:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:43:20 nativespace-cdp sudo[1527722]: pam_unix(sudo:session): session closed for user root
Sep  2 21:43:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  2 21:43:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:43:21 nativespace-cdp sudo[1527727]: pam_unix(sudo:session): session closed for user root
Sep  2 21:43:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont Mime list_redirects --output=json
Sep  2 21:43:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:43:22 nativespace-cdp sudo[1527730]: pam_unix(sudo:session): session closed for user root
Sep  2 21:45:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 21:45:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:45:06 nativespace-cdp sudo[1528579]: pam_unix(sudo:session): session closed for user root
Sep  2 21:45:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status nomistakes
Sep  2 21:45:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 21:45:07 nativespace-cdp sudo[1528587]: pam_unix(sudo:session): session closed for user root
Sep  2 21:46:33 nativespace-cdp sshd[1529229]: Connection closed by 159.100.136.21 port 47584 [preauth]
Sep  2 21:51:33 nativespace-cdp sshd[1530502]: Connection closed by 159.100.136.21 port 57628 [preauth]
Sep  2 21:56:33 nativespace-cdp sshd[1531872]: Connection closed by 159.100.136.21 port 39674 [preauth]
Sep  2 22:00:39 nativespace-cdp sshd[1532927]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.222.240.106  user=root
Sep  2 22:00:39 nativespace-cdp sshd[1532927]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 22:00:40 nativespace-cdp sshd[1532927]: Failed password for root from 185.222.240.106 port 47366 ssh2
Sep  2 22:00:40 nativespace-cdp sshd[1532927]: Received disconnect from 185.222.240.106 port 47366:11: Bye Bye [preauth]
Sep  2 22:00:40 nativespace-cdp sshd[1532927]: Disconnected from 185.222.240.106 port 47366 [preauth]
Sep  2 22:00:45 nativespace-cdp sshd[1532945]: Invalid user guest from 194.164.18.160 port 34878
Sep  2 22:00:45 nativespace-cdp sshd[1532945]: input_userauth_request: invalid user guest [preauth]
Sep  2 22:00:45 nativespace-cdp sshd[1532945]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 22:00:45 nativespace-cdp sshd[1532945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.164.18.160
Sep  2 22:00:47 nativespace-cdp sshd[1532945]: Failed password for invalid user guest from 194.164.18.160 port 34878 ssh2
Sep  2 22:00:47 nativespace-cdp sshd[1532945]: Received disconnect from 194.164.18.160 port 34878:11: Bye Bye [preauth]
Sep  2 22:00:47 nativespace-cdp sshd[1532945]: Disconnected from 194.164.18.160 port 34878 [preauth]
Sep  2 22:01:33 nativespace-cdp sshd[1533239]: Connection closed by 159.100.136.21 port 49696 [preauth]
Sep  2 22:02:15 nativespace-cdp sshd[1533417]: Invalid user uru from 101.36.125.187 port 47026
Sep  2 22:02:15 nativespace-cdp sshd[1533417]: input_userauth_request: invalid user uru [preauth]
Sep  2 22:02:15 nativespace-cdp sshd[1533417]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 22:02:15 nativespace-cdp sshd[1533417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.36.125.187
Sep  2 22:02:18 nativespace-cdp sshd[1533417]: Failed password for invalid user uru from 101.36.125.187 port 47026 ssh2
Sep  2 22:02:18 nativespace-cdp sshd[1533417]: Received disconnect from 101.36.125.187 port 47026:11: Bye Bye [preauth]
Sep  2 22:02:18 nativespace-cdp sshd[1533417]: Disconnected from 101.36.125.187 port 47026 [preauth]
Sep  2 22:06:33 nativespace-cdp sshd[1534740]: Connection closed by 159.100.136.21 port 60004 [preauth]
Sep  2 22:07:49 nativespace-cdp sshd[1534923]: Invalid user mujeeb from 101.36.125.187 port 35678
Sep  2 22:07:49 nativespace-cdp sshd[1534923]: input_userauth_request: invalid user mujeeb [preauth]
Sep  2 22:07:49 nativespace-cdp sshd[1534923]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 22:07:49 nativespace-cdp sshd[1534923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.36.125.187
Sep  2 22:07:51 nativespace-cdp sshd[1534923]: Failed password for invalid user mujeeb from 101.36.125.187 port 35678 ssh2
Sep  2 22:07:52 nativespace-cdp sshd[1534923]: Received disconnect from 101.36.125.187 port 35678:11: Bye Bye [preauth]
Sep  2 22:07:52 nativespace-cdp sshd[1534923]: Disconnected from 101.36.125.187 port 35678 [preauth]
Sep  2 22:08:04 nativespace-cdp sshd[1534985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.222.240.106  user=root
Sep  2 22:08:04 nativespace-cdp sshd[1534985]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  2 22:08:06 nativespace-cdp sshd[1534985]: Failed password for root from 185.222.240.106 port 54462 ssh2
Sep  2 22:08:06 nativespace-cdp sshd[1534985]: Received disconnect from 185.222.240.106 port 54462:11: Bye Bye [preauth]
Sep  2 22:08:06 nativespace-cdp sshd[1534985]: Disconnected from 185.222.240.106 port 54462 [preauth]
Sep  2 22:08:21 nativespace-cdp sshd[1535032]: Invalid user smb from 194.164.18.160 port 48456
Sep  2 22:08:21 nativespace-cdp sshd[1535032]: input_userauth_request: invalid user smb [preauth]
Sep  2 22:08:21 nativespace-cdp sshd[1535032]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 22:08:21 nativespace-cdp sshd[1535032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.164.18.160
Sep  2 22:08:23 nativespace-cdp sshd[1535032]: Failed password for invalid user smb from 194.164.18.160 port 48456 ssh2
Sep  2 22:08:23 nativespace-cdp sshd[1535032]: Received disconnect from 194.164.18.160 port 48456:11: Bye Bye [preauth]
Sep  2 22:08:23 nativespace-cdp sshd[1535032]: Disconnected from 194.164.18.160 port 48456 [preauth]
Sep  2 22:08:38 nativespace-cdp sshd[1535063]: Invalid user alpha from 101.36.125.187 port 51226
Sep  2 22:08:38 nativespace-cdp sshd[1535063]: input_userauth_request: invalid user alpha [preauth]
Sep  2 22:08:38 nativespace-cdp sshd[1535063]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 22:08:38 nativespace-cdp sshd[1535063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.36.125.187
Sep  2 22:08:39 nativespace-cdp sshd[1535063]: Failed password for invalid user alpha from 101.36.125.187 port 51226 ssh2
Sep  2 22:08:40 nativespace-cdp sshd[1535063]: Received disconnect from 101.36.125.187 port 51226:11: Bye Bye [preauth]
Sep  2 22:08:40 nativespace-cdp sshd[1535063]: Disconnected from 101.36.125.187 port 51226 [preauth]
Sep  2 22:09:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 22:09:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:03 nativespace-cdp sudo[1535274]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 22:09:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:03 nativespace-cdp sudo[1535277]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 22:09:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:04 nativespace-cdp sudo[1535280]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 22:09:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:04 nativespace-cdp sudo[1535285]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 22:09:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:06 nativespace-cdp sshd[1535313]: Invalid user alpha from 194.164.18.160 port 53014
Sep  2 22:09:06 nativespace-cdp sshd[1535313]: input_userauth_request: invalid user alpha [preauth]
Sep  2 22:09:06 nativespace-cdp sshd[1535313]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 22:09:06 nativespace-cdp sshd[1535313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.164.18.160
Sep  2 22:09:07 nativespace-cdp sudo[1535288]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 22:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:07 nativespace-cdp sudo[1535333]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 22:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:07 nativespace-cdp sudo[1535338]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 22:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:07 nativespace-cdp sudo[1535343]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 22:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:07 nativespace-cdp sudo[1535348]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 22:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:07 nativespace-cdp sudo[1535353]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 22:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:07 nativespace-cdp sudo[1535361]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:08 nativespace-cdp sshd[1535313]: Failed password for invalid user alpha from 194.164.18.160 port 53014 ssh2
Sep  2 22:09:08 nativespace-cdp sshd[1535313]: Received disconnect from 194.164.18.160 port 53014:11: Bye Bye [preauth]
Sep  2 22:09:08 nativespace-cdp sshd[1535313]: Disconnected from 194.164.18.160 port 53014 [preauth]
Sep  2 22:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 22:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:09 nativespace-cdp sudo[1535395]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 22:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:09 nativespace-cdp sudo[1535402]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=howardon user-2=paulmca1 user-3=pugwash user-4=cwsocial user-5=reliable user-6=ninejimm user-7=cathski user-8=cambria1 user-9=courseme user-10=eugincou user-11=hirefootballgame user-12=philmcph user-13=ctedorgu user-14=steakbridieme user-15=donnychicago user-16=firstre5 user-17=lkpier user-18=fortunaz user-19=health2045 user-20=foods user-21=leftie user-22=putterfc user-23=nscdp user-24=tigerlet user-25=barbersh user-26=hidden user-27=nomistakes user-28=isleofwi user-29=smrszyqg user-30=nsceres user-31=burydropin user-32=fawcettd user-33=dhyana user-34=eatspam user-35=darkstar user-36=beauty user-37=sibtoncc user-38=asandcoc user-39=steve user-40=zebrapho user-41=bwppodcast user-42=nvihkvu user-43=sketchy user-44=cath user-45=havantho user-46=what user-47=tstardom user-48=oubpgvbx user-49=design
Sep  2 22:09:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=kategilpin user-51=ladburyp user-52=stagingerris user-53=dancinggardener user-54=boldover user-55=nove user-56=sosevalu user-57=crrtipdl user-58=bakery user-59=onlycont user-60=attlebor user-61=lucy user-62=romaldki user-63=branko user-64=ranxterc user-65=hodgsonmail user-66=outdoorc user-67=jennimil user-68=tomandle user-69=nbhavers user-70=careers user-71=david user-72=mcdermos user-73=chrisdal user-74=ptkxhsbt user-75=dickemery123 user-76=martsblo user-77=magichat user-78=lbhyisi user-79=hhdugcor user-80=sarafoundation user-81=atestord user-82=strathar user-83=brmrjxl user-84=lakesan1 user-85=musorguk user-86=megacards user-87=wilsonsw user-88=theblack user-89=hodgesonweb user-90=spectrum user-91=jarvisin user-92=leereyn1 user-93=stephani user-94=still user-95=agproduc user-96=maflemin user-97=lbscrmod user-98=athenare user-99=connect9 user-100=vantagep user-101=foundation user-102=booff
Sep  2 22:09:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=markward user-104=ulsukarm user-105=alexadmin user-106=skyfirec user-107=nativene user-108=askhform user-109=stuartge user-110=innovat1 user-111=battlere user-112=oneoarco user-113=firstre2 user-114=vivienn1 user-115=brighto1 user-116=nstriton user-117=bemadonn user-118=belle user-119=ggaaorgu user-120=newstoda user-121=bedfords user-122=carsinyo user-123=fetch user-124=hubmaster user-125=putterfi user-126=elecleis user-127=milloyco user-128=gilpin user-129=thqkgnbz user-130=connectedshoppin user-131=ianrayne user-132=accooper user-133=opaiscyx user-134=coursemc user-135=firstres user-136=seftvta user-137=jonhartl user-138=ultbcrra user-139=southlon user-140=highlegh user-141=firstred user-142=costestimatorco user-143=firstrel user-144=clarkass feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  2 22:09:09 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 22:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:10 nativespace-cdp sudo[1535411]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 22:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:11 nativespace-cdp sudo[1535440]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-QRU1yKysYh0iogAw.~
Sep  2 22:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:11 nativespace-cdp sudo[1535447]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-QRU1yKysYh0iogAw.~'
Sep  2 22:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:11 nativespace-cdp sudo[1535451]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-QRU1yKysYh0iogAw.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 22:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:11 nativespace-cdp sudo[1535459]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 22:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:11 nativespace-cdp sudo[1535470]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 22:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 22:09:13 nativespace-cdp sudo[1535502]: pam_unix(sudo:session): session closed for user root
Sep  2 22:09:19 nativespace-cdp sshd[1535533]: Invalid user ab from 185.222.240.106 port 33422
Sep  2 22:09:19 nativespace-cdp sshd[1535533]: input_userauth_request: invalid user ab [preauth]
Sep  2 22:09:19 nativespace-cdp sshd[1535533]: pam_unix(sshd:auth): check pass; user unknown
Sep  2 22:09:19 nativespace-cdp sshd[1535533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.222.240.106
Sep  2 22:09:22 nativespace-cdp sshd[1535533]: Failed password for invalid user ab from 185.222.240.106 port 33422 ssh2
Sep  2 22:11:33 nativespace-cdp sshd[1536314]: Connection closed by 159.100.136.21 port 41806 [preauth]
Sep  2 22:16:33 nativespace-cdp sshd[1537379]: Connection closed by 159.100.136.21 port 52010 [preauth]
Sep  2 22:21:33 nativespace-cdp sshd[1538423]: Connection closed by 159.100.136.21 port 33784 [preauth]
Sep  2 22:26:33 nativespace-cdp sshd[1539769]: Connection closed by 159.100.136.21 port 44088 [preauth]
Sep  2 22:31:33 nativespace-cdp sshd[1540977]: Connection closed by 159.100.136.21 port 54126 [preauth]
Sep  2 22:36:33 nativespace-cdp sshd[1542671]: Connection closed by 159.100.136.21 port 36218 [preauth]
Sep  2 22:41:33 nativespace-cdp sshd[1544503]: Connection closed by 159.100.136.21 port 46190 [preauth]
Sep  2 22:46:33 nativespace-cdp sshd[1545778]: Connection closed by 159.100.136.21 port 56416 [preauth]
Sep  2 22:51:33 nativespace-cdp sshd[1547043]: Connection closed by 159.100.136.21 port 38260 [preauth]
Sep  2 22:56:33 nativespace-cdp sshd[1548474]: Connection closed by 159.100.136.21 port 48572 [preauth]
Sep  2 23:01:33 nativespace-cdp sshd[1549757]: Connection closed by 159.100.136.21 port 58576 [preauth]
Sep  2 23:06:33 nativespace-cdp sshd[1550764]: Connection closed by 159.100.136.21 port 40688 [preauth]
Sep  2 23:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  2 23:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:09 nativespace-cdp sudo[1551360]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  2 23:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:09 nativespace-cdp sudo[1551364]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  2 23:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:10 nativespace-cdp sudo[1551369]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  2 23:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:10 nativespace-cdp sudo[1551376]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  2 23:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:16 nativespace-cdp sudo[1551383]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  2 23:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:16 nativespace-cdp sudo[1551404]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  2 23:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:16 nativespace-cdp sudo[1551409]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  2 23:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:16 nativespace-cdp sudo[1551413]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  2 23:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:16 nativespace-cdp sudo[1551418]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  2 23:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:16 nativespace-cdp sudo[1551424]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  2 23:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:16 nativespace-cdp sudo[1551429]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  2 23:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:18 nativespace-cdp sudo[1551439]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  2 23:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:18 nativespace-cdp sudo[1551445]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=oubpgvbx user-2=tstardom user-3=what user-4=havantho user-5=cath user-6=sketchy user-7=nvihkvu user-8=dancinggardener user-9=stagingerris user-10=ladburyp user-11=kategilpin user-12=design user-13=nove user-14=boldover user-15=bakery user-16=crrtipdl user-17=sosevalu user-18=lucy user-19=attlebor user-20=onlycont user-21=hodgsonmail user-22=ranxterc user-23=outdoorc user-24=branko user-25=romaldki user-26=tomandle user-27=jennimil user-28=chrisdal user-29=mcdermos user-30=david user-31=nbhavers user-32=careers user-33=cathski user-34=cambria1 user-35=ninejimm user-36=reliable user-37=cwsocial user-38=pugwash user-39=paulmca1 user-40=howardon user-41=hirefootballgame user-42=eugincou user-43=courseme user-44=nscdp user-45=putterfc user-46=foods user-47=leftie user-48=health2045 user-49=fortunaz
Sep  2 23:09:18 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=lkpier user-51=donnychicago user-52=firstre5 user-53=steakbridieme user-54=philmcph user-55=ctedorgu user-56=isleofwi user-57=smrszyqg user-58=nomistakes user-59=hidden user-60=tigerlet user-61=barbersh user-62=fawcettd user-63=burydropin user-64=nsceres user-65=beauty user-66=darkstar user-67=eatspam user-68=dhyana user-69=asandcoc user-70=sibtoncc user-71=bwppodcast user-72=zebrapho user-73=steve user-74=alexadmin user-75=skyfirec user-76=innovat1 user-77=askhform user-78=stuartge user-79=nativene user-80=nstriton user-81=brighto1 user-82=vivienn1 user-83=firstre2 user-84=oneoarco user-85=battlere user-86=bedfords user-87=newstoda user-88=belle user-89=ggaaorgu user-90=bemadonn user-91=milloyco user-92=gilpin user-93=elecleis user-94=hubmaster user-95=putterfi user-96=fetch user-97=carsinyo user-98=accooper user-99=ianrayne user-100=connectedshoppin user-101=thqkgnbz user-102=ultbcrra user-103=jonhartl
Sep  2 23:09:18 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=seftvta user-105=firstres user-106=opaiscyx user-107=coursemc user-108=firstrel user-109=clarkass user-110=costestimatorco user-111=firstred user-112=highlegh user-113=southlon user-114=martsblo user-115=dickemery123 user-116=ptkxhsbt user-117=hhdugcor user-118=lbhyisi user-119=magichat user-120=lakesan1 user-121=brmrjxl user-122=strathar user-123=atestord user-124=sarafoundation user-125=wilsonsw user-126=megacards user-127=musorguk user-128=jarvisin user-129=spectrum user-130=theblack user-131=hodgesonweb user-132=agproduc user-133=still user-134=stephani user-135=leereyn1 user-136=markward user-137=booff user-138=foundation user-139=vantagep user-140=connect9 user-141=athenare user-142=lbscrmod user-143=maflemin user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains feature-9=webprotect
Sep  2 23:09:18 nativespace-cdp sudo: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  2 23:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:19 nativespace-cdp sudo[1551452]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 23:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:19 nativespace-cdp sudo[1551473]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rut4YNgBjZkPgmnt.~
Sep  2 23:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:19 nativespace-cdp sudo[1551478]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rut4YNgBjZkPgmnt.~'
Sep  2 23:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:19 nativespace-cdp sudo[1551482]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rut4YNgBjZkPgmnt.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  2 23:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:19 nativespace-cdp sudo[1551488]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  2 23:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:19 nativespace-cdp sudo[1551493]: pam_unix(sudo:session): session closed for user root
Sep  2 23:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  2 23:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  2 23:09:21 nativespace-cdp sudo[1551515]: pam_unix(sudo:session): session closed for user root
Sep  2 23:11:33 nativespace-cdp sshd[1552147]: Connection closed by 159.100.136.21 port 50724 [preauth]
Sep  2 23:16:33 nativespace-cdp sshd[1553377]: Connection closed by 159.100.136.21 port 60956 [preauth]
Sep  2 23:21:33 nativespace-cdp sshd[1554414]: Connection closed by 159.100.136.21 port 42734 [preauth]
Sep  2 23:22:47 nativespace-cdp sshd[1554599]: Bad protocol version identification '\003' from 194.28.112.182 port 21496
Sep  2 23:22:47 nativespace-cdp sshd[1554600]: Bad protocol version identification '\003' from 194.28.112.182 port 22542
Sep  2 23:22:47 nativespace-cdp sshd[1554601]: Bad protocol version identification '\003' from 194.28.112.182 port 23384
Sep  2 23:26:33 nativespace-cdp sshd[1555451]: Connection closed by 159.100.136.21 port 53020 [preauth]
Sep  2 23:31:33 nativespace-cdp sshd[1556932]: Connection closed by 159.100.136.21 port 34818 [preauth]
Sep  2 23:36:33 nativespace-cdp sshd[1558039]: Connection closed by 159.100.136.21 port 45104 [preauth]
Sep  2 23:41:33 nativespace-cdp sshd[1559370]: Connection closed by 159.100.136.21 port 55050 [preauth]
Sep  2 23:46:33 nativespace-cdp sshd[1560395]: Connection closed by 159.100.136.21 port 37030 [preauth]
Sep  2 23:51:33 nativespace-cdp sshd[1561443]: Connection closed by 159.100.136.21 port 47040 [preauth]
Sep  2 23:56:33 nativespace-cdp sshd[1562849]: Connection closed by 159.100.136.21 port 57296 [preauth]
Sep  3 00:01:33 nativespace-cdp sshd[1564038]: Connection closed by 159.100.136.21 port 39044 [preauth]
Sep  3 00:06:33 nativespace-cdp sshd[1565154]: Connection closed by 159.100.136.21 port 49378 [preauth]
Sep  3 00:09:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 00:09:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:03 nativespace-cdp sudo[1565575]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 00:09:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:03 nativespace-cdp sudo[1565580]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 00:09:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:04 nativespace-cdp sudo[1565585]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 00:09:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:04 nativespace-cdp sudo[1565591]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 00:09:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:05 nativespace-cdp sudo[1565597]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 00:09:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:05 nativespace-cdp sudo[1565615]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 00:09:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:05 nativespace-cdp sudo[1565620]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 00:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:06 nativespace-cdp sudo[1565624]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 00:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:06 nativespace-cdp sudo[1565629]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 00:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:06 nativespace-cdp sudo[1565634]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 00:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:06 nativespace-cdp sudo[1565641]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 00:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:07 nativespace-cdp sudo[1565651]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 00:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:08 nativespace-cdp sudo[1565657]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=chrisdal user-4=mcdermos user-5=david user-6=careers user-7=nbhavers user-8=lucy user-9=attlebor user-10=onlycont user-11=outdoorc user-12=hodgsonmail user-13=ranxterc user-14=branko user-15=romaldki user-16=nove user-17=boldover user-18=bakery user-19=crrtipdl user-20=sosevalu user-21=tstardom user-22=oubpgvbx user-23=what user-24=havantho user-25=sketchy user-26=cath user-27=nvihkvu user-28=dancinggardener user-29=stagingerris user-30=ladburyp user-31=kategilpin user-32=design user-33=sibtoncc user-34=asandcoc user-35=bwppodcast user-36=zebrapho user-37=steve user-38=fawcettd user-39=burydropin user-40=nsceres user-41=beauty user-42=darkstar user-43=eatspam user-44=dhyana user-45=nscdp user-46=putterfc user-47=leftie user-48=foods user-49=fortunaz
Sep  3 00:09:08 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=health2045 user-51=lkpier user-52=steakbridieme user-53=donnychicago user-54=firstre5 user-55=philmcph user-56=ctedorgu user-57=smrszyqg user-58=isleofwi user-59=nomistakes user-60=hidden user-61=tigerlet user-62=barbersh user-63=cathski user-64=cambria1 user-65=reliable user-66=ninejimm user-67=cwsocial user-68=paulmca1 user-69=pugwash user-70=howardon user-71=hirefootballgame user-72=eugincou user-73=courseme user-74=ultbcrra user-75=jonhartl user-76=seftvta user-77=firstres user-78=coursemc user-79=opaiscyx user-80=clarkass user-81=firstrel user-82=costestimatorco user-83=firstred user-84=highlegh user-85=southlon user-86=milloyco user-87=gilpin user-88=elecleis user-89=putterfi user-90=hubmaster user-91=fetch user-92=carsinyo user-93=accooper user-94=ianrayne user-95=connectedshoppin user-96=thqkgnbz user-97=nstriton user-98=brighto1 user-99=vivienn1 user-100=firstre2 user-101=oneoarco
Sep  3 00:09:08 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=battlere user-103=bedfords user-104=newstoda user-105=belle user-106=ggaaorgu user-107=bemadonn user-108=alexadmin user-109=skyfirec user-110=innovat1 user-111=askhform user-112=stuartge user-113=nativene user-114=booff user-115=foundation user-116=markward user-117=vantagep user-118=connect9 user-119=athenare user-120=lbscrmod user-121=maflemin user-122=ulsukarm user-123=jarvisin user-124=spectrum user-125=hodgesonweb user-126=theblack user-127=agproduc user-128=still user-129=stephani user-130=leereyn1 user-131=brmrjxl user-132=lakesan1 user-133=strathar user-134=atestord user-135=sarafoundation user-136=wilsonsw user-137=megacards user-138=musorguk user-139=martsblo user-140=dickemery123 user-141=ptkxhsbt user-142=hhdugcor user-143=lbhyisi user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  3 00:09:08 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 00:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:08 nativespace-cdp sudo[1565664]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:09 nativespace-cdp sudo[1565670]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-QpEZjvElDAtfjC1r.~
Sep  3 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:09 nativespace-cdp sudo[1565676]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-QpEZjvElDAtfjC1r.~'
Sep  3 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:09 nativespace-cdp sudo[1565680]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-QpEZjvElDAtfjC1r.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:09 nativespace-cdp sudo[1565687]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:09 nativespace-cdp sudo[1565692]: pam_unix(sudo:session): session closed for user root
Sep  3 00:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 00:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 00:09:11 nativespace-cdp sudo[1565715]: pam_unix(sudo:session): session closed for user root
Sep  3 00:11:33 nativespace-cdp sshd[1566480]: Connection closed by 159.100.136.21 port 59322 [preauth]
Sep  3 00:17:02 nativespace-cdp sshd[1568029]: Did not receive identification string from 159.100.136.21 port 41306
Sep  3 00:21:33 nativespace-cdp sshd[1569188]: Connection closed by 159.100.136.21 port 51300 [preauth]
Sep  3 00:26:33 nativespace-cdp sshd[1570221]: Connection closed by 159.100.136.21 port 33298 [preauth]
Sep  3 00:31:33 nativespace-cdp sshd[1571563]: Connection closed by 159.100.136.21 port 43344 [preauth]
Sep  3 00:36:33 nativespace-cdp sshd[1572635]: Connection closed by 159.100.136.21 port 53640 [preauth]
Sep  3 00:41:33 nativespace-cdp sshd[1573977]: Connection closed by 159.100.136.21 port 35352 [preauth]
Sep  3 00:46:33 nativespace-cdp sshd[1575039]: Connection closed by 159.100.136.21 port 45568 [preauth]
Sep  3 00:51:33 nativespace-cdp sshd[1576080]: Connection closed by 159.100.136.21 port 55570 [preauth]
Sep  3 00:56:02 nativespace-cdp sshd[1577166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.155.0.205  user=root
Sep  3 00:56:02 nativespace-cdp sshd[1577166]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 00:56:04 nativespace-cdp sshd[1577166]: Failed password for root from 122.155.0.205 port 30582 ssh2
Sep  3 00:56:04 nativespace-cdp sshd[1577166]: Received disconnect from 122.155.0.205 port 30582:11: Bye Bye [preauth]
Sep  3 00:56:04 nativespace-cdp sshd[1577166]: Disconnected from 122.155.0.205 port 30582 [preauth]
Sep  3 00:56:33 nativespace-cdp sshd[1577257]: Connection closed by 159.100.136.21 port 37594 [preauth]
Sep  3 00:58:53 nativespace-cdp sshd[1577813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=155.248.251.201  user=root
Sep  3 00:58:53 nativespace-cdp sshd[1577813]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 00:58:54 nativespace-cdp sshd[1577813]: Failed password for root from 155.248.251.201 port 41808 ssh2
Sep  3 00:58:55 nativespace-cdp sshd[1577813]: Received disconnect from 155.248.251.201 port 41808:11: Bye Bye [preauth]
Sep  3 00:58:55 nativespace-cdp sshd[1577813]: Disconnected from 155.248.251.201 port 41808 [preauth]
Sep  3 00:59:47 nativespace-cdp sshd[1577936]: Invalid user temp from 162.19.48.19 port 53200
Sep  3 00:59:47 nativespace-cdp sshd[1577936]: input_userauth_request: invalid user temp [preauth]
Sep  3 00:59:47 nativespace-cdp sshd[1577936]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 00:59:47 nativespace-cdp sshd[1577936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.19.48.19
Sep  3 00:59:49 nativespace-cdp sshd[1577936]: Failed password for invalid user temp from 162.19.48.19 port 53200 ssh2
Sep  3 00:59:49 nativespace-cdp sshd[1577936]: Received disconnect from 162.19.48.19 port 53200:11: Bye Bye [preauth]
Sep  3 00:59:49 nativespace-cdp sshd[1577936]: Disconnected from 162.19.48.19 port 53200 [preauth]
Sep  3 01:00:04 nativespace-cdp sshd[1578238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.84.41.101  user=root
Sep  3 01:00:04 nativespace-cdp sshd[1578238]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:00:06 nativespace-cdp sshd[1578238]: Failed password for root from 138.84.41.101 port 14412 ssh2
Sep  3 01:00:06 nativespace-cdp sshd[1578238]: Received disconnect from 138.84.41.101 port 14412:11: Bye Bye [preauth]
Sep  3 01:00:06 nativespace-cdp sshd[1578238]: Disconnected from 138.84.41.101 port 14412 [preauth]
Sep  3 01:01:33 nativespace-cdp sshd[1578552]: Connection closed by 159.100.136.21 port 47578 [preauth]
Sep  3 01:02:14 nativespace-cdp sshd[1578683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.101.240.144  user=root
Sep  3 01:02:14 nativespace-cdp sshd[1578683]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:02:17 nativespace-cdp sshd[1578683]: Failed password for root from 34.101.240.144 port 49200 ssh2
Sep  3 01:02:17 nativespace-cdp sshd[1578683]: Received disconnect from 34.101.240.144 port 49200:11: Bye Bye [preauth]
Sep  3 01:02:17 nativespace-cdp sshd[1578683]: Disconnected from 34.101.240.144 port 49200 [preauth]
Sep  3 01:03:29 nativespace-cdp sshd[1578901]: Invalid user jair from 155.248.251.201 port 59036
Sep  3 01:03:29 nativespace-cdp sshd[1578901]: input_userauth_request: invalid user jair [preauth]
Sep  3 01:03:29 nativespace-cdp sshd[1578901]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:03:29 nativespace-cdp sshd[1578901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=155.248.251.201
Sep  3 01:03:30 nativespace-cdp sshd[1578901]: Failed password for invalid user jair from 155.248.251.201 port 59036 ssh2
Sep  3 01:03:30 nativespace-cdp sshd[1578901]: Received disconnect from 155.248.251.201 port 59036:11: Bye Bye [preauth]
Sep  3 01:03:30 nativespace-cdp sshd[1578901]: Disconnected from 155.248.251.201 port 59036 [preauth]
Sep  3 01:03:50 nativespace-cdp sshd[1578956]: Invalid user trial from 162.19.48.19 port 44120
Sep  3 01:03:50 nativespace-cdp sshd[1578956]: input_userauth_request: invalid user trial [preauth]
Sep  3 01:03:50 nativespace-cdp sshd[1578956]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:03:50 nativespace-cdp sshd[1578956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.19.48.19
Sep  3 01:03:52 nativespace-cdp sshd[1578956]: Failed password for invalid user trial from 162.19.48.19 port 44120 ssh2
Sep  3 01:03:52 nativespace-cdp sshd[1578956]: Received disconnect from 162.19.48.19 port 44120:11: Bye Bye [preauth]
Sep  3 01:03:52 nativespace-cdp sshd[1578956]: Disconnected from 162.19.48.19 port 44120 [preauth]
Sep  3 01:03:53 nativespace-cdp sshd[1578958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.84.41.101  user=root
Sep  3 01:03:53 nativespace-cdp sshd[1578958]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:03:53 nativespace-cdp sshd[1578961]: Invalid user hhhh from 122.155.0.205 port 9218
Sep  3 01:03:53 nativespace-cdp sshd[1578961]: input_userauth_request: invalid user hhhh [preauth]
Sep  3 01:03:53 nativespace-cdp sshd[1578961]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:03:53 nativespace-cdp sshd[1578961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.155.0.205
Sep  3 01:03:55 nativespace-cdp sshd[1578958]: Failed password for root from 138.84.41.101 port 33253 ssh2
Sep  3 01:03:55 nativespace-cdp sshd[1578961]: Failed password for invalid user hhhh from 122.155.0.205 port 9218 ssh2
Sep  3 01:03:55 nativespace-cdp sshd[1578961]: Received disconnect from 122.155.0.205 port 9218:11: Bye Bye [preauth]
Sep  3 01:03:55 nativespace-cdp sshd[1578961]: Disconnected from 122.155.0.205 port 9218 [preauth]
Sep  3 01:03:56 nativespace-cdp sshd[1578958]: Received disconnect from 138.84.41.101 port 33253:11: Bye Bye [preauth]
Sep  3 01:03:56 nativespace-cdp sshd[1578958]: Disconnected from 138.84.41.101 port 33253 [preauth]
Sep  3 01:04:19 nativespace-cdp sshd[1579036]: Invalid user ekgis from 155.248.251.201 port 38164
Sep  3 01:04:19 nativespace-cdp sshd[1579036]: input_userauth_request: invalid user ekgis [preauth]
Sep  3 01:04:19 nativespace-cdp sshd[1579036]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:04:19 nativespace-cdp sshd[1579036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=155.248.251.201
Sep  3 01:04:22 nativespace-cdp sshd[1579036]: Failed password for invalid user ekgis from 155.248.251.201 port 38164 ssh2
Sep  3 01:04:22 nativespace-cdp sshd[1579036]: Received disconnect from 155.248.251.201 port 38164:11: Bye Bye [preauth]
Sep  3 01:04:22 nativespace-cdp sshd[1579036]: Disconnected from 155.248.251.201 port 38164 [preauth]
Sep  3 01:04:29 nativespace-cdp sshd[1579090]: Invalid user ann from 162.19.48.19 port 59148
Sep  3 01:04:29 nativespace-cdp sshd[1579090]: input_userauth_request: invalid user ann [preauth]
Sep  3 01:04:29 nativespace-cdp sshd[1579090]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:04:29 nativespace-cdp sshd[1579090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.19.48.19
Sep  3 01:04:31 nativespace-cdp sshd[1579090]: Failed password for invalid user ann from 162.19.48.19 port 59148 ssh2
Sep  3 01:04:31 nativespace-cdp sshd[1579090]: Received disconnect from 162.19.48.19 port 59148:11: Bye Bye [preauth]
Sep  3 01:04:31 nativespace-cdp sshd[1579090]: Disconnected from 162.19.48.19 port 59148 [preauth]
Sep  3 01:04:40 nativespace-cdp sshd[1579150]: Invalid user wg from 122.155.0.205 port 17196
Sep  3 01:04:40 nativespace-cdp sshd[1579150]: input_userauth_request: invalid user wg [preauth]
Sep  3 01:04:40 nativespace-cdp sshd[1579150]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:04:40 nativespace-cdp sshd[1579150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.155.0.205
Sep  3 01:04:42 nativespace-cdp sshd[1579150]: Failed password for invalid user wg from 122.155.0.205 port 17196 ssh2
Sep  3 01:04:42 nativespace-cdp sshd[1579150]: Received disconnect from 122.155.0.205 port 17196:11: Bye Bye [preauth]
Sep  3 01:04:42 nativespace-cdp sshd[1579150]: Disconnected from 122.155.0.205 port 17196 [preauth]
Sep  3 01:04:45 nativespace-cdp sshd[1579192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.247.129.88  user=root
Sep  3 01:04:45 nativespace-cdp sshd[1579192]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:04:47 nativespace-cdp sshd[1579192]: Failed password for root from 84.247.129.88 port 48744 ssh2
Sep  3 01:04:47 nativespace-cdp sshd[1579192]: Received disconnect from 84.247.129.88 port 48744:11: Bye Bye [preauth]
Sep  3 01:04:47 nativespace-cdp sshd[1579192]: Disconnected from 84.247.129.88 port 48744 [preauth]
Sep  3 01:04:50 nativespace-cdp sshd[1579206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.84.41.101  user=root
Sep  3 01:04:50 nativespace-cdp sshd[1579206]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:04:51 nativespace-cdp sshd[1579206]: Failed password for root from 138.84.41.101 port 31709 ssh2
Sep  3 01:04:52 nativespace-cdp sshd[1579206]: Received disconnect from 138.84.41.101 port 31709:11: Bye Bye [preauth]
Sep  3 01:04:52 nativespace-cdp sshd[1579206]: Disconnected from 138.84.41.101 port 31709 [preauth]
Sep  3 01:06:33 nativespace-cdp sshd[1579727]: Connection closed by 159.100.136.21 port 57882 [preauth]
Sep  3 01:08:40 nativespace-cdp sshd[1580033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.101.240.144  user=root
Sep  3 01:08:40 nativespace-cdp sshd[1580033]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:08:43 nativespace-cdp sshd[1580033]: Failed password for root from 34.101.240.144 port 46220 ssh2
Sep  3 01:08:43 nativespace-cdp sshd[1580033]: Received disconnect from 34.101.240.144 port 46220:11: Bye Bye [preauth]
Sep  3 01:08:43 nativespace-cdp sshd[1580033]: Disconnected from 34.101.240.144 port 46220 [preauth]
Sep  3 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:12 nativespace-cdp sudo[1580144]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:12 nativespace-cdp sudo[1580148]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:13 nativespace-cdp sudo[1580151]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 01:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:13 nativespace-cdp sudo[1580158]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 01:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:16 nativespace-cdp sudo[1580161]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 01:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:16 nativespace-cdp sudo[1580176]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 01:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:16 nativespace-cdp sudo[1580179]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 01:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:16 nativespace-cdp sudo[1580182]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 01:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:16 nativespace-cdp sudo[1580185]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 01:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:16 nativespace-cdp sudo[1580188]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 01:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:16 nativespace-cdp sudo[1580191]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 01:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:18 nativespace-cdp sudo[1580205]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 01:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:18 nativespace-cdp sudo[1580210]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=clarkass user-2=firstrel user-3=costestimatorco user-4=firstred user-5=southlon user-6=highlegh user-7=jonhartl user-8=seftvta user-9=ultbcrra user-10=firstres user-11=coursemc user-12=opaiscyx user-13=accooper user-14=ianrayne user-15=connectedshoppin user-16=thqkgnbz user-17=milloyco user-18=gilpin user-19=elecleis user-20=hubmaster user-21=putterfi user-22=carsinyo user-23=fetch user-24=bedfords user-25=ggaaorgu user-26=belle user-27=newstoda user-28=bemadonn user-29=brighto1 user-30=nstriton user-31=firstre2 user-32=vivienn1 user-33=battlere user-34=oneoarco user-35=innovat1 user-36=askhform user-37=stuartge user-38=nativene user-39=skyfirec user-40=alexadmin user-41=ulsukarm user-42=markward user-43=foundation user-44=booff user-45=connect9 user-46=athenare user-47=vantagep user-48=maflemin
Sep  3 01:09:18 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=lbscrmod user-50=still user-51=agproduc user-52=stephani user-53=leereyn1 user-54=jarvisin user-55=spectrum user-56=theblack user-57=hodgesonweb user-58=wilsonsw user-59=musorguk user-60=megacards user-61=lakesan1 user-62=brmrjxl user-63=strathar user-64=sarafoundation user-65=atestord user-66=lbhyisi user-67=hhdugcor user-68=magichat user-69=martsblo user-70=dickemery123 user-71=ptkxhsbt user-72=chrisdal user-73=mcdermos user-74=nbhavers user-75=careers user-76=david user-77=tomandle user-78=jennimil user-79=hodgsonmail user-80=outdoorc user-81=ranxterc user-82=branko user-83=romaldki user-84=attlebor user-85=lucy user-86=onlycont user-87=bakery user-88=sosevalu user-89=crrtipdl user-90=nove user-91=boldover user-92=ladburyp user-93=dancinggardener user-94=stagingerris user-95=kategilpin user-96=design user-97=tstardom user-98=oubpgvbx user-99=what user-100=sketchy user-101=cath user-102=havantho
Sep  3 01:09:18 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=nvihkvu user-104=bwppodcast user-105=zebrapho user-106=steve user-107=sibtoncc user-108=asandcoc user-109=beauty user-110=eatspam user-111=darkstar user-112=dhyana user-113=burydropin user-114=fawcettd user-115=nsceres user-116=isleofwi user-117=smrszyqg user-118=hidden user-119=nomistakes user-120=tigerlet user-121=barbersh user-122=putterfc user-123=nscdp user-124=health2045 user-125=fortunaz user-126=foods user-127=leftie user-128=lkpier user-129=ctedorgu user-130=philmcph user-131=donnychicago user-132=firstre5 user-133=steakbridieme user-134=hirefootballgame user-135=eugincou user-136=courseme user-137=cambria1 user-138=cathski user-139=reliable user-140=ninejimm user-141=paulmca1 user-142=pugwash user-143=howardon user-144=cwsocial feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 01:09:18 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 01:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:19 nativespace-cdp sudo[1580214]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:19 nativespace-cdp sudo[1580222]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jQiYFBV94nFUF01K.~
Sep  3 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:19 nativespace-cdp sudo[1580225]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jQiYFBV94nFUF01K.~'
Sep  3 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:19 nativespace-cdp sudo[1580228]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jQiYFBV94nFUF01K.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:19 nativespace-cdp sudo[1580232]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:19 nativespace-cdp sudo[1580235]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 01:09:21 nativespace-cdp sudo[1580255]: pam_unix(sudo:session): session closed for user root
Sep  3 01:09:32 nativespace-cdp sshd[1580280]: Invalid user administrator from 84.247.129.88 port 54410
Sep  3 01:09:32 nativespace-cdp sshd[1580280]: input_userauth_request: invalid user administrator [preauth]
Sep  3 01:09:32 nativespace-cdp sshd[1580280]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:09:32 nativespace-cdp sshd[1580280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.247.129.88
Sep  3 01:09:34 nativespace-cdp sshd[1580280]: Failed password for invalid user administrator from 84.247.129.88 port 54410 ssh2
Sep  3 01:09:34 nativespace-cdp sshd[1580280]: Received disconnect from 84.247.129.88 port 54410:11: Bye Bye [preauth]
Sep  3 01:09:34 nativespace-cdp sshd[1580280]: Disconnected from 84.247.129.88 port 54410 [preauth]
Sep  3 01:09:46 nativespace-cdp sshd[1580307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.101.240.144  user=root
Sep  3 01:09:46 nativespace-cdp sshd[1580307]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:09:47 nativespace-cdp sshd[1580307]: Failed password for root from 34.101.240.144 port 37010 ssh2
Sep  3 01:09:47 nativespace-cdp sshd[1580307]: Received disconnect from 34.101.240.144 port 37010:11: Bye Bye [preauth]
Sep  3 01:09:47 nativespace-cdp sshd[1580307]: Disconnected from 34.101.240.144 port 37010 [preauth]
Sep  3 01:10:23 nativespace-cdp sshd[1580797]: Invalid user software from 84.247.129.88 port 45422
Sep  3 01:10:23 nativespace-cdp sshd[1580797]: input_userauth_request: invalid user software [preauth]
Sep  3 01:10:23 nativespace-cdp sshd[1580797]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:10:23 nativespace-cdp sshd[1580797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.247.129.88
Sep  3 01:10:26 nativespace-cdp sshd[1580797]: Failed password for invalid user software from 84.247.129.88 port 45422 ssh2
Sep  3 01:11:33 nativespace-cdp sshd[1581044]: Connection closed by 159.100.136.21 port 39636 [preauth]
Sep  3 01:16:33 nativespace-cdp sshd[1582219]: Connection closed by 159.100.136.21 port 49852 [preauth]
Sep  3 01:21:33 nativespace-cdp sshd[1583258]: Connection closed by 159.100.136.21 port 59798 [preauth]
Sep  3 01:26:33 nativespace-cdp sshd[1584520]: Connection closed by 159.100.136.21 port 41852 [preauth]
Sep  3 01:31:33 nativespace-cdp sshd[1585655]: Connection closed by 159.100.136.21 port 51862 [preauth]
Sep  3 01:36:33 nativespace-cdp sshd[1586750]: Connection closed by 159.100.136.21 port 33932 [preauth]
Sep  3 01:41:33 nativespace-cdp sshd[1587814]: Connection closed by 159.100.136.21 port 43880 [preauth]
Sep  3 01:43:15 nativespace-cdp sshd[1588145]: Invalid user bg from 92.205.21.182 port 37468
Sep  3 01:43:15 nativespace-cdp sshd[1588145]: input_userauth_request: invalid user bg [preauth]
Sep  3 01:43:15 nativespace-cdp sshd[1588145]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:43:15 nativespace-cdp sshd[1588145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.21.182
Sep  3 01:43:16 nativespace-cdp sshd[1588145]: Failed password for invalid user bg from 92.205.21.182 port 37468 ssh2
Sep  3 01:43:16 nativespace-cdp sshd[1588145]: Received disconnect from 92.205.21.182 port 37468:11: Bye Bye [preauth]
Sep  3 01:43:16 nativespace-cdp sshd[1588145]: Disconnected from 92.205.21.182 port 37468 [preauth]
Sep  3 01:44:21 nativespace-cdp sshd[1588445]: Invalid user masood from 185.100.53.39 port 46226
Sep  3 01:44:21 nativespace-cdp sshd[1588445]: input_userauth_request: invalid user masood [preauth]
Sep  3 01:44:21 nativespace-cdp sshd[1588445]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:44:21 nativespace-cdp sshd[1588445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.100.53.39
Sep  3 01:44:23 nativespace-cdp sshd[1588445]: Failed password for invalid user masood from 185.100.53.39 port 46226 ssh2
Sep  3 01:44:23 nativespace-cdp sshd[1588445]: Received disconnect from 185.100.53.39 port 46226:11: Bye Bye [preauth]
Sep  3 01:44:23 nativespace-cdp sshd[1588445]: Disconnected from 185.100.53.39 port 46226 [preauth]
Sep  3 01:45:27 nativespace-cdp sshd[1588838]: Invalid user generic from 54.36.163.1 port 48208
Sep  3 01:45:27 nativespace-cdp sshd[1588838]: input_userauth_request: invalid user generic [preauth]
Sep  3 01:45:27 nativespace-cdp sshd[1588838]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:45:27 nativespace-cdp sshd[1588838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.163.1
Sep  3 01:45:27 nativespace-cdp sshd[1588835]: Invalid user solr from 203.172.76.4 port 33448
Sep  3 01:45:27 nativespace-cdp sshd[1588835]: input_userauth_request: invalid user solr [preauth]
Sep  3 01:45:27 nativespace-cdp sshd[1588835]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:45:27 nativespace-cdp sshd[1588835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.172.76.4
Sep  3 01:45:29 nativespace-cdp sshd[1588838]: Failed password for invalid user generic from 54.36.163.1 port 48208 ssh2
Sep  3 01:45:29 nativespace-cdp sshd[1588838]: Received disconnect from 54.36.163.1 port 48208:11: Bye Bye [preauth]
Sep  3 01:45:29 nativespace-cdp sshd[1588838]: Disconnected from 54.36.163.1 port 48208 [preauth]
Sep  3 01:45:29 nativespace-cdp sshd[1588835]: Failed password for invalid user solr from 203.172.76.4 port 33448 ssh2
Sep  3 01:45:29 nativespace-cdp sshd[1588835]: Received disconnect from 203.172.76.4 port 33448:11: Bye Bye [preauth]
Sep  3 01:45:29 nativespace-cdp sshd[1588835]: Disconnected from 203.172.76.4 port 33448 [preauth]
Sep  3 01:45:56 nativespace-cdp sshd[1588940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.180.114.229  user=root
Sep  3 01:45:56 nativespace-cdp sshd[1588940]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:45:58 nativespace-cdp sshd[1588940]: Failed password for root from 47.180.114.229 port 50382 ssh2
Sep  3 01:45:58 nativespace-cdp sshd[1588940]: Received disconnect from 47.180.114.229 port 50382:11: Bye Bye [preauth]
Sep  3 01:45:58 nativespace-cdp sshd[1588940]: Disconnected from 47.180.114.229 port 50382 [preauth]
Sep  3 01:46:33 nativespace-cdp sshd[1589034]: Connection closed by 159.100.136.21 port 54102 [preauth]
Sep  3 01:48:19 nativespace-cdp sshd[1589337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.180.114.229  user=root
Sep  3 01:48:19 nativespace-cdp sshd[1589337]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:48:21 nativespace-cdp sshd[1589337]: Failed password for root from 47.180.114.229 port 47676 ssh2
Sep  3 01:48:21 nativespace-cdp sshd[1589337]: Received disconnect from 47.180.114.229 port 47676:11: Bye Bye [preauth]
Sep  3 01:48:21 nativespace-cdp sshd[1589337]: Disconnected from 47.180.114.229 port 47676 [preauth]
Sep  3 01:49:04 nativespace-cdp sshd[1589448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.180.114.229  user=root
Sep  3 01:49:04 nativespace-cdp sshd[1589448]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:49:06 nativespace-cdp sshd[1589448]: Failed password for root from 47.180.114.229 port 35168 ssh2
Sep  3 01:49:06 nativespace-cdp sshd[1589448]: Received disconnect from 47.180.114.229 port 35168:11: Bye Bye [preauth]
Sep  3 01:49:06 nativespace-cdp sshd[1589448]: Disconnected from 47.180.114.229 port 35168 [preauth]
Sep  3 01:51:12 nativespace-cdp sshd[1590138]: Invalid user italia from 185.100.53.39 port 37272
Sep  3 01:51:12 nativespace-cdp sshd[1590138]: input_userauth_request: invalid user italia [preauth]
Sep  3 01:51:12 nativespace-cdp sshd[1590138]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:51:12 nativespace-cdp sshd[1590138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.100.53.39
Sep  3 01:51:14 nativespace-cdp sshd[1590138]: Failed password for invalid user italia from 185.100.53.39 port 37272 ssh2
Sep  3 01:51:14 nativespace-cdp sshd[1590138]: Received disconnect from 185.100.53.39 port 37272:11: Bye Bye [preauth]
Sep  3 01:51:14 nativespace-cdp sshd[1590138]: Disconnected from 185.100.53.39 port 37272 [preauth]
Sep  3 01:51:24 nativespace-cdp sshd[1590171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.21.182  user=root
Sep  3 01:51:24 nativespace-cdp sshd[1590171]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:51:26 nativespace-cdp sshd[1590171]: Failed password for root from 92.205.21.182 port 41080 ssh2
Sep  3 01:51:26 nativespace-cdp sshd[1590171]: Received disconnect from 92.205.21.182 port 41080:11: Bye Bye [preauth]
Sep  3 01:51:26 nativespace-cdp sshd[1590171]: Disconnected from 92.205.21.182 port 41080 [preauth]
Sep  3 01:51:33 nativespace-cdp sshd[1590191]: Connection closed by 159.100.136.21 port 35880 [preauth]
Sep  3 01:51:35 nativespace-cdp sshd[1590195]: Invalid user rt from 203.172.76.4 port 50758
Sep  3 01:51:35 nativespace-cdp sshd[1590195]: input_userauth_request: invalid user rt [preauth]
Sep  3 01:51:35 nativespace-cdp sshd[1590195]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:51:35 nativespace-cdp sshd[1590195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.172.76.4
Sep  3 01:51:37 nativespace-cdp sshd[1590195]: Failed password for invalid user rt from 203.172.76.4 port 50758 ssh2
Sep  3 01:51:38 nativespace-cdp sshd[1590195]: Received disconnect from 203.172.76.4 port 50758:11: Bye Bye [preauth]
Sep  3 01:51:38 nativespace-cdp sshd[1590195]: Disconnected from 203.172.76.4 port 50758 [preauth]
Sep  3 01:52:04 nativespace-cdp sshd[1590286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.100.53.39  user=root
Sep  3 01:52:04 nativespace-cdp sshd[1590286]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:52:05 nativespace-cdp sshd[1590291]: Invalid user backend from 92.205.21.182 port 54436
Sep  3 01:52:05 nativespace-cdp sshd[1590291]: input_userauth_request: invalid user backend [preauth]
Sep  3 01:52:05 nativespace-cdp sshd[1590291]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:52:05 nativespace-cdp sshd[1590291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.21.182
Sep  3 01:52:07 nativespace-cdp sshd[1590286]: Failed password for root from 185.100.53.39 port 52898 ssh2
Sep  3 01:52:07 nativespace-cdp sshd[1590286]: Received disconnect from 185.100.53.39 port 52898:11: Bye Bye [preauth]
Sep  3 01:52:07 nativespace-cdp sshd[1590286]: Disconnected from 185.100.53.39 port 52898 [preauth]
Sep  3 01:52:08 nativespace-cdp sshd[1590291]: Failed password for invalid user backend from 92.205.21.182 port 54436 ssh2
Sep  3 01:52:16 nativespace-cdp sshd[1590380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.163.1  user=root
Sep  3 01:52:16 nativespace-cdp sshd[1590380]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:52:18 nativespace-cdp sshd[1590380]: Failed password for root from 54.36.163.1 port 36552 ssh2
Sep  3 01:52:18 nativespace-cdp sshd[1590380]: Received disconnect from 54.36.163.1 port 36552:11: Bye Bye [preauth]
Sep  3 01:52:18 nativespace-cdp sshd[1590380]: Disconnected from 54.36.163.1 port 36552 [preauth]
Sep  3 01:52:29 nativespace-cdp sshd[1590444]: Invalid user berlin from 203.172.76.4 port 35324
Sep  3 01:52:29 nativespace-cdp sshd[1590444]: input_userauth_request: invalid user berlin [preauth]
Sep  3 01:52:29 nativespace-cdp sshd[1590444]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 01:52:29 nativespace-cdp sshd[1590444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.172.76.4
Sep  3 01:52:31 nativespace-cdp sshd[1590444]: Failed password for invalid user berlin from 203.172.76.4 port 35324 ssh2
Sep  3 01:52:31 nativespace-cdp sshd[1590444]: Received disconnect from 203.172.76.4 port 35324:11: Bye Bye [preauth]
Sep  3 01:52:31 nativespace-cdp sshd[1590444]: Disconnected from 203.172.76.4 port 35324 [preauth]
Sep  3 01:52:55 nativespace-cdp sshd[1590519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.163.1  user=root
Sep  3 01:52:55 nativespace-cdp sshd[1590519]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 01:52:57 nativespace-cdp sshd[1590519]: Failed password for root from 54.36.163.1 port 34214 ssh2
Sep  3 01:52:57 nativespace-cdp sshd[1590519]: Received disconnect from 54.36.163.1 port 34214:11: Bye Bye [preauth]
Sep  3 01:52:57 nativespace-cdp sshd[1590519]: Disconnected from 54.36.163.1 port 34214 [preauth]
Sep  3 01:56:33 nativespace-cdp sshd[1591637]: Connection closed by 159.100.136.21 port 46126 [preauth]
Sep  3 02:01:33 nativespace-cdp sshd[1592804]: Connection closed by 159.100.136.21 port 56114 [preauth]
Sep  3 02:06:33 nativespace-cdp sshd[1593855]: Connection closed by 159.100.136.21 port 38196 [preauth]
Sep  3 02:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 02:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:07 nativespace-cdp sudo[1594297]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 02:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:07 nativespace-cdp sudo[1594300]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 02:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:07 nativespace-cdp sudo[1594304]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 02:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:07 nativespace-cdp sudo[1594308]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 02:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:09 nativespace-cdp sudo[1594311]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:10 nativespace-cdp sudo[1594321]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:10 nativespace-cdp sudo[1594324]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:10 nativespace-cdp sudo[1594327]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:10 nativespace-cdp sudo[1594330]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:10 nativespace-cdp sudo[1594333]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:10 nativespace-cdp sudo[1594336]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 02:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:11 nativespace-cdp sudo[1594344]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 02:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:12 nativespace-cdp sudo[1594350]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=beauty user-2=darkstar user-3=eatspam user-4=dhyana user-5=fawcettd user-6=burydropin user-7=nsceres user-8=bwppodcast user-9=zebrapho user-10=steve user-11=sibtoncc user-12=asandcoc user-13=hirefootballgame user-14=eugincou user-15=courseme user-16=cambria1 user-17=cathski user-18=ninejimm user-19=reliable user-20=cwsocial user-21=paulmca1 user-22=howardon user-23=pugwash user-24=smrszyqg user-25=isleofwi user-26=nomistakes user-27=hidden user-28=barbersh user-29=tigerlet user-30=nscdp user-31=putterfc user-32=foods user-33=leftie user-34=fortunaz user-35=health2045 user-36=lkpier user-37=firstre5 user-38=donnychicago user-39=steakbridieme user-40=ctedorgu user-41=philmcph user-42=hodgsonmail user-43=ranxterc user-44=outdoorc user-45=branko user-46=romaldki user-47=lucy user-48=attlebor
Sep  3 02:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=chrisdal user-51=mcdermos user-52=david user-53=nbhavers user-54=careers user-55=tomandle user-56=jennimil user-57=dancinggardener user-58=stagingerris user-59=ladburyp user-60=kategilpin user-61=design user-62=oubpgvbx user-63=tstardom user-64=what user-65=havantho user-66=sketchy user-67=cath user-68=nvihkvu user-69=bakery user-70=crrtipdl user-71=sosevalu user-72=nove user-73=boldover user-74=agproduc user-75=still user-76=stephani user-77=leereyn1 user-78=jarvisin user-79=spectrum user-80=theblack user-81=hodgesonweb user-82=ulsukarm user-83=markward user-84=booff user-85=foundation user-86=vantagep user-87=connect9 user-88=athenare user-89=lbscrmod user-90=maflemin user-91=hhdugcor user-92=lbhyisi user-93=magichat user-94=martsblo user-95=dickemery123 user-96=ptkxhsbt user-97=wilsonsw user-98=megacards user-99=musorguk user-100=brmrjxl user-101=lakesan1 user-102=strathar
Sep  3 02:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=atestord user-104=sarafoundation user-105=accooper user-106=ianrayne user-107=connectedshoppin user-108=thqkgnbz user-109=gilpin user-110=milloyco user-111=elecleis user-112=hubmaster user-113=putterfi user-114=fetch user-115=carsinyo user-116=clarkass user-117=firstrel user-118=costestimatorco user-119=firstred user-120=highlegh user-121=southlon user-122=ultbcrra user-123=jonhartl user-124=seftvta user-125=firstres user-126=coursemc user-127=opaiscyx user-128=innovat1 user-129=askhform user-130=stuartge user-131=nativene user-132=alexadmin user-133=skyfirec user-134=bedfords user-135=newstoda user-136=belle user-137=ggaaorgu user-138=bemadonn user-139=nstriton user-140=brighto1 user-141=vivienn1 user-142=firstre2 user-143=oneoarco user-144=battlere feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 02:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 02:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:12 nativespace-cdp sudo[1594354]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 02:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:13 nativespace-cdp sudo[1594363]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-RZloZ6j4Xwg3DJXU.~
Sep  3 02:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:13 nativespace-cdp sudo[1594366]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-RZloZ6j4Xwg3DJXU.~'
Sep  3 02:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:13 nativespace-cdp sudo[1594369]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-RZloZ6j4Xwg3DJXU.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 02:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:13 nativespace-cdp sudo[1594373]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 02:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:13 nativespace-cdp sudo[1594376]: pam_unix(sudo:session): session closed for user root
Sep  3 02:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 02:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 02:09:14 nativespace-cdp sudo[1594396]: pam_unix(sudo:session): session closed for user root
Sep  3 02:11:33 nativespace-cdp sshd[1595196]: Connection closed by 159.100.136.21 port 48180 [preauth]
Sep  3 02:16:33 nativespace-cdp sshd[1596329]: Connection closed by 159.100.136.21 port 58388 [preauth]
Sep  3 02:21:33 nativespace-cdp sshd[1597374]: Connection closed by 159.100.136.21 port 40126 [preauth]
Sep  3 02:23:53 nativespace-cdp sshd[1597695]: Invalid user training from 187.16.96.250 port 60758
Sep  3 02:23:53 nativespace-cdp sshd[1597695]: input_userauth_request: invalid user training [preauth]
Sep  3 02:23:53 nativespace-cdp sshd[1597695]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 02:23:53 nativespace-cdp sshd[1597695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.16.96.250
Sep  3 02:23:55 nativespace-cdp sshd[1597695]: Failed password for invalid user training from 187.16.96.250 port 60758 ssh2
Sep  3 02:23:55 nativespace-cdp sshd[1597695]: Received disconnect from 187.16.96.250 port 60758:11: Bye Bye [preauth]
Sep  3 02:23:55 nativespace-cdp sshd[1597695]: Disconnected from 187.16.96.250 port 60758 [preauth]
Sep  3 02:26:33 nativespace-cdp sshd[1598427]: Connection closed by 159.100.136.21 port 50394 [preauth]
Sep  3 02:28:03 nativespace-cdp sshd[1598830]: Invalid user syslogs from 187.16.96.250 port 56820
Sep  3 02:28:03 nativespace-cdp sshd[1598830]: input_userauth_request: invalid user syslogs [preauth]
Sep  3 02:28:03 nativespace-cdp sshd[1598830]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 02:28:03 nativespace-cdp sshd[1598830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.16.96.250
Sep  3 02:28:05 nativespace-cdp sshd[1598830]: Failed password for invalid user syslogs from 187.16.96.250 port 56820 ssh2
Sep  3 02:28:05 nativespace-cdp sshd[1598830]: Received disconnect from 187.16.96.250 port 56820:11: Bye Bye [preauth]
Sep  3 02:28:05 nativespace-cdp sshd[1598830]: Disconnected from 187.16.96.250 port 56820 [preauth]
Sep  3 02:28:58 nativespace-cdp sshd[1598946]: Invalid user appuser from 187.16.96.250 port 39168
Sep  3 02:28:58 nativespace-cdp sshd[1598946]: input_userauth_request: invalid user appuser [preauth]
Sep  3 02:28:58 nativespace-cdp sshd[1598946]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 02:28:58 nativespace-cdp sshd[1598946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.16.96.250
Sep  3 02:29:00 nativespace-cdp sshd[1598946]: Failed password for invalid user appuser from 187.16.96.250 port 39168 ssh2
Sep  3 02:31:33 nativespace-cdp sshd[1599679]: Connection closed by 159.100.136.21 port 60394 [preauth]
Sep  3 02:36:33 nativespace-cdp sshd[1600753]: Connection closed by 159.100.136.21 port 42462 [preauth]
Sep  3 02:41:33 nativespace-cdp sshd[1602083]: Connection closed by 159.100.136.21 port 52418 [preauth]
Sep  3 02:46:33 nativespace-cdp sshd[1603136]: Connection closed by 159.100.136.21 port 34404 [preauth]
Sep  3 02:51:33 nativespace-cdp sshd[1604171]: Connection closed by 159.100.136.21 port 44394 [preauth]
Sep  3 02:56:33 nativespace-cdp sshd[1605507]: Connection closed by 159.100.136.21 port 54672 [preauth]
Sep  3 03:01:33 nativespace-cdp sshd[1606676]: Connection closed by 159.100.136.21 port 36424 [preauth]
Sep  3 03:06:33 nativespace-cdp sshd[1607713]: Connection closed by 159.100.136.21 port 46528 [preauth]
Sep  3 03:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 03:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:07 nativespace-cdp sudo[1608145]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 03:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:07 nativespace-cdp sudo[1608148]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 03:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:07 nativespace-cdp sudo[1608151]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 03:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:07 nativespace-cdp sudo[1608155]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 03:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:08 nativespace-cdp sudo[1608158]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 03:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:08 nativespace-cdp sudo[1608167]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 03:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:08 nativespace-cdp sudo[1608170]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 03:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:08 nativespace-cdp sudo[1608173]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 03:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:08 nativespace-cdp sudo[1608177]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 03:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:09 nativespace-cdp sudo[1608180]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 03:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:09 nativespace-cdp sudo[1608184]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 03:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:10 nativespace-cdp sudo[1608193]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 03:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:10 nativespace-cdp sudo[1608197]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=ptkxhsbt user-3=dickemery123 user-4=lbhyisi user-5=hhdugcor user-6=magichat user-7=lakesan1 user-8=brmrjxl user-9=sarafoundation user-10=atestord user-11=strathar user-12=wilsonsw user-13=musorguk user-14=megacards user-15=jarvisin user-16=theblack user-17=hodgesonweb user-18=spectrum user-19=still user-20=agproduc user-21=leereyn1 user-22=stephani user-23=booff user-24=markward user-25=foundation user-26=maflemin user-27=lbscrmod user-28=athenare user-29=connect9 user-30=vantagep user-31=ulsukarm user-32=skyfirec user-33=alexadmin user-34=stuartge user-35=askhform user-36=innovat1 user-37=nativene user-38=brighto1 user-39=nstriton user-40=battlere user-41=oneoarco user-42=firstre2 user-43=vivienn1 user-44=bedfords user-45=bemadonn user-46=ggaaorgu user-47=belle user-48=newstoda
Sep  3 03:09:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=elecleis user-50=milloyco user-51=gilpin user-52=carsinyo user-53=fetch user-54=putterfi user-55=hubmaster user-56=ianrayne user-57=accooper user-58=thqkgnbz user-59=connectedshoppin user-60=firstres user-61=seftvta user-62=jonhartl user-63=ultbcrra user-64=opaiscyx user-65=coursemc user-66=costestimatorco user-67=firstrel user-68=clarkass user-69=southlon user-70=highlegh user-71=firstred user-72=ninejimm user-73=reliable user-74=cambria1 user-75=cathski user-76=howardon user-77=paulmca1 user-78=pugwash user-79=cwsocial user-80=hirefootballgame user-81=courseme user-82=eugincou user-83=health2045 user-84=fortunaz user-85=foods user-86=leftie user-87=putterfc user-88=nscdp user-89=ctedorgu user-90=philmcph user-91=firstre5 user-92=donnychicago user-93=steakbridieme user-94=lkpier user-95=isleofwi user-96=smrszyqg user-97=tigerlet user-98=barbersh user-99=hidden user-100=nomistakes user-101=burydropin
Sep  3 03:09:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=fawcettd user-103=nsceres user-104=eatspam user-105=darkstar user-106=beauty user-107=dhyana user-108=sibtoncc user-109=asandcoc user-110=zebrapho user-111=bwppodcast user-112=steve user-113=what user-114=tstardom user-115=oubpgvbx user-116=nvihkvu user-117=sketchy user-118=cath user-119=havantho user-120=kategilpin user-121=ladburyp user-122=stagingerris user-123=dancinggardener user-124=design user-125=nove user-126=boldover user-127=sosevalu user-128=crrtipdl user-129=bakery user-130=attlebor user-131=lucy user-132=onlycont user-133=branko user-134=hodgsonmail user-135=ranxterc user-136=outdoorc user-137=romaldki user-138=tomandle user-139=jennimil user-140=mcdermos user-141=chrisdal user-142=nbhavers user-143=careers user-144=david feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 03:09:10 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 03:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:11 nativespace-cdp sudo[1608201]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:11 nativespace-cdp sudo[1608208]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-PqJ6ys0utH6jfgqB.~
Sep  3 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:11 nativespace-cdp sudo[1608211]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-PqJ6ys0utH6jfgqB.~'
Sep  3 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:11 nativespace-cdp sudo[1608214]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-PqJ6ys0utH6jfgqB.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:11 nativespace-cdp sudo[1608218]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:11 nativespace-cdp sudo[1608222]: pam_unix(sudo:session): session closed for user root
Sep  3 03:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 03:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 03:09:16 nativespace-cdp sudo[1608249]: pam_unix(sudo:session): session closed for user root
Sep  3 03:11:33 nativespace-cdp sshd[1609020]: Connection closed by 159.100.136.21 port 56524 [preauth]
Sep  3 03:16:33 nativespace-cdp sshd[1610212]: Connection closed by 159.100.136.21 port 38484 [preauth]
Sep  3 03:21:33 nativespace-cdp sshd[1611211]: Connection closed by 159.100.136.21 port 48442 [preauth]
Sep  3 03:26:33 nativespace-cdp sshd[1612282]: Connection closed by 159.100.136.21 port 58166 [preauth]
Sep  3 03:31:33 nativespace-cdp sshd[1613542]: Connection closed by 159.100.136.21 port 39968 [preauth]
Sep  3 03:36:33 nativespace-cdp sshd[1614615]: Connection closed by 159.100.136.21 port 50248 [preauth]
Sep  3 03:41:33 nativespace-cdp sshd[1616065]: Connection closed by 159.100.136.21 port 60222 [preauth]
Sep  3 03:46:33 nativespace-cdp sshd[1617126]: Connection closed by 159.100.136.21 port 42224 [preauth]
Sep  3 03:51:33 nativespace-cdp sshd[1618104]: Connection closed by 159.100.136.21 port 52220 [preauth]
Sep  3 03:56:33 nativespace-cdp sshd[1619189]: Connection closed by 159.100.136.21 port 34210 [preauth]
Sep  3 04:01:33 nativespace-cdp sshd[1620441]: Connection closed by 159.100.136.21 port 44194 [preauth]
Sep  3 04:06:33 nativespace-cdp sshd[1621552]: Connection closed by 159.100.136.21 port 54262 [preauth]
Sep  3 04:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 04:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:07 nativespace-cdp sudo[1622074]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 04:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:07 nativespace-cdp sudo[1622077]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 04:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:07 nativespace-cdp sudo[1622080]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 04:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:07 nativespace-cdp sudo[1622085]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 04:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:09 nativespace-cdp sudo[1622088]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 04:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:09 nativespace-cdp sudo[1622099]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 04:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:09 nativespace-cdp sudo[1622102]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 04:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:09 nativespace-cdp sudo[1622105]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 04:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:09 nativespace-cdp sudo[1622109]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 04:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:09 nativespace-cdp sudo[1622112]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 04:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:09 nativespace-cdp sudo[1622115]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 04:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:10 nativespace-cdp sudo[1622125]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 04:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:10 nativespace-cdp sudo[1622129]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=chrisdal user-4=mcdermos user-5=careers user-6=nbhavers user-7=david user-8=attlebor user-9=lucy user-10=onlycont user-11=hodgsonmail user-12=ranxterc user-13=outdoorc user-14=branko user-15=romaldki user-16=nove user-17=boldover user-18=bakery user-19=sosevalu user-20=crrtipdl user-21=oubpgvbx user-22=tstardom user-23=what user-24=sketchy user-25=cath user-26=havantho user-27=nvihkvu user-28=ladburyp user-29=dancinggardener user-30=stagingerris user-31=kategilpin user-32=design user-33=sibtoncc user-34=asandcoc user-35=bwppodcast user-36=zebrapho user-37=steve user-38=burydropin user-39=fawcettd user-40=nsceres user-41=beauty user-42=eatspam user-43=darkstar user-44=dhyana user-45=putterfc user-46=nscdp user-47=fortunaz user-48=health2045 user-49=foods
Sep  3 04:09:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=leftie user-51=lkpier user-52=philmcph user-53=ctedorgu user-54=donnychicago user-55=firstre5 user-56=steakbridieme user-57=isleofwi user-58=smrszyqg user-59=hidden user-60=nomistakes user-61=barbersh user-62=tigerlet user-63=cambria1 user-64=cathski user-65=reliable user-66=ninejimm user-67=paulmca1 user-68=pugwash user-69=howardon user-70=cwsocial user-71=hirefootballgame user-72=eugincou user-73=courseme user-74=jonhartl user-75=seftvta user-76=ultbcrra user-77=firstres user-78=opaiscyx user-79=coursemc user-80=clarkass user-81=firstrel user-82=costestimatorco user-83=firstred user-84=southlon user-85=highlegh user-86=gilpin user-87=milloyco user-88=elecleis user-89=putterfi user-90=hubmaster user-91=carsinyo user-92=fetch user-93=accooper user-94=ianrayne user-95=connectedshoppin user-96=thqkgnbz user-97=brighto1 user-98=nstriton user-99=firstre2 user-100=vivienn1 user-101=battlere user-102=oneoarco
Sep  3 04:09:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=ggaaorgu user-105=belle user-106=newstoda user-107=bemadonn user-108=skyfirec user-109=alexadmin user-110=innovat1 user-111=askhform user-112=stuartge user-113=nativene user-114=markward user-115=booff user-116=foundation user-117=athenare user-118=connect9 user-119=vantagep user-120=maflemin user-121=lbscrmod user-122=ulsukarm user-123=jarvisin user-124=spectrum user-125=theblack user-126=hodgesonweb user-127=still user-128=agproduc user-129=stephani user-130=leereyn1 user-131=lakesan1 user-132=brmrjxl user-133=strathar user-134=sarafoundation user-135=atestord user-136=wilsonsw user-137=musorguk user-138=megacards user-139=martsblo user-140=dickemery123 user-141=ptkxhsbt user-142=lbhyisi user-143=hhdugcor user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 04:09:10 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 04:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:11 nativespace-cdp sudo[1622133]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 04:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:11 nativespace-cdp sudo[1622140]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Gh1tKtUYMRCU7yqN.~
Sep  3 04:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:11 nativespace-cdp sudo[1622143]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Gh1tKtUYMRCU7yqN.~'
Sep  3 04:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:11 nativespace-cdp sudo[1622147]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Gh1tKtUYMRCU7yqN.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 04:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:11 nativespace-cdp sudo[1622151]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 04:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:11 nativespace-cdp sudo[1622154]: pam_unix(sudo:session): session closed for user root
Sep  3 04:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 04:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:09:12 nativespace-cdp sudo[1622174]: pam_unix(sudo:session): session closed for user root
Sep  3 04:11:33 nativespace-cdp sshd[1623112]: Connection closed by 159.100.136.21 port 36006 [preauth]
Sep  3 04:15:10 nativespace-cdp sshd[1623805]: Did not receive identification string from 199.45.154.140 port 36198
Sep  3 04:15:28 nativespace-cdp sshd[1623822]: Connection closed by 199.45.154.140 port 36278 [preauth]
Sep  3 04:16:33 nativespace-cdp sshd[1624199]: Connection closed by 159.100.136.21 port 46192 [preauth]
Sep  3 04:21:33 nativespace-cdp sshd[1625526]: Connection closed by 159.100.136.21 port 56068 [preauth]
Sep  3 04:26:33 nativespace-cdp sshd[1626665]: Connection closed by 159.100.136.21 port 37966 [preauth]
Sep  3 04:31:32 nativespace-cdp sshd[1628108]: Connection closed by 159.100.136.21 port 48004 [preauth]
Sep  3 04:36:33 nativespace-cdp sshd[1630050]: Connection closed by 159.100.136.21 port 58280 [preauth]
Sep  3 04:41:33 nativespace-cdp sshd[1631656]: Connection closed by 159.100.136.21 port 40010 [preauth]
Sep  3 04:46:33 nativespace-cdp sshd[1632795]: Connection closed by 159.100.136.21 port 50244 [preauth]
Sep  3 04:51:33 nativespace-cdp sshd[1633853]: Connection closed by 159.100.136.21 port 60230 [preauth]
Sep  3 04:56:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 04:56:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:11 nativespace-cdp sudo[1634876]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 04:56:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:11 nativespace-cdp sudo[1634884]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 04:56:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:15 nativespace-cdp sudo[1634900]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jennimil user-2=tomandle user-3=david user-4=careers user-5=nbhavers user-6=mcdermos user-7=chrisdal user-8=onlycont user-9=lucy user-10=attlebor user-11=romaldki user-12=branko user-13=hodgsonmail user-14=outdoorc user-15=ranxterc user-16=boldover user-17=nove user-18=crrtipdl user-19=sosevalu user-20=bakery user-21=nvihkvu user-22=havantho user-23=cath user-24=sketchy user-25=what user-26=tstardom user-27=oubpgvbx user-28=design user-29=kategilpin user-30=dancinggardener user-31=stagingerris user-32=ladburyp user-33=sibtoncc user-34=asandcoc user-35=steve user-36=zebrapho user-37=bwppodcast user-38=nsceres user-39=fawcettd user-40=burydropin user-41=dhyana user-42=darkstar user-43=eatspam user-44=beauty user-45=donnychicago user-46=firstre5 user-47=steakbridieme user-48=ctedorgu
Sep  3 04:56:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=philmcph user-50=lkpier user-51=foods user-52=leftie user-53=fortunaz user-54=health2045 user-55=nscdp user-56=putterfc user-57=barbersh user-58=tigerlet user-59=nomistakes user-60=hidden user-61=isleofwi user-62=smrszyqg user-63=cwsocial user-64=paulmca1 user-65=pugwash user-66=howardon user-67=reliable user-68=ninejimm user-69=cambria1 user-70=cathski user-71=courseme user-72=eugincou user-73=hirefootballgame user-74=coursemc user-75=opaiscyx user-76=firstres user-77=ultbcrra user-78=seftvta user-79=jonhartl user-80=highlegh user-81=southlon user-82=firstred user-83=costestimatorco user-84=clarkass user-85=firstrel user-86=fetch user-87=carsinyo user-88=hubmaster user-89=putterfi user-90=elecleis user-91=milloyco user-92=gilpin user-93=thqkgnbz user-94=connectedshoppin user-95=ianrayne user-96=accooper user-97=oneoarco user-98=battlere user-99=vivienn1 user-100=firstre2 user-101=nstriton
Sep  3 04:56:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=brighto1 user-103=bemadonn user-104=newstoda user-105=belle user-106=ggaaorgu user-107=bedfords user-108=skyfirec user-109=alexadmin user-110=nativene user-111=stuartge user-112=askhform user-113=innovat1 user-114=lbscrmod user-115=maflemin user-116=vantagep user-117=connect9 user-118=athenare user-119=foundation user-120=booff user-121=markward user-122=ulsukarm user-123=hodgesonweb user-124=theblack user-125=spectrum user-126=jarvisin user-127=leereyn1 user-128=stephani user-129=agproduc user-130=still user-131=atestord user-132=sarafoundation user-133=strathar user-134=lakesan1 user-135=brmrjxl user-136=megacards user-137=musorguk user-138=wilsonsw user-139=ptkxhsbt user-140=dickemery123 user-141=martsblo user-142=magichat user-143=hhdugcor user-144=lbhyisi feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  3 04:56:15 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 04:56:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:16 nativespace-cdp sudo[1634904]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  3 04:56:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:17 nativespace-cdp sudo[1634911]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=onlycont --output=json
Sep  3 04:56:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:18 nativespace-cdp sudo[1634915]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:33 nativespace-cdp sshd[1634974]: Connection closed by 159.100.136.21 port 42270 [preauth]
Sep  3 04:56:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  3 04:56:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 04:56:40 nativespace-cdp sudo[1635032]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 04:56:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user onlycont --user-current --json
Sep  3 04:56:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:41 nativespace-cdp sudo[1635038]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont LangPHP php_get_vhost_versions --output=json
Sep  3 04:56:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:43 nativespace-cdp sudo[1635043]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep  3 04:56:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:45 nativespace-cdp sudo[1635049]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  3 04:56:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:45 nativespace-cdp sudo[1635062]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DomainInfo single_domain_data domain=apexred.com return_https_redirect_status=1 --output=json
Sep  3 04:56:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:47 nativespace-cdp sudo[1635102]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep  3 04:56:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:51 nativespace-cdp sudo[1635163]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep  3 04:56:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:52 nativespace-cdp sudo[1635184]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont Mime list_redirects --output=json
Sep  3 04:56:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:52 nativespace-cdp sudo[1635189]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DirectoryPrivacy is_directory_protected dir=/home/onlycont/public_html/wp --output=json
Sep  3 04:56:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:56:56 nativespace-cdp sudo[1635256]: pam_unix(sudo:session): session closed for user root
Sep  3 04:56:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  3 04:56:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 04:56:59 nativespace-cdp sudo[1635311]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 04:56:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep  3 04:56:59 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep  3 04:56:59 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep  3 04:56:59 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:56:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 04:56:59 nativespace-cdp sudo[1635318]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 04:56:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  3 04:56:59 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  3 04:56:59 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  3 04:56:59 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:56:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 04:57:00 nativespace-cdp sudo[1635327]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 04:57:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  3 04:57:00 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  3 04:57:00 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  3 04:57:00 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:57:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 04:57:02 nativespace-cdp sudo[1635334]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  3 04:57:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 04:57:11 nativespace-cdp sudo[1635462]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:57:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 04:57:11 nativespace-cdp sudo[1635469]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:57:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 04:57:11 nativespace-cdp sudo[1635475]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep  3 04:57:11 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:57:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 04:57:11 nativespace-cdp sudo[1635482]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 04:57:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  3 04:57:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:57:13 nativespace-cdp sudo[1635517]: pam_unix(sudo:session): session closed for user root
Sep  3 04:57:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep  3 04:57:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:57:14 nativespace-cdp sudo[1635523]: pam_unix(sudo:session): session closed for user root
Sep  3 04:57:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  3 04:57:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:57:32 nativespace-cdp sudo[1635611]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:57:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  3 04:57:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:57:32 nativespace-cdp sudo[1635618]: pam_unix(sudo:session): session closed for user root
Sep  3 04:57:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep  3 04:57:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:57:33 nativespace-cdp sudo[1635621]: pam_unix(sudo:session): session closed for user root
Sep  3 04:57:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep  3 04:57:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:57:34 nativespace-cdp sudo[1635632]: pam_unix(sudo:session): session closed for user root
Sep  3 04:57:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  3 04:57:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:57:34 nativespace-cdp sudo[1635708]: pam_unix(sudo:session): session closed for user root
Sep  3 04:57:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep  3 04:57:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:57:37 nativespace-cdp sudo[1635728]: pam_unix(sudo:session): session closed for user root
Sep  3 04:57:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep  3 04:57:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:57:38 nativespace-cdp sudo[1635733]: pam_unix(sudo:session): session closed for user root
Sep  3 04:57:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep  3 04:57:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:57:44 nativespace-cdp sudo[1635806]: pam_unix(sudo:session): session closed for user root
Sep  3 04:57:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  3 04:57:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:57:47 nativespace-cdp sudo[1635864]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:57:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  3 04:57:47 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  3 04:57:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  3 04:57:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:57:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:57:47 nativespace-cdp sudo[1635870]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:57:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  3 04:57:47 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  3 04:57:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  3 04:57:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:57:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:58:06 nativespace-cdp sudo[1635877]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:58:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  3 04:58:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:58:15 nativespace-cdp sudo[1636052]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:58:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  3 04:58:15 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  3 04:58:15 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  3 04:58:15 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:58:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:58:15 nativespace-cdp sudo[1636059]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:58:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  3 04:58:15 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  3 04:58:15 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  3 04:58:15 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:58:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:58:15 nativespace-cdp sudo[1636065]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:58:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  3 04:58:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:58:18 nativespace-cdp sudo[1636104]: pam_unix(sudo:session): session closed for user root
Sep  3 04:58:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep  3 04:58:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:58:18 nativespace-cdp sudo[1636108]: pam_unix(sudo:session): session closed for user root
Sep  3 04:58:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  3 04:58:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 04:58:30 nativespace-cdp sudo[1636190]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 04:58:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep  3 04:58:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:58:30 nativespace-cdp sudo[1636196]: pam_unix(sudo:session): session closed for user root
Sep  3 04:58:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep  3 04:58:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:58:31 nativespace-cdp sudo[1636199]: pam_unix(sudo:session): session closed for user root
Sep  3 04:58:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  3 04:58:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:58:31 nativespace-cdp sudo[1636204]: pam_unix(sudo:session): session closed for user root
Sep  3 04:58:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep  3 04:58:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:58:32 nativespace-cdp sudo[1636216]: pam_unix(sudo:session): session closed for user root
Sep  3 04:58:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep  3 04:58:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:58:32 nativespace-cdp sudo[1636222]: pam_unix(sudo:session): session closed for user root
Sep  3 04:58:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep  3 04:58:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:58:37 nativespace-cdp sudo[1636294]: pam_unix(sudo:session): session closed for user root
Sep  3 04:58:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  3 04:58:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 04:58:40 nativespace-cdp sudo[1636356]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 04:58:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  3 04:58:40 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  3 04:58:40 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  3 04:58:40 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:58:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 04:58:41 nativespace-cdp sudo[1636363]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 04:58:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  3 04:58:41 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  3 04:58:41 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  3 04:58:41 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:58:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 04:58:57 nativespace-cdp sudo[1636370]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 04:58:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  3 04:58:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  3 04:58:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  3 04:58:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:58:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 04:59:00 nativespace-cdp sudo[1636411]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  3 04:59:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 04:59:06 nativespace-cdp sudo[1636546]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:59:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 04:59:06 nativespace-cdp sudo[1636553]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:59:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 04:59:06 nativespace-cdp sudo[1636560]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  3 04:59:06 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:59:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 04:59:06 nativespace-cdp sudo[1636568]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 04:59:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  3 04:59:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:08 nativespace-cdp sudo[1636603]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep  3 04:59:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:09 nativespace-cdp sudo[1636607]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep  3 04:59:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:09 nativespace-cdp sudo[1636622]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep  3 04:59:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:10 nativespace-cdp sudo[1636627]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  3 04:59:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  3 04:59:10 nativespace-cdp sudo[1636638]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  3 04:59:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep  3 04:59:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:11 nativespace-cdp sudo[1636644]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep  3 04:59:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:11 nativespace-cdp sudo[1636648]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  3 04:59:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:11 nativespace-cdp sudo[1636653]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  3 04:59:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:59:19 nativespace-cdp sudo[1636757]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:59:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  3 04:59:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:20 nativespace-cdp sudo[1636763]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  3 04:59:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:20 nativespace-cdp sudo[1636767]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep  3 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:21 nativespace-cdp sudo[1636780]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep  3 04:59:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:26 nativespace-cdp sudo[1636845]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  3 04:59:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:59:29 nativespace-cdp sudo[1636905]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:59:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  3 04:59:29 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  3 04:59:29 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  3 04:59:29 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:59:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:59:30 nativespace-cdp sudo[1636916]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:59:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  3 04:59:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  3 04:59:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  3 04:59:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:59:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:59:47 nativespace-cdp sudo[1636923]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:59:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  3 04:59:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:59:52 nativespace-cdp sudo[1637062]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:59:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  3 04:59:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  3 04:59:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  3 04:59:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:59:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:59:53 nativespace-cdp sudo[1637068]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:59:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  3 04:59:53 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  3 04:59:53 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  3 04:59:53 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  3 04:59:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 04:59:53 nativespace-cdp sudo[1637075]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 04:59:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  3 04:59:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:55 nativespace-cdp sudo[1637113]: pam_unix(sudo:session): session closed for user root
Sep  3 04:59:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep  3 04:59:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 04:59:55 nativespace-cdp sudo[1637117]: pam_unix(sudo:session): session closed for user root
Sep  3 05:00:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  3 05:00:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  3 05:00:45 nativespace-cdp sudo[1637449]: pam_unix(sudo:session): session closed for user fortunaz
Sep  3 05:00:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep  3 05:00:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:00:46 nativespace-cdp sudo[1637456]: pam_unix(sudo:session): session closed for user root
Sep  3 05:00:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep  3 05:00:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:00:46 nativespace-cdp sudo[1637463]: pam_unix(sudo:session): session closed for user root
Sep  3 05:00:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  3 05:00:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:00:46 nativespace-cdp sudo[1637468]: pam_unix(sudo:session): session closed for user root
Sep  3 05:00:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep  3 05:00:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:00:49 nativespace-cdp sudo[1637483]: pam_unix(sudo:session): session closed for user root
Sep  3 05:00:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  3 05:00:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:00:49 nativespace-cdp sudo[1637490]: pam_unix(sudo:session): session closed for user root
Sep  3 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep  3 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:00:53 nativespace-cdp sudo[1637595]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=jennimil WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "Check & Log Email" on ONE | OAR (https://oneoar.co.uk). Installed version: 1.0.6. Available version: 2.0.1.<br/><br/>' installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep  3 05:01:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:05 nativespace-cdp sudo[1637809]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep  3 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:13 nativespace-cdp sudo[1637934]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  3 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:13 nativespace-cdp sudo[1637937]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  3 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:13 nativespace-cdp sudo[1637940]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  3 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:13 nativespace-cdp sudo[1637943]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  3 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:13 nativespace-cdp sudo[1637946]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  3 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:13 nativespace-cdp sudo[1637949]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  3 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:13 nativespace-cdp sudo[1637952]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637955]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637958]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637961]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637965]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637968]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637971]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637974]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637977]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637980]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637983]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637986]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637989]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637993]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637996]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1637999]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638002]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638006]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638009]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638012]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638016]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638019]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638022]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638025]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638028]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638031]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638034]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638037]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638040]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638043]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638046]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:14 nativespace-cdp sudo[1638049]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638052]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638055]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638059]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638062]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638065]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638068]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638071]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638074]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638077]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638080]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638083]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638086]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638089]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638092]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638095]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638098]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638101]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638104]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638107]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638111]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638114]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638117]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638120]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638123]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638126]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638130]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638133]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638136]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638139]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638142]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638145]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638148]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638151]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:15 nativespace-cdp sudo[1638154]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638157]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638160]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638163]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638166]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638169]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638172]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638175]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638178]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638181]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638184]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638187]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638190]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638193]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638196]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638199]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638202]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638205]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638208]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638212]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638215]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638219]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638222]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638225]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638228]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638231]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638234]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638237]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638240]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638243]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638246]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638249]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638252]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  3 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:16 nativespace-cdp sudo[1638255]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638258]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638261]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638264]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638267]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638270]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638273]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638276]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638279]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638282]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638285]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638288]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638291]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638294]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638298]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638301]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638304]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638307]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638310]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638313]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638317]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638320]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638323]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638326]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638329]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638332]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638335]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638338]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638341]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638344]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638347]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638350]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638353]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638356]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638359]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638362]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638365]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:17 nativespace-cdp sudo[1638368]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638371]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638374]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638377]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638380]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638383]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638386]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638389]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638392]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638395]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638398]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638401]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638404]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638407]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638410]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638413]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638416]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638419]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638422]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638425]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638428]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638432]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638435]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638438]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638441]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638444]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638447]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638450]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638453]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638456]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638459]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638462]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638465]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638468]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638471]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638474]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:18 nativespace-cdp sudo[1638477]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638480]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638483]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638486]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638490]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638493]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638496]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638499]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638502]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638505]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638508]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638511]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638514]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638517]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638520]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638523]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638526]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638529]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638532]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638535]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638538]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638541]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638545]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638548]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638551]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638554]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638558]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638561]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638564]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638567]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638570]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638573]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638576]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638579]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638582]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638585]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638588]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:19 nativespace-cdp sudo[1638591]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638594]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638597]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638600]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638603]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638607]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638612]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638620]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638623]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638626]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  3 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:01:20 nativespace-cdp sudo[1638633]: pam_unix(sudo:session): session closed for user root
Sep  3 05:01:33 nativespace-cdp sshd[1638841]: Connection closed by 159.100.136.21 port 52256 [preauth]
Sep  3 05:06:33 nativespace-cdp sshd[1639933]: Connection closed by 159.100.136.21 port 34348 [preauth]
Sep  3 05:07:46 nativespace-cdp sshd[1640191]: Invalid user test from 103.149.27.228 port 39086
Sep  3 05:07:46 nativespace-cdp sshd[1640191]: input_userauth_request: invalid user test [preauth]
Sep  3 05:07:46 nativespace-cdp sshd[1640191]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 05:07:46 nativespace-cdp sshd[1640191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.27.228
Sep  3 05:07:48 nativespace-cdp sshd[1640191]: Failed password for invalid user test from 103.149.27.228 port 39086 ssh2
Sep  3 05:07:48 nativespace-cdp sshd[1640191]: Received disconnect from 103.149.27.228 port 39086:11: Bye Bye [preauth]
Sep  3 05:07:48 nativespace-cdp sshd[1640191]: Disconnected from 103.149.27.228 port 39086 [preauth]
Sep  3 05:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 05:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:06 nativespace-cdp sudo[1640429]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 05:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:07 nativespace-cdp sudo[1640432]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 05:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:07 nativespace-cdp sudo[1640435]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 05:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:07 nativespace-cdp sudo[1640439]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 05:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:09 nativespace-cdp sudo[1640443]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 05:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:09 nativespace-cdp sudo[1640451]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 05:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:09 nativespace-cdp sudo[1640454]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 05:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:09 nativespace-cdp sudo[1640457]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 05:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:09 nativespace-cdp sudo[1640460]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 05:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:09 nativespace-cdp sudo[1640463]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 05:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:09 nativespace-cdp sudo[1640466]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 05:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:16 nativespace-cdp sudo[1640484]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 05:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:16 nativespace-cdp sudo[1640488]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lucy user-2=attlebor user-3=onlycont user-4=outdoorc user-5=hodgsonmail user-6=ranxterc user-7=branko user-8=romaldki user-9=tomandle user-10=jennimil user-11=chrisdal user-12=mcdermos user-13=david user-14=nbhavers user-15=careers user-16=tstardom user-17=oubpgvbx user-18=what user-19=havantho user-20=sketchy user-21=cath user-22=nvihkvu user-23=stagingerris user-24=dancinggardener user-25=ladburyp user-26=kategilpin user-27=design user-28=nove user-29=boldover user-30=bakery user-31=crrtipdl user-32=sosevalu user-33=fawcettd user-34=burydropin user-35=nsceres user-36=beauty user-37=darkstar user-38=eatspam user-39=dhyana user-40=sibtoncc user-41=asandcoc user-42=bwppodcast user-43=zebrapho user-44=steve user-45=cambria1 user-46=cathski user-47=reliable user-48=ninejimm user-49=cwsocial
Sep  3 05:09:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=pugwash user-51=paulmca1 user-52=howardon user-53=hirefootballgame user-54=eugincou user-55=courseme user-56=nscdp user-57=putterfc user-58=foods user-59=leftie user-60=fortunaz user-61=health2045 user-62=lkpier user-63=firstre5 user-64=steakbridieme user-65=donnychicago user-66=ctedorgu user-67=philmcph user-68=smrszyqg user-69=isleofwi user-70=nomistakes user-71=hidden user-72=tigerlet user-73=barbersh user-74=milloyco user-75=gilpin user-76=elecleis user-77=putterfi user-78=hubmaster user-79=fetch user-80=carsinyo user-81=accooper user-82=ianrayne user-83=connectedshoppin user-84=thqkgnbz user-85=ultbcrra user-86=seftvta user-87=jonhartl user-88=firstres user-89=opaiscyx user-90=coursemc user-91=firstrel user-92=clarkass user-93=costestimatorco user-94=firstred user-95=highlegh user-96=southlon user-97=alexadmin user-98=skyfirec user-99=innovat1 user-100=askhform user-101=stuartge user-102=nativene
Sep  3 05:09:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=nstriton user-104=brighto1 user-105=vivienn1 user-106=firstre2 user-107=oneoarco user-108=battlere user-109=bedfords user-110=newstoda user-111=belle user-112=ggaaorgu user-113=bemadonn user-114=jarvisin user-115=spectrum user-116=theblack user-117=hodgesonweb user-118=agproduc user-119=still user-120=stephani user-121=leereyn1 user-122=markward user-123=foundation user-124=booff user-125=vantagep user-126=connect9 user-127=athenare user-128=lbscrmod user-129=maflemin user-130=ulsukarm user-131=martsblo user-132=dickemery123 user-133=ptkxhsbt user-134=hhdugcor user-135=lbhyisi user-136=magichat user-137=brmrjxl user-138=lakesan1 user-139=strathar user-140=atestord user-141=sarafoundation user-142=wilsonsw user-143=megacards user-144=musorguk feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 05:09:16 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 05:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:16 nativespace-cdp sudo[1640492]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 05:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:17 nativespace-cdp sudo[1640499]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Nzdvm154aluYik8f.~
Sep  3 05:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:17 nativespace-cdp sudo[1640502]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Nzdvm154aluYik8f.~'
Sep  3 05:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:17 nativespace-cdp sudo[1640505]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Nzdvm154aluYik8f.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 05:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:17 nativespace-cdp sudo[1640509]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 05:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:17 nativespace-cdp sudo[1640512]: pam_unix(sudo:session): session closed for user root
Sep  3 05:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 05:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 05:09:18 nativespace-cdp sudo[1640533]: pam_unix(sudo:session): session closed for user root
Sep  3 05:11:05 nativespace-cdp sshd[1641007]: Invalid user hadoop from 103.149.27.228 port 38978
Sep  3 05:11:05 nativespace-cdp sshd[1641007]: input_userauth_request: invalid user hadoop [preauth]
Sep  3 05:11:05 nativespace-cdp sshd[1641007]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 05:11:05 nativespace-cdp sshd[1641007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.27.228
Sep  3 05:11:08 nativespace-cdp sshd[1641007]: Failed password for invalid user hadoop from 103.149.27.228 port 38978 ssh2
Sep  3 05:11:08 nativespace-cdp sshd[1641007]: Received disconnect from 103.149.27.228 port 38978:11: Bye Bye [preauth]
Sep  3 05:11:08 nativespace-cdp sshd[1641007]: Disconnected from 103.149.27.228 port 38978 [preauth]
Sep  3 05:11:33 nativespace-cdp sshd[1641071]: Connection closed by 159.100.136.21 port 44292 [preauth]
Sep  3 05:12:12 nativespace-cdp sshd[1641313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.27.228  user=root
Sep  3 05:12:12 nativespace-cdp sshd[1641313]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 05:12:14 nativespace-cdp sshd[1641313]: Failed password for root from 103.149.27.228 port 52612 ssh2
Sep  3 05:12:15 nativespace-cdp sshd[1641313]: Received disconnect from 103.149.27.228 port 52612:11: Bye Bye [preauth]
Sep  3 05:12:15 nativespace-cdp sshd[1641313]: Disconnected from 103.149.27.228 port 52612 [preauth]
Sep  3 05:16:33 nativespace-cdp sshd[1642301]: Connection closed by 159.100.136.21 port 54502 [preauth]
Sep  3 05:21:33 nativespace-cdp sshd[1643409]: Connection closed by 159.100.136.21 port 36256 [preauth]
Sep  3 05:26:33 nativespace-cdp sshd[1644656]: Connection closed by 159.100.136.21 port 46498 [preauth]
Sep  3 05:31:33 nativespace-cdp sshd[1645686]: Connection closed by 159.100.136.21 port 56534 [preauth]
Sep  3 05:35:09 nativespace-cdp su: pam_unix(su:session): session opened for user ggaaorgu by (uid=0)
Sep  3 05:35:09 nativespace-cdp su[1646436]: pam_unix(su:session): session closed for user ggaaorgu
Sep  3 05:36:33 nativespace-cdp sshd[1646701]: Connection closed by 159.100.136.21 port 38416 [preauth]
Sep  3 05:41:33 nativespace-cdp sshd[1647989]: Connection closed by 159.100.136.21 port 48388 [preauth]
Sep  3 05:46:33 nativespace-cdp sshd[1649048]: Connection closed by 159.100.136.21 port 58578 [preauth]
Sep  3 05:51:33 nativespace-cdp sshd[1650099]: Connection closed by 159.100.136.21 port 40360 [preauth]
Sep  3 05:55:41 nativespace-cdp sshd[1651003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.226.66.81  user=root
Sep  3 05:55:41 nativespace-cdp sshd[1651003]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 05:55:44 nativespace-cdp sshd[1651003]: Failed password for root from 64.226.66.81 port 35564 ssh2
Sep  3 05:55:44 nativespace-cdp sshd[1651003]: Received disconnect from 64.226.66.81 port 35564:11: Bye Bye [preauth]
Sep  3 05:55:44 nativespace-cdp sshd[1651003]: Disconnected from 64.226.66.81 port 35564 [preauth]
Sep  3 05:56:33 nativespace-cdp sshd[1651189]: Connection closed by 159.100.136.21 port 50634 [preauth]
Sep  3 05:57:43 nativespace-cdp sshd[1651503]: Invalid user jia from 64.226.66.81 port 42978
Sep  3 05:57:43 nativespace-cdp sshd[1651503]: input_userauth_request: invalid user jia [preauth]
Sep  3 05:57:43 nativespace-cdp sshd[1651503]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 05:57:43 nativespace-cdp sshd[1651503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.226.66.81
Sep  3 05:57:45 nativespace-cdp sshd[1651503]: Failed password for invalid user jia from 64.226.66.81 port 42978 ssh2
Sep  3 05:57:45 nativespace-cdp sshd[1651503]: Received disconnect from 64.226.66.81 port 42978:11: Bye Bye [preauth]
Sep  3 05:57:45 nativespace-cdp sshd[1651503]: Disconnected from 64.226.66.81 port 42978 [preauth]
Sep  3 05:58:20 nativespace-cdp sshd[1651787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.226.66.81  user=root
Sep  3 05:58:20 nativespace-cdp sshd[1651787]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 05:58:22 nativespace-cdp sshd[1651787]: Failed password for root from 64.226.66.81 port 36418 ssh2
Sep  3 05:58:22 nativespace-cdp sshd[1651787]: Received disconnect from 64.226.66.81 port 36418:11: Bye Bye [preauth]
Sep  3 05:58:22 nativespace-cdp sshd[1651787]: Disconnected from 64.226.66.81 port 36418 [preauth]
Sep  3 06:01:33 nativespace-cdp sshd[1652564]: Connection closed by 159.100.136.21 port 60614 [preauth]
Sep  3 06:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 06:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:03:02 nativespace-cdp sudo[1652917]: pam_unix(sudo:session): session closed for user root
Sep  3 06:06:33 nativespace-cdp sshd[1653627]: Connection closed by 159.100.136.21 port 42686 [preauth]
Sep  3 06:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 06:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:06 nativespace-cdp sudo[1654162]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 06:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:06 nativespace-cdp sudo[1654165]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 06:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:07 nativespace-cdp sudo[1654168]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 06:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:07 nativespace-cdp sudo[1654172]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 06:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:09 nativespace-cdp sudo[1654176]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 06:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:09 nativespace-cdp sudo[1654188]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 06:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:09 nativespace-cdp sudo[1654191]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 06:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:09 nativespace-cdp sudo[1654194]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 06:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:09 nativespace-cdp sudo[1654197]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 06:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:09 nativespace-cdp sudo[1654200]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 06:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:09 nativespace-cdp sudo[1654203]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 06:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:11 nativespace-cdp sudo[1654212]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 06:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:11 nativespace-cdp sudo[1654217]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=burydropin user-2=fawcettd user-3=nsceres user-4=beauty user-5=eatspam user-6=darkstar user-7=dhyana user-8=sibtoncc user-9=asandcoc user-10=bwppodcast user-11=zebrapho user-12=steve user-13=cambria1 user-14=cathski user-15=reliable user-16=ninejimm user-17=paulmca1 user-18=howardon user-19=pugwash user-20=cwsocial user-21=hirefootballgame user-22=eugincou user-23=courseme user-24=putterfc user-25=nscdp user-26=fortunaz user-27=health2045 user-28=leftie user-29=foods user-30=lkpier user-31=ctedorgu user-32=philmcph user-33=firstre5 user-34=steakbridieme user-35=donnychicago user-36=isleofwi user-37=smrszyqg user-38=hidden user-39=nomistakes user-40=tigerlet user-41=barbersh user-42=attlebor user-43=lucy user-44=onlycont user-45=hodgsonmail user-46=ranxterc user-47=outdoorc user-48=branko
Sep  3 06:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=tomandle user-51=jennimil user-52=chrisdal user-53=mcdermos user-54=careers user-55=nbhavers user-56=david user-57=oubpgvbx user-58=tstardom user-59=what user-60=sketchy user-61=cath user-62=havantho user-63=nvihkvu user-64=ladburyp user-65=stagingerris user-66=dancinggardener user-67=kategilpin user-68=design user-69=nove user-70=boldover user-71=bakery user-72=sosevalu user-73=crrtipdl user-74=jarvisin user-75=spectrum user-76=hodgesonweb user-77=theblack user-78=still user-79=agproduc user-80=stephani user-81=leereyn1 user-82=foundation user-83=markward user-84=booff user-85=athenare user-86=connect9 user-87=vantagep user-88=maflemin user-89=lbscrmod user-90=ulsukarm user-91=martsblo user-92=dickemery123 user-93=ptkxhsbt user-94=lbhyisi user-95=hhdugcor user-96=magichat user-97=brmrjxl user-98=lakesan1 user-99=strathar user-100=sarafoundation user-101=atestord user-102=wilsonsw
Sep  3 06:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=musorguk user-104=megacards user-105=gilpin user-106=milloyco user-107=elecleis user-108=hubmaster user-109=putterfi user-110=carsinyo user-111=fetch user-112=accooper user-113=ianrayne user-114=connectedshoppin user-115=thqkgnbz user-116=seftvta user-117=jonhartl user-118=ultbcrra user-119=firstres user-120=opaiscyx user-121=coursemc user-122=clarkass user-123=firstrel user-124=costestimatorco user-125=firstred user-126=southlon user-127=highlegh user-128=skyfirec user-129=alexadmin user-130=innovat1 user-131=stuartge user-132=askhform user-133=nativene user-134=brighto1 user-135=nstriton user-136=firstre2 user-137=vivienn1 user-138=battlere user-139=oneoarco user-140=bedfords user-141=ggaaorgu user-142=belle user-143=newstoda user-144=bemadonn feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 06:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 06:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:12 nativespace-cdp sudo[1654222]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 06:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:12 nativespace-cdp sudo[1654229]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4nkBYFuXoO6XjZHc.~
Sep  3 06:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:12 nativespace-cdp sudo[1654232]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4nkBYFuXoO6XjZHc.~'
Sep  3 06:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:12 nativespace-cdp sudo[1654235]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4nkBYFuXoO6XjZHc.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 06:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:12 nativespace-cdp sudo[1654239]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 06:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:12 nativespace-cdp sudo[1654243]: pam_unix(sudo:session): session closed for user root
Sep  3 06:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 06:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 06:09:13 nativespace-cdp sudo[1654262]: pam_unix(sudo:session): session closed for user root
Sep  3 06:11:33 nativespace-cdp sshd[1654930]: Connection closed by 159.100.136.21 port 52672 [preauth]
Sep  3 06:16:33 nativespace-cdp sshd[1656159]: Connection closed by 159.100.136.21 port 34626 [preauth]
Sep  3 06:21:33 nativespace-cdp sshd[1657178]: Connection closed by 159.100.136.21 port 44608 [preauth]
Sep  3 06:26:33 nativespace-cdp sshd[1658219]: Connection closed by 159.100.136.21 port 54878 [preauth]
Sep  3 06:31:33 nativespace-cdp sshd[1659556]: Connection closed by 159.100.136.21 port 36648 [preauth]
Sep  3 06:36:33 nativespace-cdp sshd[1660634]: Connection closed by 159.100.136.21 port 46942 [preauth]
Sep  3 06:41:33 nativespace-cdp sshd[1661997]: Connection closed by 159.100.136.21 port 56898 [preauth]
Sep  3 06:46:33 nativespace-cdp sshd[1663127]: Connection closed by 159.100.136.21 port 38904 [preauth]
Sep  3 06:51:33 nativespace-cdp sshd[1664501]: Connection closed by 159.100.136.21 port 48890 [preauth]
Sep  3 06:56:33 nativespace-cdp sshd[1665712]: Connection closed by 159.100.136.21 port 59148 [preauth]
Sep  3 07:01:33 nativespace-cdp sshd[1667166]: Connection closed by 159.100.136.21 port 40900 [preauth]
Sep  3 07:06:33 nativespace-cdp sshd[1668371]: Connection closed by 159.100.136.21 port 51220 [preauth]
Sep  3 07:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 07:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:09 nativespace-cdp sudo[1668978]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 07:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:09 nativespace-cdp sudo[1668981]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 07:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:10 nativespace-cdp sudo[1668984]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 07:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:10 nativespace-cdp sudo[1668989]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 07:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:11 nativespace-cdp sudo[1668992]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 07:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:11 nativespace-cdp sudo[1669007]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 07:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:11 nativespace-cdp sudo[1669010]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 07:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:11 nativespace-cdp sudo[1669013]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 07:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:11 nativespace-cdp sudo[1669017]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 07:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:11 nativespace-cdp sudo[1669020]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 07:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:11 nativespace-cdp sudo[1669023]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 07:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:13 nativespace-cdp sudo[1669036]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 07:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:13 nativespace-cdp sudo[1669041]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lbhyisi user-2=hhdugcor user-3=magichat user-4=martsblo user-5=dickemery123 user-6=ptkxhsbt user-7=wilsonsw user-8=musorguk user-9=megacards user-10=lakesan1 user-11=brmrjxl user-12=strathar user-13=sarafoundation user-14=atestord user-15=still user-16=agproduc user-17=stephani user-18=leereyn1 user-19=jarvisin user-20=spectrum user-21=theblack user-22=hodgesonweb user-23=ulsukarm user-24=markward user-25=booff user-26=foundation user-27=athenare user-28=connect9 user-29=vantagep user-30=maflemin user-31=lbscrmod user-32=innovat1 user-33=stuartge user-34=askhform user-35=nativene user-36=alexadmin user-37=skyfirec user-38=bedfords user-39=ggaaorgu user-40=belle user-41=newstoda user-42=bemadonn user-43=brighto1 user-44=nstriton user-45=firstre2 user-46=vivienn1 user-47=battlere user-48=oneoarco
Sep  3 07:09:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=accooper user-50=ianrayne user-51=connectedshoppin user-52=thqkgnbz user-53=milloyco user-54=gilpin user-55=elecleis user-56=hubmaster user-57=putterfi user-58=carsinyo user-59=fetch user-60=clarkass user-61=firstrel user-62=costestimatorco user-63=firstred user-64=southlon user-65=highlegh user-66=seftvta user-67=jonhartl user-68=ultbcrra user-69=firstres user-70=opaiscyx user-71=coursemc user-72=hirefootballgame user-73=eugincou user-74=courseme user-75=cambria1 user-76=cathski user-77=ninejimm user-78=reliable user-79=paulmca1 user-80=howardon user-81=pugwash user-82=cwsocial user-83=isleofwi user-84=smrszyqg user-85=hidden user-86=nomistakes user-87=barbersh user-88=tigerlet user-89=putterfc user-90=nscdp user-91=fortunaz user-92=health2045 user-93=foods user-94=leftie user-95=lkpier user-96=ctedorgu user-97=philmcph user-98=firstre5 user-99=donnychicago user-100=steakbridieme user-101=beauty
Sep  3 07:09:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=eatspam user-103=darkstar user-104=dhyana user-105=burydropin user-106=fawcettd user-107=nsceres user-108=bwppodcast user-109=zebrapho user-110=steve user-111=asandcoc user-112=sibtoncc user-113=ladburyp user-114=stagingerris user-115=dancinggardener user-116=kategilpin user-117=design user-118=tstardom user-119=oubpgvbx user-120=what user-121=cath user-122=sketchy user-123=havantho user-124=nvihkvu user-125=bakery user-126=sosevalu user-127=crrtipdl user-128=nove user-129=boldover user-130=ranxterc user-131=hodgsonmail user-132=outdoorc user-133=branko user-134=romaldki user-135=attlebor user-136=lucy user-137=onlycont user-138=chrisdal user-139=mcdermos user-140=nbhavers user-141=careers user-142=david user-143=tomandle user-144=jennimil feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 07:09:13 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 07:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:15 nativespace-cdp sudo[1669047]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 07:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:15 nativespace-cdp sudo[1669055]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-0lNzkGrS4qjJ56Kk.~
Sep  3 07:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:15 nativespace-cdp sudo[1669058]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-0lNzkGrS4qjJ56Kk.~'
Sep  3 07:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:15 nativespace-cdp sudo[1669061]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-0lNzkGrS4qjJ56Kk.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 07:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:15 nativespace-cdp sudo[1669065]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 07:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:15 nativespace-cdp sudo[1669068]: pam_unix(sudo:session): session closed for user root
Sep  3 07:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 07:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 07:09:16 nativespace-cdp sudo[1669087]: pam_unix(sudo:session): session closed for user root
Sep  3 07:11:33 nativespace-cdp sshd[1669873]: Connection closed by 159.100.136.21 port 32958 [preauth]
Sep  3 07:16:33 nativespace-cdp sshd[1671034]: Connection closed by 159.100.136.21 port 43182 [preauth]
Sep  3 07:21:33 nativespace-cdp sshd[1672109]: Connection closed by 159.100.136.21 port 53130 [preauth]
Sep  3 07:26:33 nativespace-cdp sshd[1673351]: Connection closed by 159.100.136.21 port 35180 [preauth]
Sep  3 07:29:52 nativespace-cdp sshd[1673962]: Invalid user imp from 202.158.139.57 port 32840
Sep  3 07:29:52 nativespace-cdp sshd[1673962]: input_userauth_request: invalid user imp [preauth]
Sep  3 07:29:52 nativespace-cdp sshd[1673962]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 07:29:52 nativespace-cdp sshd[1673962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.158.139.57
Sep  3 07:29:54 nativespace-cdp sshd[1673962]: Failed password for invalid user imp from 202.158.139.57 port 32840 ssh2
Sep  3 07:29:55 nativespace-cdp sshd[1673962]: Received disconnect from 202.158.139.57 port 32840:11: Bye Bye [preauth]
Sep  3 07:29:55 nativespace-cdp sshd[1673962]: Disconnected from 202.158.139.57 port 32840 [preauth]
Sep  3 07:29:58 nativespace-cdp sshd[1673973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.214.197.163  user=root
Sep  3 07:29:58 nativespace-cdp sshd[1673973]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 07:30:01 nativespace-cdp sshd[1673973]: Failed password for root from 1.214.197.163 port 46438 ssh2
Sep  3 07:30:01 nativespace-cdp sshd[1673973]: Received disconnect from 1.214.197.163 port 46438:11: Bye Bye [preauth]
Sep  3 07:30:01 nativespace-cdp sshd[1673973]: Disconnected from 1.214.197.163 port 46438 [preauth]
Sep  3 07:31:33 nativespace-cdp sshd[1674664]: Connection closed by 159.100.136.21 port 45218 [preauth]
Sep  3 07:35:08 nativespace-cdp sshd[1675526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=135.0.208.122  user=root
Sep  3 07:35:08 nativespace-cdp sshd[1675526]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 07:35:11 nativespace-cdp sshd[1675526]: Failed password for root from 135.0.208.122 port 54826 ssh2
Sep  3 07:35:11 nativespace-cdp sshd[1675526]: Received disconnect from 135.0.208.122 port 54826:11: Bye Bye [preauth]
Sep  3 07:35:11 nativespace-cdp sshd[1675526]: Disconnected from 135.0.208.122 port 54826 [preauth]
Sep  3 07:35:18 nativespace-cdp sshd[1675595]: Invalid user diana from 45.119.81.249 port 58152
Sep  3 07:35:18 nativespace-cdp sshd[1675595]: input_userauth_request: invalid user diana [preauth]
Sep  3 07:35:18 nativespace-cdp sshd[1675595]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 07:35:18 nativespace-cdp sshd[1675595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.119.81.249
Sep  3 07:35:20 nativespace-cdp sshd[1675595]: Failed password for invalid user diana from 45.119.81.249 port 58152 ssh2
Sep  3 07:35:20 nativespace-cdp sshd[1675595]: Received disconnect from 45.119.81.249 port 58152:11: Bye Bye [preauth]
Sep  3 07:35:20 nativespace-cdp sshd[1675595]: Disconnected from 45.119.81.249 port 58152 [preauth]
Sep  3 07:35:58 nativespace-cdp sshd[1675720]: Invalid user marieke from 1.214.197.163 port 37230
Sep  3 07:35:58 nativespace-cdp sshd[1675720]: input_userauth_request: invalid user marieke [preauth]
Sep  3 07:35:58 nativespace-cdp sshd[1675720]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 07:35:58 nativespace-cdp sshd[1675720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.214.197.163
Sep  3 07:36:00 nativespace-cdp sshd[1675720]: Failed password for invalid user marieke from 1.214.197.163 port 37230 ssh2
Sep  3 07:36:00 nativespace-cdp sshd[1675720]: Received disconnect from 1.214.197.163 port 37230:11: Bye Bye [preauth]
Sep  3 07:36:00 nativespace-cdp sshd[1675720]: Disconnected from 1.214.197.163 port 37230 [preauth]
Sep  3 07:36:33 nativespace-cdp sshd[1675898]: Invalid user aa from 202.158.139.57 port 53716
Sep  3 07:36:33 nativespace-cdp sshd[1675898]: input_userauth_request: invalid user aa [preauth]
Sep  3 07:36:33 nativespace-cdp sshd[1675898]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 07:36:33 nativespace-cdp sshd[1675898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.158.139.57
Sep  3 07:36:33 nativespace-cdp sshd[1675905]: Connection closed by 159.100.136.21 port 55492 [preauth]
Sep  3 07:36:34 nativespace-cdp sshd[1675910]: Invalid user diana from 135.0.208.122 port 38490
Sep  3 07:36:34 nativespace-cdp sshd[1675910]: input_userauth_request: invalid user diana [preauth]
Sep  3 07:36:34 nativespace-cdp sshd[1675910]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 07:36:34 nativespace-cdp sshd[1675910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=135.0.208.122
Sep  3 07:36:35 nativespace-cdp sshd[1675898]: Failed password for invalid user aa from 202.158.139.57 port 53716 ssh2
Sep  3 07:36:35 nativespace-cdp sshd[1675898]: Received disconnect from 202.158.139.57 port 53716:11: Bye Bye [preauth]
Sep  3 07:36:35 nativespace-cdp sshd[1675898]: Disconnected from 202.158.139.57 port 53716 [preauth]
Sep  3 07:36:36 nativespace-cdp sshd[1675910]: Failed password for invalid user diana from 135.0.208.122 port 38490 ssh2
Sep  3 07:36:36 nativespace-cdp sshd[1675910]: Received disconnect from 135.0.208.122 port 38490:11: Bye Bye [preauth]
Sep  3 07:36:36 nativespace-cdp sshd[1675910]: Disconnected from 135.0.208.122 port 38490 [preauth]
Sep  3 07:36:50 nativespace-cdp sshd[1675958]: Invalid user teamspeak3 from 1.214.197.163 port 52532
Sep  3 07:36:50 nativespace-cdp sshd[1675958]: input_userauth_request: invalid user teamspeak3 [preauth]
Sep  3 07:36:50 nativespace-cdp sshd[1675958]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 07:36:50 nativespace-cdp sshd[1675958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.214.197.163
Sep  3 07:36:52 nativespace-cdp sshd[1675958]: Failed password for invalid user teamspeak3 from 1.214.197.163 port 52532 ssh2
Sep  3 07:36:52 nativespace-cdp sshd[1675958]: Received disconnect from 1.214.197.163 port 52532:11: Bye Bye [preauth]
Sep  3 07:36:52 nativespace-cdp sshd[1675958]: Disconnected from 1.214.197.163 port 52532 [preauth]
Sep  3 07:37:13 nativespace-cdp sshd[1676068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=135.0.208.122  user=lp
Sep  3 07:37:13 nativespace-cdp sshd[1676068]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "lp"
Sep  3 07:37:15 nativespace-cdp sshd[1676068]: Failed password for lp from 135.0.208.122 port 51448 ssh2
Sep  3 07:37:15 nativespace-cdp sshd[1676068]: Received disconnect from 135.0.208.122 port 51448:11: Bye Bye [preauth]
Sep  3 07:37:15 nativespace-cdp sshd[1676068]: Disconnected from 135.0.208.122 port 51448 [preauth]
Sep  3 07:37:20 nativespace-cdp sshd[1676118]: Invalid user tarun from 202.158.139.57 port 38248
Sep  3 07:37:20 nativespace-cdp sshd[1676118]: input_userauth_request: invalid user tarun [preauth]
Sep  3 07:37:20 nativespace-cdp sshd[1676118]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 07:37:20 nativespace-cdp sshd[1676118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.158.139.57
Sep  3 07:37:22 nativespace-cdp sshd[1676118]: Failed password for invalid user tarun from 202.158.139.57 port 38248 ssh2
Sep  3 07:37:22 nativespace-cdp sshd[1676118]: Received disconnect from 202.158.139.57 port 38248:11: Bye Bye [preauth]
Sep  3 07:37:22 nativespace-cdp sshd[1676118]: Disconnected from 202.158.139.57 port 38248 [preauth]
Sep  3 07:37:50 nativespace-cdp sshd[1676304]: Invalid user andrea from 45.119.81.249 port 51656
Sep  3 07:37:50 nativespace-cdp sshd[1676304]: input_userauth_request: invalid user andrea [preauth]
Sep  3 07:37:50 nativespace-cdp sshd[1676304]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 07:37:50 nativespace-cdp sshd[1676304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.119.81.249
Sep  3 07:37:52 nativespace-cdp sshd[1676304]: Failed password for invalid user andrea from 45.119.81.249 port 51656 ssh2
Sep  3 07:37:52 nativespace-cdp sshd[1676304]: Received disconnect from 45.119.81.249 port 51656:11: Bye Bye [preauth]
Sep  3 07:37:52 nativespace-cdp sshd[1676304]: Disconnected from 45.119.81.249 port 51656 [preauth]
Sep  3 07:39:02 nativespace-cdp sshd[1676559]: Invalid user guard from 45.119.81.249 port 36782
Sep  3 07:39:02 nativespace-cdp sshd[1676559]: input_userauth_request: invalid user guard [preauth]
Sep  3 07:39:02 nativespace-cdp sshd[1676559]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 07:39:02 nativespace-cdp sshd[1676559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.119.81.249
Sep  3 07:39:04 nativespace-cdp sshd[1676559]: Failed password for invalid user guard from 45.119.81.249 port 36782 ssh2
Sep  3 07:39:04 nativespace-cdp sshd[1676559]: Received disconnect from 45.119.81.249 port 36782:11: Bye Bye [preauth]
Sep  3 07:39:04 nativespace-cdp sshd[1676559]: Disconnected from 45.119.81.249 port 36782 [preauth]
Sep  3 07:41:33 nativespace-cdp sshd[1677423]: Connection closed by 159.100.136.21 port 37218 [preauth]
Sep  3 07:46:33 nativespace-cdp sshd[1678600]: Connection closed by 159.100.136.21 port 47460 [preauth]
Sep  3 07:51:33 nativespace-cdp sshd[1679801]: Connection closed by 159.100.136.21 port 57428 [preauth]
Sep  3 07:56:33 nativespace-cdp sshd[1681220]: Connection closed by 159.100.136.21 port 39470 [preauth]
Sep  3 08:01:33 nativespace-cdp sshd[1682677]: Connection closed by 159.100.136.21 port 49452 [preauth]
Sep  3 08:06:33 nativespace-cdp sshd[1684010]: Connection closed by 159.100.136.21 port 59762 [preauth]
Sep  3 08:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 08:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:32 nativespace-cdp sudo[1684668]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 08:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:32 nativespace-cdp sudo[1684672]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 08:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:37 nativespace-cdp sudo[1684676]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 08:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:37 nativespace-cdp sudo[1684694]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 08:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:43 nativespace-cdp sudo[1684698]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 08:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:43 nativespace-cdp sudo[1684737]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 08:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:43 nativespace-cdp sudo[1684740]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 08:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:43 nativespace-cdp sudo[1684743]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 08:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:43 nativespace-cdp sudo[1684746]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 08:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:43 nativespace-cdp sudo[1684749]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 08:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:43 nativespace-cdp sudo[1684752]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 08:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:45 nativespace-cdp sudo[1684760]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 08:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:47 nativespace-cdp sudo[1684767]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=burydropin user-2=fawcettd user-3=nsceres user-4=beauty user-5=eatspam user-6=darkstar user-7=dhyana user-8=sibtoncc user-9=asandcoc user-10=bwppodcast user-11=zebrapho user-12=steve user-13=cathski user-14=cambria1 user-15=reliable user-16=ninejimm user-17=pugwash user-18=paulmca1 user-19=howardon user-20=cwsocial user-21=hirefootballgame user-22=eugincou user-23=courseme user-24=putterfc user-25=nscdp user-26=health2045 user-27=fortunaz user-28=leftie user-29=foods user-30=lkpier user-31=ctedorgu user-32=philmcph user-33=firstre5 user-34=steakbridieme user-35=donnychicago user-36=isleofwi user-37=smrszyqg user-38=hidden user-39=nomistakes user-40=barbersh user-41=tigerlet user-42=attlebor user-43=lucy user-44=onlycont user-45=outdoorc user-46=hodgsonmail user-47=ranxterc user-48=branko
Sep  3 08:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=tomandle user-51=jennimil user-52=chrisdal user-53=mcdermos user-54=nbhavers user-55=careers user-56=david user-57=oubpgvbx user-58=tstardom user-59=what user-60=cath user-61=sketchy user-62=havantho user-63=nvihkvu user-64=ladburyp user-65=stagingerris user-66=dancinggardener user-67=kategilpin user-68=design user-69=nove user-70=boldover user-71=bakery user-72=sosevalu user-73=crrtipdl user-74=jarvisin user-75=spectrum user-76=hodgesonweb user-77=theblack user-78=still user-79=agproduc user-80=stephani user-81=leereyn1 user-82=foundation user-83=markward user-84=booff user-85=athenare user-86=connect9 user-87=vantagep user-88=maflemin user-89=lbscrmod user-90=ulsukarm user-91=martsblo user-92=dickemery123 user-93=ptkxhsbt user-94=lbhyisi user-95=hhdugcor user-96=magichat user-97=brmrjxl user-98=lakesan1 user-99=strathar user-100=sarafoundation user-101=atestord user-102=wilsonsw
Sep  3 08:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=musorguk user-104=megacards user-105=gilpin user-106=milloyco user-107=elecleis user-108=hubmaster user-109=putterfi user-110=carsinyo user-111=fetch user-112=accooper user-113=ianrayne user-114=connectedshoppin user-115=thqkgnbz user-116=jonhartl user-117=seftvta user-118=ultbcrra user-119=firstres user-120=opaiscyx user-121=coursemc user-122=clarkass user-123=firstrel user-124=costestimatorco user-125=firstred user-126=southlon user-127=highlegh user-128=alexadmin user-129=skyfirec user-130=innovat1 user-131=askhform user-132=stuartge user-133=nativene user-134=brighto1 user-135=nstriton user-136=firstre2 user-137=vivienn1 user-138=battlere user-139=oneoarco user-140=bedfords user-141=belle user-142=ggaaorgu user-143=newstoda user-144=bemadonn feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 08:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 08:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:48 nativespace-cdp sudo[1684773]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 08:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:48 nativespace-cdp sudo[1684781]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-HrDxVLSpGOg9R8Fi.~
Sep  3 08:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:49 nativespace-cdp sudo[1684784]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-HrDxVLSpGOg9R8Fi.~'
Sep  3 08:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:49 nativespace-cdp sudo[1684788]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-HrDxVLSpGOg9R8Fi.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 08:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:49 nativespace-cdp sudo[1684792]: pam_unix(sudo:session): session closed for user root
Sep  3 08:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 08:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:09:49 nativespace-cdp sudo[1684796]: pam_unix(sudo:session): session closed for user root
Sep  3 08:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 08:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 08:10:06 nativespace-cdp sudo[1685096]: pam_unix(sudo:session): session closed for user root
Sep  3 08:11:33 nativespace-cdp sshd[1685417]: Connection closed by 159.100.136.21 port 41504 [preauth]
Sep  3 08:16:33 nativespace-cdp sshd[1686771]: Connection closed by 159.100.136.21 port 51728 [preauth]
Sep  3 08:21:33 nativespace-cdp sshd[1688067]: Connection closed by 159.100.136.21 port 33170 [preauth]
Sep  3 08:26:33 nativespace-cdp sshd[1689508]: Connection closed by 159.100.136.21 port 43438 [preauth]
Sep  3 08:31:33 nativespace-cdp sshd[1690762]: Connection closed by 159.100.136.21 port 53482 [preauth]
Sep  3 08:36:33 nativespace-cdp sshd[1692180]: Connection closed by 159.100.136.21 port 35514 [preauth]
Sep  3 08:41:33 nativespace-cdp sshd[1693409]: Connection closed by 159.100.136.21 port 45496 [preauth]
Sep  3 08:46:33 nativespace-cdp sshd[1694889]: Connection closed by 159.100.136.21 port 55704 [preauth]
Sep  3 08:51:33 nativespace-cdp sshd[1696058]: Connection closed by 159.100.136.21 port 37458 [preauth]
Sep  3 08:56:33 nativespace-cdp sshd[1697412]: Connection closed by 159.100.136.21 port 47738 [preauth]
Sep  3 09:01:33 nativespace-cdp sshd[1699016]: Connection closed by 159.100.136.21 port 57728 [preauth]
Sep  3 09:06:33 nativespace-cdp sshd[1700573]: Connection closed by 159.100.136.21 port 39814 [preauth]
Sep  3 09:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 09:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:33 nativespace-cdp sudo[1701350]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 09:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:33 nativespace-cdp sudo[1701353]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 09:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:51 nativespace-cdp sudo[1701356]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 09:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:51 nativespace-cdp sudo[1701410]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 09:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:55 nativespace-cdp sudo[1701417]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:56 nativespace-cdp sudo[1701434]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:56 nativespace-cdp sudo[1701439]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:56 nativespace-cdp sudo[1701443]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:56 nativespace-cdp sudo[1701448]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:56 nativespace-cdp sudo[1701454]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:56 nativespace-cdp sudo[1701459]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 09:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:09:58 nativespace-cdp sudo[1701545]: pam_unix(sudo:session): session closed for user root
Sep  3 09:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 09:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:10:01 nativespace-cdp sudo[1701577]: pam_unix(sudo:session): session closed for user root
Sep  3 09:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=gilpin user-2=milloyco user-3=elecleis user-4=hubmaster user-5=putterfi user-6=fetch user-7=carsinyo user-8=accooper user-9=ianrayne user-10=connectedshoppin user-11=thqkgnbz user-12=ultbcrra user-13=seftvta user-14=jonhartl user-15=firstres user-16=opaiscyx user-17=coursemc user-18=firstrel user-19=clarkass user-20=costestimatorco user-21=firstred user-22=highlegh user-23=southlon user-24=alexadmin user-25=skyfirec user-26=innovat1 user-27=stuartge user-28=askhform user-29=nativene user-30=nstriton user-31=brighto1 user-32=vivienn1 user-33=firstre2 user-34=oneoarco user-35=battlere user-36=bedfords user-37=newstoda user-38=belle user-39=ggaaorgu user-40=bemadonn user-41=jarvisin user-42=spectrum user-43=hodgesonweb user-44=theblack user-45=agproduc user-46=still user-47=stephani
Sep  3 09:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=leereyn1 user-49=markward user-50=booff user-51=foundation user-52=vantagep user-53=connect9 user-54=athenare user-55=lbscrmod user-56=maflemin user-57=ulsukarm user-58=martsblo user-59=dickemery123 user-60=ptkxhsbt user-61=hhdugcor user-62=lbhyisi user-63=magichat user-64=lakesan1 user-65=brmrjxl user-66=strathar user-67=atestord user-68=sarafoundation user-69=wilsonsw user-70=megacards user-71=musorguk user-72=lucy user-73=attlebor user-74=onlycont user-75=hodgsonmail user-76=outdoorc user-77=ranxterc user-78=branko user-79=romaldki user-80=tomandle user-81=jennimil user-82=chrisdal user-83=mcdermos user-84=david user-85=careers user-86=nbhavers user-87=tstardom user-88=oubpgvbx user-89=what user-90=havantho user-91=sketchy user-92=cath user-93=nvihkvu user-94=dancinggardener user-95=stagingerris user-96=ladburyp user-97=kategilpin user-98=design user-99=nove user-100=boldover user-101=bakery
Sep  3 09:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=crrtipdl user-103=sosevalu user-104=fawcettd user-105=burydropin user-106=nsceres user-107=beauty user-108=darkstar user-109=eatspam user-110=dhyana user-111=sibtoncc user-112=asandcoc user-113=bwppodcast user-114=zebrapho user-115=steve user-116=cambria1 user-117=cathski user-118=ninejimm user-119=reliable user-120=cwsocial user-121=paulmca1 user-122=pugwash user-123=howardon user-124=hirefootballgame user-125=eugincou user-126=courseme user-127=nscdp user-128=putterfc user-129=foods user-130=leftie user-131=health2045 user-132=fortunaz user-133=lkpier user-134=firstre5 user-135=donnychicago user-136=steakbridieme user-137=philmcph user-138=ctedorgu user-139=isleofwi user-140=smrszyqg user-141=nomistakes user-142=hidden user-143=barbersh user-144=tigerlet feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  3 09:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 09:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:10:08 nativespace-cdp sudo[1701744]: pam_unix(sudo:session): session closed for user root
Sep  3 09:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 09:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:10:11 nativespace-cdp sudo[1701985]: pam_unix(sudo:session): session closed for user root
Sep  3 09:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VmsKT5Ym69HY7GOb.~
Sep  3 09:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:10:12 nativespace-cdp sudo[1701996]: pam_unix(sudo:session): session closed for user root
Sep  3 09:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VmsKT5Ym69HY7GOb.~'
Sep  3 09:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:10:12 nativespace-cdp sudo[1702000]: pam_unix(sudo:session): session closed for user root
Sep  3 09:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VmsKT5Ym69HY7GOb.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 09:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:10:12 nativespace-cdp sudo[1702004]: pam_unix(sudo:session): session closed for user root
Sep  3 09:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 09:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:10:12 nativespace-cdp sudo[1702008]: pam_unix(sudo:session): session closed for user root
Sep  3 09:10:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 09:10:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 09:10:45 nativespace-cdp sudo[1702253]: pam_unix(sudo:session): session closed for user root
Sep  3 09:11:33 nativespace-cdp sshd[1702448]: Connection closed by 159.100.136.21 port 49760 [preauth]
Sep  3 09:16:33 nativespace-cdp sshd[1703707]: Connection closed by 159.100.136.21 port 59974 [preauth]
Sep  3 09:21:33 nativespace-cdp sshd[1704972]: Connection closed by 159.100.136.21 port 41722 [preauth]
Sep  3 09:26:33 nativespace-cdp sshd[1706520]: Connection closed by 159.100.136.21 port 52000 [preauth]
Sep  3 09:31:33 nativespace-cdp sshd[1707989]: Connection closed by 159.100.136.21 port 33768 [preauth]
Sep  3 09:36:33 nativespace-cdp sshd[1709297]: Connection closed by 159.100.136.21 port 44056 [preauth]
Sep  3 09:41:33 nativespace-cdp sshd[1710838]: Connection closed by 159.100.136.21 port 54034 [preauth]
Sep  3 09:46:33 nativespace-cdp sshd[1712160]: Connection closed by 159.100.136.21 port 36060 [preauth]
Sep  3 09:51:33 nativespace-cdp sshd[1713699]: Connection closed by 159.100.136.21 port 46076 [preauth]
Sep  3 09:56:33 nativespace-cdp sshd[1714934]: Connection closed by 159.100.136.21 port 56372 [preauth]
Sep  3 10:01:33 nativespace-cdp sshd[1716513]: Connection closed by 159.100.136.21 port 38142 [preauth]
Sep  3 10:06:33 nativespace-cdp sshd[1717817]: Connection closed by 159.100.136.21 port 48474 [preauth]
Sep  3 10:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 10:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:22 nativespace-cdp sudo[1718529]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 10:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:22 nativespace-cdp sudo[1718534]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 10:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:27 nativespace-cdp sudo[1718537]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:27 nativespace-cdp sudo[1718549]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:31 nativespace-cdp sudo[1718552]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:32 nativespace-cdp sudo[1718572]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:32 nativespace-cdp sudo[1718577]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:32 nativespace-cdp sudo[1718581]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:32 nativespace-cdp sudo[1718586]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:32 nativespace-cdp sudo[1718592]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:32 nativespace-cdp sudo[1718597]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 10:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:35 nativespace-cdp sudo[1718609]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 10:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:35 nativespace-cdp sudo[1718616]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=sarafoundation user-2=atestord user-3=strathar user-4=brmrjxl user-5=lakesan1 user-6=musorguk user-7=megacards user-8=wilsonsw user-9=ptkxhsbt user-10=dickemery123 user-11=martsblo user-12=magichat user-13=lbhyisi user-14=hhdugcor user-15=maflemin user-16=lbscrmod user-17=athenare user-18=connect9 user-19=vantagep user-20=markward user-21=booff user-22=foundation user-23=ulsukarm user-24=theblack user-25=hodgesonweb user-26=spectrum user-27=jarvisin user-28=leereyn1 user-29=stephani user-30=still user-31=agproduc user-32=battlere user-33=oneoarco user-34=firstre2 user-35=vivienn1 user-36=brighto1 user-37=nstriton user-38=bemadonn user-39=belle user-40=ggaaorgu user-41=newstoda user-42=bedfords user-43=alexadmin user-44=skyfirec user-45=nativene user-46=askhform user-47=stuartge user-48=innovat1
Sep  3 10:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=opaiscyx user-50=coursemc user-51=firstres user-52=seftvta user-53=jonhartl user-54=ultbcrra user-55=southlon user-56=highlegh user-57=firstred user-58=costestimatorco user-59=firstrel user-60=clarkass user-61=carsinyo user-62=fetch user-63=hubmaster user-64=putterfi user-65=elecleis user-66=milloyco user-67=gilpin user-68=thqkgnbz user-69=connectedshoppin user-70=ianrayne user-71=accooper user-72=philmcph user-73=ctedorgu user-74=donnychicago user-75=firstre5 user-76=steakbridieme user-77=lkpier user-78=health2045 user-79=fortunaz user-80=foods user-81=leftie user-82=putterfc user-83=nscdp user-84=barbersh user-85=tigerlet user-86=hidden user-87=nomistakes user-88=smrszyqg user-89=isleofwi user-90=paulmca1 user-91=howardon user-92=pugwash user-93=cwsocial user-94=ninejimm user-95=reliable user-96=cathski user-97=cambria1 user-98=courseme user-99=eugincou user-100=hirefootballgame user-101=sibtoncc
Sep  3 10:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=asandcoc user-103=steve user-104=zebrapho user-105=bwppodcast user-106=nsceres user-107=burydropin user-108=fawcettd user-109=dhyana user-110=eatspam user-111=darkstar user-112=beauty user-113=boldover user-114=nove user-115=sosevalu user-116=crrtipdl user-117=bakery user-118=nvihkvu user-119=sketchy user-120=cath user-121=havantho user-122=what user-123=oubpgvbx user-124=tstardom user-125=design user-126=kategilpin user-127=ladburyp user-128=dancinggardener user-129=stagingerris user-130=jennimil user-131=tomandle user-132=careers user-133=nbhavers user-134=david user-135=mcdermos user-136=chrisdal user-137=onlycont user-138=attlebor user-139=lucy user-140=romaldki user-141=branko user-142=hodgsonmail user-143=ranxterc user-144=outdoorc feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 10:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 10:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:38 nativespace-cdp sudo[1718624]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 10:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:39 nativespace-cdp sudo[1718637]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nxi4bvO2AZ0Qagwo.~
Sep  3 10:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:39 nativespace-cdp sudo[1718642]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nxi4bvO2AZ0Qagwo.~'
Sep  3 10:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:39 nativespace-cdp sudo[1718646]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nxi4bvO2AZ0Qagwo.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 10:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:39 nativespace-cdp sudo[1718652]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 10:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:39 nativespace-cdp sudo[1718657]: pam_unix(sudo:session): session closed for user root
Sep  3 10:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 10:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 10:09:42 nativespace-cdp sudo[1718686]: pam_unix(sudo:session): session closed for user root
Sep  3 10:11:33 nativespace-cdp sshd[1719460]: Connection closed by 159.100.136.21 port 58494 [preauth]
Sep  3 10:16:33 nativespace-cdp sshd[1720768]: Connection closed by 159.100.136.21 port 40486 [preauth]
Sep  3 10:21:33 nativespace-cdp sshd[1722171]: Connection closed by 159.100.136.21 port 50476 [preauth]
Sep  3 10:26:33 nativespace-cdp sshd[1723760]: Connection closed by 159.100.136.21 port 60762 [preauth]
Sep  3 10:31:33 nativespace-cdp sshd[1725174]: Connection closed by 159.100.136.21 port 42604 [preauth]
Sep  3 10:36:33 nativespace-cdp sshd[1726406]: Connection closed by 159.100.136.21 port 52928 [preauth]
Sep  3 10:41:33 nativespace-cdp sshd[1727737]: Connection closed by 159.100.136.21 port 34668 [preauth]
Sep  3 10:46:33 nativespace-cdp sshd[1729256]: Connection closed by 159.100.136.21 port 44932 [preauth]
Sep  3 10:51:33 nativespace-cdp sshd[1730686]: Connection closed by 159.100.136.21 port 54962 [preauth]
Sep  3 10:56:33 nativespace-cdp sshd[1732231]: Connection closed by 159.100.136.21 port 36996 [preauth]
Sep  3 11:01:33 nativespace-cdp sshd[1733677]: Connection closed by 159.100.136.21 port 47006 [preauth]
Sep  3 11:06:33 nativespace-cdp sshd[1734986]: Connection closed by 159.100.136.21 port 57346 [preauth]
Sep  3 11:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 11:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:31 nativespace-cdp sudo[1735766]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 11:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:31 nativespace-cdp sudo[1735772]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 11:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:32 nativespace-cdp sudo[1735775]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:32 nativespace-cdp sudo[1735785]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:36 nativespace-cdp sudo[1735791]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 11:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:36 nativespace-cdp sudo[1735808]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 11:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:36 nativespace-cdp sudo[1735813]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 11:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:36 nativespace-cdp sudo[1735817]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 11:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:36 nativespace-cdp sudo[1735822]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 11:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:36 nativespace-cdp sudo[1735829]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 11:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:36 nativespace-cdp sudo[1735834]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:38 nativespace-cdp sudo[1735849]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:39 nativespace-cdp sudo[1735856]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=reliable user-2=ninejimm user-3=cambria1 user-4=cathski user-5=howardon user-6=paulmca1 user-7=pugwash user-8=cwsocial user-9=hirefootballgame user-10=courseme user-11=eugincou user-12=health2045 user-13=fortunaz user-14=foods user-15=leftie user-16=putterfc user-17=nscdp user-18=philmcph user-19=ctedorgu user-20=firstre5 user-21=donnychicago user-22=steakbridieme user-23=lkpier user-24=smrszyqg user-25=isleofwi user-26=tigerlet user-27=barbersh user-28=hidden user-29=nomistakes user-30=burydropin user-31=fawcettd user-32=nsceres user-33=eatspam user-34=darkstar user-35=beauty user-36=dhyana user-37=asandcoc user-38=sibtoncc user-39=zebrapho user-40=bwppodcast user-41=steve user-42=what user-43=tstardom user-44=oubpgvbx user-45=nvihkvu user-46=cath user-47=sketchy user-48=havantho
Sep  3 11:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=kategilpin user-50=ladburyp user-51=stagingerris user-52=dancinggardener user-53=design user-54=nove user-55=boldover user-56=sosevalu user-57=crrtipdl user-58=bakery user-59=attlebor user-60=lucy user-61=onlycont user-62=branko user-63=outdoorc user-64=hodgsonmail user-65=ranxterc user-66=romaldki user-67=tomandle user-68=jennimil user-69=mcdermos user-70=chrisdal user-71=nbhavers user-72=careers user-73=david user-74=martsblo user-75=ptkxhsbt user-76=dickemery123 user-77=lbhyisi user-78=hhdugcor user-79=magichat user-80=lakesan1 user-81=brmrjxl user-82=sarafoundation user-83=atestord user-84=strathar user-85=wilsonsw user-86=musorguk user-87=megacards user-88=jarvisin user-89=hodgesonweb user-90=theblack user-91=spectrum user-92=still user-93=agproduc user-94=leereyn1 user-95=stephani user-96=foundation user-97=markward user-98=booff user-99=maflemin user-100=lbscrmod user-101=athenare user-102=connect9
Sep  3 11:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=vantagep user-104=ulsukarm user-105=skyfirec user-106=alexadmin user-107=stuartge user-108=askhform user-109=innovat1 user-110=nativene user-111=brighto1 user-112=nstriton user-113=battlere user-114=oneoarco user-115=firstre2 user-116=vivienn1 user-117=bedfords user-118=bemadonn user-119=belle user-120=ggaaorgu user-121=newstoda user-122=elecleis user-123=gilpin user-124=milloyco user-125=carsinyo user-126=fetch user-127=putterfi user-128=hubmaster user-129=ianrayne user-130=accooper user-131=thqkgnbz user-132=connectedshoppin user-133=firstres user-134=jonhartl user-135=seftvta user-136=ultbcrra user-137=opaiscyx user-138=coursemc user-139=costestimatorco user-140=firstrel user-141=clarkass user-142=southlon user-143=highlegh user-144=firstred feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 11:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 11:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:40 nativespace-cdp sudo[1735865]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  3 11:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:42 nativespace-cdp sudo[1735881]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep  3 11:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  3 11:09:42 nativespace-cdp sudo[1735889]: pam_unix(sudo:session): session closed for user onlycont
Sep  3 11:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  3 11:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:43 nativespace-cdp sudo[1735902]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  3 11:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 11:09:43 nativespace-cdp sudo[1735909]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 11:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  3 11:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:45 nativespace-cdp sudo[1735929]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep  3 11:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  3 11:09:45 nativespace-cdp sudo[1735934]: pam_unix(sudo:session): session closed for user lkpier
Sep  3 11:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  3 11:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:46 nativespace-cdp sudo[1735947]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep  3 11:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  3 11:09:46 nativespace-cdp sudo[1735953]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  3 11:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  3 11:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  3 11:09:46 nativespace-cdp sudo[1735965]: pam_unix(sudo:session): session closed for user oneoarco
Sep  3 11:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  3 11:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:47 nativespace-cdp sudo[1735977]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep  3 11:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  3 11:09:47 nativespace-cdp sudo[1735983]: pam_unix(sudo:session): session closed for user fortunaz
Sep  3 11:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep  3 11:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:47 nativespace-cdp sudo[1735996]: pam_unix(sudo:session): session closed for user root
Sep  3 11:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 11:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:09:47 nativespace-cdp sudo[1736000]: pam_unix(sudo:session): session closed for user root
Sep  3 11:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep  3 11:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:10:06 nativespace-cdp sudo[1737310]: pam_unix(sudo:session): session closed for user root
Sep  3 11:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep  3 11:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:10:06 nativespace-cdp sudo[1737315]: pam_unix(sudo:session): session closed for user root
Sep  3 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:10:08 nativespace-cdp sudo[1737332]: pam_unix(sudo:session): session closed for user root
Sep  3 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EdW3LsKf3ziYWUI7.~
Sep  3 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:10:08 nativespace-cdp sudo[1737335]: pam_unix(sudo:session): session closed for user root
Sep  3 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EdW3LsKf3ziYWUI7.~'
Sep  3 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:10:08 nativespace-cdp sudo[1737339]: pam_unix(sudo:session): session closed for user root
Sep  3 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EdW3LsKf3ziYWUI7.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:10:08 nativespace-cdp sudo[1737343]: pam_unix(sudo:session): session closed for user root
Sep  3 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:10:08 nativespace-cdp sudo[1737346]: pam_unix(sudo:session): session closed for user root
Sep  3 11:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 11:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 11:10:20 nativespace-cdp sudo[1737395]: pam_unix(sudo:session): session closed for user root
Sep  3 11:11:33 nativespace-cdp sshd[1737664]: Connection closed by 159.100.136.21 port 39120 [preauth]
Sep  3 11:16:33 nativespace-cdp sshd[1738891]: Connection closed by 159.100.136.21 port 49366 [preauth]
Sep  3 11:21:33 nativespace-cdp sshd[1740191]: Connection closed by 159.100.136.21 port 59332 [preauth]
Sep  3 11:26:33 nativespace-cdp sshd[1741690]: Connection closed by 159.100.136.21 port 41398 [preauth]
Sep  3 11:31:33 nativespace-cdp sshd[1743386]: Connection closed by 159.100.136.21 port 51438 [preauth]
Sep  3 11:36:33 nativespace-cdp sshd[1744685]: Connection closed by 159.100.136.21 port 33536 [preauth]
Sep  3 11:41:33 nativespace-cdp sshd[1746234]: Connection closed by 159.100.136.21 port 43532 [preauth]
Sep  3 11:46:33 nativespace-cdp sshd[1747617]: Connection closed by 159.100.136.21 port 53742 [preauth]
Sep  3 11:51:33 nativespace-cdp sshd[1749011]: Connection closed by 159.100.136.21 port 35530 [preauth]
Sep  3 11:56:33 nativespace-cdp sshd[1750478]: Connection closed by 159.100.136.21 port 45824 [preauth]
Sep  3 12:01:33 nativespace-cdp sshd[1751719]: Connection closed by 159.100.136.21 port 55842 [preauth]
Sep  3 12:06:33 nativespace-cdp sshd[1753019]: Connection closed by 159.100.136.21 port 37946 [preauth]
Sep  3 12:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 12:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:31 nativespace-cdp sudo[1753690]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 12:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:31 nativespace-cdp sudo[1753696]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 12:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:32 nativespace-cdp sudo[1753701]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 12:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:32 nativespace-cdp sudo[1753707]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 12:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:35 nativespace-cdp sudo[1753713]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 12:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:36 nativespace-cdp sudo[1753728]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 12:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:36 nativespace-cdp sudo[1753733]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 12:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:36 nativespace-cdp sudo[1753737]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 12:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:36 nativespace-cdp sudo[1753742]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 12:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:36 nativespace-cdp sudo[1753748]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 12:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:36 nativespace-cdp sudo[1753753]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:38 nativespace-cdp sudo[1753767]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:38 nativespace-cdp sudo[1753774]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=brighto1 user-2=nstriton user-3=battlere user-4=oneoarco user-5=firstre2 user-6=vivienn1 user-7=bedfords user-8=bemadonn user-9=belle user-10=ggaaorgu user-11=newstoda user-12=skyfirec user-13=alexadmin user-14=stuartge user-15=askhform user-16=innovat1 user-17=nativene user-18=firstres user-19=seftvta user-20=jonhartl user-21=ultbcrra user-22=opaiscyx user-23=coursemc user-24=costestimatorco user-25=firstrel user-26=clarkass user-27=southlon user-28=highlegh user-29=firstred user-30=elecleis user-31=gilpin user-32=milloyco user-33=carsinyo user-34=fetch user-35=hubmaster user-36=putterfi user-37=ianrayne user-38=accooper user-39=thqkgnbz user-40=connectedshoppin user-41=brmrjxl user-42=lakesan1 user-43=sarafoundation user-44=atestord user-45=strathar user-46=wilsonsw user-47=musorguk
Sep  3 12:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=martsblo user-50=ptkxhsbt user-51=dickemery123 user-52=lbhyisi user-53=hhdugcor user-54=magichat user-55=markward user-56=foundation user-57=booff user-58=maflemin user-59=lbscrmod user-60=connect9 user-61=athenare user-62=vantagep user-63=ulsukarm user-64=jarvisin user-65=hodgesonweb user-66=theblack user-67=spectrum user-68=still user-69=agproduc user-70=leereyn1 user-71=stephani user-72=nove user-73=boldover user-74=sosevalu user-75=crrtipdl user-76=bakery user-77=what user-78=oubpgvbx user-79=tstardom user-80=nvihkvu user-81=sketchy user-82=cath user-83=havantho user-84=kategilpin user-85=ladburyp user-86=dancinggardener user-87=stagingerris user-88=design user-89=tomandle user-90=jennimil user-91=mcdermos user-92=chrisdal user-93=careers user-94=nbhavers user-95=david user-96=attlebor user-97=lucy user-98=onlycont user-99=branko user-100=hodgsonmail user-101=outdoorc
Sep  3 12:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ranxterc user-103=romaldki user-104=health2045 user-105=fortunaz user-106=leftie user-107=foods user-108=putterfc user-109=nscdp user-110=philmcph user-111=ctedorgu user-112=firstre5 user-113=donnychicago user-114=steakbridieme user-115=lkpier user-116=smrszyqg user-117=isleofwi user-118=barbersh user-119=tigerlet user-120=hidden user-121=nomistakes user-122=ninejimm user-123=reliable user-124=cathski user-125=cambria1 user-126=paulmca1 user-127=howardon user-128=pugwash user-129=cwsocial user-130=hirefootballgame user-131=courseme user-132=eugincou user-133=asandcoc user-134=sibtoncc user-135=zebrapho user-136=bwppodcast user-137=steve user-138=burydropin user-139=fawcettd user-140=nsceres user-141=eatspam user-142=darkstar user-143=beauty user-144=dhyana feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  3 12:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:39 nativespace-cdp sudo[1753783]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:40 nativespace-cdp sudo[1753792]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-pYVSCI5yjDmt2Yc2.~
Sep  3 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:40 nativespace-cdp sudo[1753800]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-pYVSCI5yjDmt2Yc2.~'
Sep  3 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:40 nativespace-cdp sudo[1753804]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-pYVSCI5yjDmt2Yc2.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:40 nativespace-cdp sudo[1753810]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:40 nativespace-cdp sudo[1753815]: pam_unix(sudo:session): session closed for user root
Sep  3 12:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 12:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 12:09:42 nativespace-cdp sudo[1753837]: pam_unix(sudo:session): session closed for user root
Sep  3 12:11:33 nativespace-cdp sshd[1754519]: Connection closed by 159.100.136.21 port 47966 [preauth]
Sep  3 12:16:33 nativespace-cdp sshd[1756069]: Connection closed by 159.100.136.21 port 58174 [preauth]
Sep  3 12:21:33 nativespace-cdp sshd[1757557]: Connection closed by 159.100.136.21 port 39944 [preauth]
Sep  3 12:26:33 nativespace-cdp sshd[1759290]: Connection closed by 159.100.136.21 port 50248 [preauth]
Sep  3 12:31:33 nativespace-cdp sshd[1760883]: Connection closed by 159.100.136.21 port 60282 [preauth]
Sep  3 12:36:33 nativespace-cdp sshd[1762143]: Connection closed by 159.100.136.21 port 42366 [preauth]
Sep  3 12:39:39 nativespace-cdp sshd[1762800]: Invalid user abas from 49.0.129.17 port 53270
Sep  3 12:39:39 nativespace-cdp sshd[1762800]: input_userauth_request: invalid user abas [preauth]
Sep  3 12:39:39 nativespace-cdp sshd[1762800]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 12:39:39 nativespace-cdp sshd[1762800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.0.129.17
Sep  3 12:39:41 nativespace-cdp sshd[1762800]: Failed password for invalid user abas from 49.0.129.17 port 53270 ssh2
Sep  3 12:39:42 nativespace-cdp sshd[1762800]: Received disconnect from 49.0.129.17 port 53270:11: Bye Bye [preauth]
Sep  3 12:39:42 nativespace-cdp sshd[1762800]: Disconnected from 49.0.129.17 port 53270 [preauth]
Sep  3 12:41:33 nativespace-cdp sshd[1763496]: Connection closed by 159.100.136.21 port 52366 [preauth]
Sep  3 12:42:08 nativespace-cdp sshd[1763609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.81.211.213  user=root
Sep  3 12:42:08 nativespace-cdp sshd[1763609]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 12:42:10 nativespace-cdp sshd[1763609]: Failed password for root from 192.81.211.213 port 45030 ssh2
Sep  3 12:42:10 nativespace-cdp sshd[1763609]: Received disconnect from 192.81.211.213 port 45030:11: Bye Bye [preauth]
Sep  3 12:42:10 nativespace-cdp sshd[1763609]: Disconnected from 192.81.211.213 port 45030 [preauth]
Sep  3 12:45:32 nativespace-cdp sshd[1764747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.185.9  user=root
Sep  3 12:45:32 nativespace-cdp sshd[1764747]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 12:45:34 nativespace-cdp sshd[1764747]: Failed password for root from 157.230.185.9 port 47640 ssh2
Sep  3 12:45:35 nativespace-cdp sshd[1764747]: Received disconnect from 157.230.185.9 port 47640:11: Bye Bye [preauth]
Sep  3 12:45:35 nativespace-cdp sshd[1764747]: Disconnected from 157.230.185.9 port 47640 [preauth]
Sep  3 12:45:39 nativespace-cdp sshd[1764774]: Invalid user abdol from 66.29.149.124 port 56884
Sep  3 12:45:39 nativespace-cdp sshd[1764774]: input_userauth_request: invalid user abdol [preauth]
Sep  3 12:45:39 nativespace-cdp sshd[1764774]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 12:45:39 nativespace-cdp sshd[1764774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.29.149.124
Sep  3 12:45:41 nativespace-cdp sshd[1764774]: Failed password for invalid user abdol from 66.29.149.124 port 56884 ssh2
Sep  3 12:45:41 nativespace-cdp sshd[1764774]: Received disconnect from 66.29.149.124 port 56884:11: Bye Bye [preauth]
Sep  3 12:45:41 nativespace-cdp sshd[1764774]: Disconnected from 66.29.149.124 port 56884 [preauth]
Sep  3 12:46:33 nativespace-cdp sshd[1764945]: Connection closed by 159.100.136.21 port 34346 [preauth]
Sep  3 12:46:50 nativespace-cdp sshd[1765006]: Invalid user postgres from 66.29.149.124 port 44392
Sep  3 12:46:50 nativespace-cdp sshd[1765006]: input_userauth_request: invalid user postgres [preauth]
Sep  3 12:46:50 nativespace-cdp sshd[1765006]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 12:46:50 nativespace-cdp sshd[1765006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.29.149.124
Sep  3 12:46:53 nativespace-cdp sshd[1765006]: Failed password for invalid user postgres from 66.29.149.124 port 44392 ssh2
Sep  3 12:46:53 nativespace-cdp sshd[1765006]: Received disconnect from 66.29.149.124 port 44392:11: Bye Bye [preauth]
Sep  3 12:46:53 nativespace-cdp sshd[1765006]: Disconnected from 66.29.149.124 port 44392 [preauth]
Sep  3 12:47:00 nativespace-cdp sshd[1765025]: Invalid user tiffany from 157.230.185.9 port 40626
Sep  3 12:47:00 nativespace-cdp sshd[1765025]: input_userauth_request: invalid user tiffany [preauth]
Sep  3 12:47:00 nativespace-cdp sshd[1765025]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 12:47:00 nativespace-cdp sshd[1765025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.185.9
Sep  3 12:47:02 nativespace-cdp sshd[1765025]: Failed password for invalid user tiffany from 157.230.185.9 port 40626 ssh2
Sep  3 12:47:02 nativespace-cdp sshd[1765025]: Received disconnect from 157.230.185.9 port 40626:11: Bye Bye [preauth]
Sep  3 12:47:02 nativespace-cdp sshd[1765025]: Disconnected from 157.230.185.9 port 40626 [preauth]
Sep  3 12:47:26 nativespace-cdp sshd[1765122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.0.129.17  user=root
Sep  3 12:47:26 nativespace-cdp sshd[1765122]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 12:47:28 nativespace-cdp sshd[1765122]: Failed password for root from 49.0.129.17 port 58342 ssh2
Sep  3 12:47:28 nativespace-cdp sshd[1765122]: Received disconnect from 49.0.129.17 port 58342:11: Bye Bye [preauth]
Sep  3 12:47:28 nativespace-cdp sshd[1765122]: Disconnected from 49.0.129.17 port 58342 [preauth]
Sep  3 12:47:35 nativespace-cdp sshd[1765144]: Invalid user benjamin from 66.29.149.124 port 57604
Sep  3 12:47:35 nativespace-cdp sshd[1765144]: input_userauth_request: invalid user benjamin [preauth]
Sep  3 12:47:35 nativespace-cdp sshd[1765144]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 12:47:35 nativespace-cdp sshd[1765144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.29.149.124
Sep  3 12:47:37 nativespace-cdp sshd[1765144]: Failed password for invalid user benjamin from 66.29.149.124 port 57604 ssh2
Sep  3 12:47:37 nativespace-cdp sshd[1765144]: Received disconnect from 66.29.149.124 port 57604:11: Bye Bye [preauth]
Sep  3 12:47:37 nativespace-cdp sshd[1765144]: Disconnected from 66.29.149.124 port 57604 [preauth]
Sep  3 12:47:43 nativespace-cdp sshd[1765224]: Invalid user leila from 192.81.211.213 port 34404
Sep  3 12:47:43 nativespace-cdp sshd[1765224]: input_userauth_request: invalid user leila [preauth]
Sep  3 12:47:43 nativespace-cdp sshd[1765224]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 12:47:43 nativespace-cdp sshd[1765224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.81.211.213
Sep  3 12:47:44 nativespace-cdp sshd[1765228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.185.9  user=root
Sep  3 12:47:44 nativespace-cdp sshd[1765228]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 12:47:45 nativespace-cdp sshd[1765224]: Failed password for invalid user leila from 192.81.211.213 port 34404 ssh2
Sep  3 12:47:45 nativespace-cdp sshd[1765224]: Received disconnect from 192.81.211.213 port 34404:11: Bye Bye [preauth]
Sep  3 12:47:45 nativespace-cdp sshd[1765224]: Disconnected from 192.81.211.213 port 34404 [preauth]
Sep  3 12:47:46 nativespace-cdp sshd[1765228]: Failed password for root from 157.230.185.9 port 42916 ssh2
Sep  3 12:48:21 nativespace-cdp sshd[1765423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.0.129.17  user=root
Sep  3 12:48:21 nativespace-cdp sshd[1765423]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 12:48:24 nativespace-cdp sshd[1765423]: Failed password for root from 49.0.129.17 port 51540 ssh2
Sep  3 12:48:24 nativespace-cdp sshd[1765423]: Received disconnect from 49.0.129.17 port 51540:11: Bye Bye [preauth]
Sep  3 12:48:24 nativespace-cdp sshd[1765423]: Disconnected from 49.0.129.17 port 51540 [preauth]
Sep  3 12:48:25 nativespace-cdp sshd[1765432]: Invalid user deployer from 192.81.211.213 port 49730
Sep  3 12:48:25 nativespace-cdp sshd[1765432]: input_userauth_request: invalid user deployer [preauth]
Sep  3 12:48:25 nativespace-cdp sshd[1765432]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 12:48:25 nativespace-cdp sshd[1765432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.81.211.213
Sep  3 12:48:27 nativespace-cdp sshd[1765432]: Failed password for invalid user deployer from 192.81.211.213 port 49730 ssh2
Sep  3 12:48:27 nativespace-cdp sshd[1765432]: Received disconnect from 192.81.211.213 port 49730:11: Bye Bye [preauth]
Sep  3 12:48:27 nativespace-cdp sshd[1765432]: Disconnected from 192.81.211.213 port 49730 [preauth]
Sep  3 12:51:33 nativespace-cdp sshd[1766412]: Connection closed by 159.100.136.21 port 44394 [preauth]
Sep  3 12:56:33 nativespace-cdp sshd[1768032]: Connection closed by 159.100.136.21 port 54668 [preauth]
Sep  3 13:01:33 nativespace-cdp sshd[1769412]: Connection closed by 159.100.136.21 port 36432 [preauth]
Sep  3 13:06:33 nativespace-cdp sshd[1770651]: Connection closed by 159.100.136.21 port 46780 [preauth]
Sep  3 13:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 13:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:09:37 nativespace-cdp sudo[1771582]: pam_unix(sudo:session): session closed for user root
Sep  3 13:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 13:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:09:37 nativespace-cdp sudo[1771594]: pam_unix(sudo:session): session closed for user root
Sep  3 13:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 13:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:13:38 nativespace-cdp crond[1772145]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  3 13:13:38 nativespace-cdp crond[1772220]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  3 13:13:38 nativespace-cdp crond[1772144]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  3 13:13:38 nativespace-cdp crond[1772221]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  3 13:14:29 nativespace-cdp sshd[1772178]: Did not receive identification string from 159.100.136.21 port 56774
Sep  3 13:14:43 nativespace-cdp sudo[1771597]: pam_unix(sudo:session): session closed for user root
Sep  3 13:14:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 13:14:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:14:47 nativespace-cdp sudo[1773686]: pam_unix(sudo:session): session closed for user root
Sep  3 13:14:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 13:14:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:20 nativespace-cdp sudo[1773701]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 13:15:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:20 nativespace-cdp sudo[1774199]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 13:15:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:20 nativespace-cdp sudo[1774203]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 13:15:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:20 nativespace-cdp sudo[1774206]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 13:15:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:20 nativespace-cdp sudo[1774209]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 13:15:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:20 nativespace-cdp sudo[1774212]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 13:15:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:20 nativespace-cdp sudo[1774215]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 13:15:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:23 nativespace-cdp sudo[1774251]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 13:15:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:27 nativespace-cdp sudo[1774280]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lkpier user-2=donnychicago user-3=firstre5 user-4=steakbridieme user-5=philmcph user-6=ctedorgu user-7=nscdp user-8=putterfc user-9=leftie user-10=foods user-11=fortunaz user-12=health2045 user-13=nomistakes user-14=hidden user-15=tigerlet user-16=barbersh user-17=isleofwi user-18=smrszyqg user-19=cwsocial user-20=paulmca1 user-21=howardon user-22=pugwash user-23=cathski user-24=cambria1 user-25=reliable user-26=ninejimm user-27=eugincou user-28=courseme user-29=hirefootballgame user-30=asandcoc user-31=sibtoncc user-32=steve user-33=bwppodcast user-34=zebrapho user-35=nsceres user-36=fawcettd user-37=burydropin user-38=dhyana user-39=beauty user-40=darkstar user-41=eatspam user-42=boldover user-43=nove user-44=bakery user-45=crrtipdl user-46=sosevalu user-47=havantho user-48=sketchy
Sep  3 13:15:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=cath user-50=nvihkvu user-51=oubpgvbx user-52=tstardom user-53=what user-54=design user-55=dancinggardener user-56=stagingerris user-57=ladburyp user-58=kategilpin user-59=jennimil user-60=tomandle user-61=david user-62=careers user-63=nbhavers user-64=chrisdal user-65=mcdermos user-66=onlycont user-67=lucy user-68=attlebor user-69=romaldki user-70=outdoorc user-71=hodgsonmail user-72=ranxterc user-73=branko user-74=strathar user-75=atestord user-76=sarafoundation user-77=brmrjxl user-78=lakesan1 user-79=megacards user-80=musorguk user-81=wilsonsw user-82=dickemery123 user-83=ptkxhsbt user-84=martsblo user-85=magichat user-86=hhdugcor user-87=lbhyisi user-88=vantagep user-89=athenare user-90=connect9 user-91=lbscrmod user-92=maflemin user-93=booff user-94=markward user-95=foundation user-96=ulsukarm user-97=spectrum user-98=theblack user-99=hodgesonweb user-100=jarvisin user-101=stephani user-102=leereyn1
Sep  3 13:15:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=agproduc user-104=still user-105=vivienn1 user-106=firstre2 user-107=oneoarco user-108=battlere user-109=nstriton user-110=brighto1 user-111=newstoda user-112=ggaaorgu user-113=belle user-114=bemadonn user-115=bedfords user-116=alexadmin user-117=skyfirec user-118=nativene user-119=innovat1 user-120=askhform user-121=stuartge user-122=opaiscyx user-123=coursemc user-124=ultbcrra user-125=jonhartl user-126=seftvta user-127=firstres user-128=firstred user-129=highlegh user-130=southlon user-131=clarkass user-132=firstrel user-133=costestimatorco user-134=putterfi user-135=hubmaster user-136=fetch user-137=carsinyo user-138=milloyco user-139=gilpin user-140=elecleis user-141=connectedshoppin user-142=thqkgnbz user-143=accooper user-144=ianrayne feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 13:15:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 13:15:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:29 nativespace-cdp sudo[1774392]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 13:15:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:30 nativespace-cdp sudo[1774427]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mvMEi9ChlPD1rvYW.~
Sep  3 13:15:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:30 nativespace-cdp sudo[1774430]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mvMEi9ChlPD1rvYW.~'
Sep  3 13:15:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:30 nativespace-cdp sudo[1774433]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mvMEi9ChlPD1rvYW.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 13:15:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:30 nativespace-cdp sudo[1774438]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 13:15:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:30 nativespace-cdp sudo[1774441]: pam_unix(sudo:session): session closed for user root
Sep  3 13:15:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 13:15:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 13:15:38 nativespace-cdp sudo[1774479]: pam_unix(sudo:session): session closed for user root
Sep  3 13:16:33 nativespace-cdp sshd[1774889]: Connection closed by 159.100.136.21 port 38622 [preauth]
Sep  3 13:21:33 nativespace-cdp sshd[1778230]: Connection closed by 159.100.136.21 port 48624 [preauth]
Sep  3 13:26:33 nativespace-cdp sshd[1781926]: Connection closed by 159.100.136.21 port 58754 [preauth]
Sep  3 13:31:33 nativespace-cdp sshd[1785314]: Connection closed by 159.100.136.21 port 40580 [preauth]
Sep  3 13:36:33 nativespace-cdp sshd[1786626]: Connection closed by 159.100.136.21 port 50892 [preauth]
Sep  3 13:41:33 nativespace-cdp sshd[1787885]: Connection closed by 159.100.136.21 port 60870 [preauth]
Sep  3 13:46:33 nativespace-cdp sshd[1789604]: Connection closed by 159.100.136.21 port 42886 [preauth]
Sep  3 13:51:33 nativespace-cdp sshd[1790956]: Connection closed by 159.100.136.21 port 52888 [preauth]
Sep  3 13:56:33 nativespace-cdp sshd[1792530]: Connection closed by 159.100.136.21 port 34946 [preauth]
Sep  3 14:01:33 nativespace-cdp sshd[1793960]: Connection closed by 159.100.136.21 port 44968 [preauth]
Sep  3 14:06:33 nativespace-cdp sshd[1795209]: Connection closed by 159.100.136.21 port 55288 [preauth]
Sep  3 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:41 nativespace-cdp sudo[1795789]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:41 nativespace-cdp sudo[1795793]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:42 nativespace-cdp sudo[1795798]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 14:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:42 nativespace-cdp sudo[1795806]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 14:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:45 nativespace-cdp sudo[1795812]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:45 nativespace-cdp sudo[1795823]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:45 nativespace-cdp sudo[1795828]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:45 nativespace-cdp sudo[1795832]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:45 nativespace-cdp sudo[1795837]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:45 nativespace-cdp sudo[1795842]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:45 nativespace-cdp sudo[1795848]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:47 nativespace-cdp sudo[1795862]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:47 nativespace-cdp sudo[1795869]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=brmrjxl user-2=lakesan1 user-3=strathar user-4=sarafoundation user-5=atestord user-6=wilsonsw user-7=musorguk user-8=megacards user-9=martsblo user-10=dickemery123 user-11=ptkxhsbt user-12=lbhyisi user-13=hhdugcor user-14=magichat user-15=booff user-16=markward user-17=foundation user-18=connect9 user-19=athenare user-20=vantagep user-21=maflemin user-22=lbscrmod user-23=ulsukarm user-24=jarvisin user-25=spectrum user-26=hodgesonweb user-27=theblack user-28=still user-29=agproduc user-30=stephani user-31=leereyn1 user-32=brighto1 user-33=nstriton user-34=firstre2 user-35=vivienn1 user-36=battlere user-37=oneoarco user-38=bedfords user-39=belle user-40=ggaaorgu user-41=newstoda user-42=bemadonn user-43=skyfirec user-44=alexadmin user-45=innovat1 user-46=stuartge user-47=askhform user-48=nativene
Sep  3 14:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=seftvta user-50=jonhartl user-51=ultbcrra user-52=firstres user-53=coursemc user-54=opaiscyx user-55=clarkass user-56=firstrel user-57=costestimatorco user-58=firstred user-59=southlon user-60=highlegh user-61=gilpin user-62=milloyco user-63=elecleis user-64=putterfi user-65=hubmaster user-66=carsinyo user-67=fetch user-68=accooper user-69=ianrayne user-70=connectedshoppin user-71=thqkgnbz user-72=putterfc user-73=nscdp user-74=health2045 user-75=fortunaz user-76=leftie user-77=foods user-78=lkpier user-79=philmcph user-80=ctedorgu user-81=firstre5 user-82=donnychicago user-83=steakbridieme user-84=isleofwi user-85=smrszyqg user-86=hidden user-87=nomistakes user-88=barbersh user-89=tigerlet user-90=cambria1 user-91=cathski user-92=reliable user-93=ninejimm user-94=paulmca1 user-95=pugwash user-96=howardon user-97=cwsocial user-98=hirefootballgame user-99=eugincou user-100=courseme user-101=asandcoc
Sep  3 14:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sibtoncc user-103=bwppodcast user-104=zebrapho user-105=steve user-106=burydropin user-107=fawcettd user-108=nsceres user-109=beauty user-110=eatspam user-111=darkstar user-112=dhyana user-113=nove user-114=boldover user-115=bakery user-116=sosevalu user-117=crrtipdl user-118=tstardom user-119=oubpgvbx user-120=what user-121=cath user-122=sketchy user-123=havantho user-124=nvihkvu user-125=ladburyp user-126=dancinggardener user-127=stagingerris user-128=kategilpin user-129=design user-130=tomandle user-131=jennimil user-132=chrisdal user-133=mcdermos user-134=nbhavers user-135=careers user-136=david user-137=attlebor user-138=lucy user-139=onlycont user-140=hodgsonmail user-141=outdoorc user-142=ranxterc user-143=branko user-144=romaldki feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 14:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:48 nativespace-cdp sudo[1795876]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:49 nativespace-cdp sudo[1795886]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yHSV7CADlWC8tNDY.~
Sep  3 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:49 nativespace-cdp sudo[1795892]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yHSV7CADlWC8tNDY.~'
Sep  3 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:49 nativespace-cdp sudo[1795896]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yHSV7CADlWC8tNDY.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:49 nativespace-cdp sudo[1795902]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:49 nativespace-cdp sudo[1795907]: pam_unix(sudo:session): session closed for user root
Sep  3 14:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 14:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 14:09:51 nativespace-cdp sudo[1795931]: pam_unix(sudo:session): session closed for user root
Sep  3 14:11:33 nativespace-cdp sshd[1796600]: Connection closed by 159.100.136.21 port 37068 [preauth]
Sep  3 14:16:33 nativespace-cdp sshd[1798167]: Connection closed by 159.100.136.21 port 47300 [preauth]
Sep  3 14:21:33 nativespace-cdp sshd[1799383]: Connection closed by 159.100.136.21 port 57304 [preauth]
Sep  3 14:26:33 nativespace-cdp sshd[1800795]: Connection closed by 159.100.136.21 port 39350 [preauth]
Sep  3 14:31:33 nativespace-cdp sshd[1802196]: Connection closed by 159.100.136.21 port 49388 [preauth]
Sep  3 14:36:33 nativespace-cdp sshd[1803410]: Connection closed by 159.100.136.21 port 59700 [preauth]
Sep  3 14:41:33 nativespace-cdp sshd[1805097]: Connection closed by 159.100.136.21 port 41478 [preauth]
Sep  3 14:46:33 nativespace-cdp sshd[1806268]: Connection closed by 159.100.136.21 port 51636 [preauth]
Sep  3 14:46:57 nativespace-cdp sshd[1806329]: Invalid user postmaster from 171.103.243.157 port 51422
Sep  3 14:46:57 nativespace-cdp sshd[1806329]: input_userauth_request: invalid user postmaster [preauth]
Sep  3 14:46:57 nativespace-cdp sshd[1806329]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 14:46:57 nativespace-cdp sshd[1806329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.103.243.157
Sep  3 14:46:59 nativespace-cdp sshd[1806329]: Failed password for invalid user postmaster from 171.103.243.157 port 51422 ssh2
Sep  3 14:46:59 nativespace-cdp sshd[1806329]: Received disconnect from 171.103.243.157 port 51422:11: Bye Bye [preauth]
Sep  3 14:46:59 nativespace-cdp sshd[1806329]: Disconnected from 171.103.243.157 port 51422 [preauth]
Sep  3 14:48:37 nativespace-cdp sshd[1806643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.54.13  user=root
Sep  3 14:48:37 nativespace-cdp sshd[1806643]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 14:48:39 nativespace-cdp sshd[1806643]: Failed password for root from 174.138.54.13 port 42968 ssh2
Sep  3 14:48:39 nativespace-cdp sshd[1806643]: Received disconnect from 174.138.54.13 port 42968:11: Bye Bye [preauth]
Sep  3 14:48:39 nativespace-cdp sshd[1806643]: Disconnected from 174.138.54.13 port 42968 [preauth]
Sep  3 14:50:51 nativespace-cdp sshd[1807259]: Invalid user dev from 174.138.54.13 port 39482
Sep  3 14:50:51 nativespace-cdp sshd[1807259]: input_userauth_request: invalid user dev [preauth]
Sep  3 14:50:51 nativespace-cdp sshd[1807259]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 14:50:51 nativespace-cdp sshd[1807259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.54.13
Sep  3 14:50:53 nativespace-cdp sshd[1807259]: Failed password for invalid user dev from 174.138.54.13 port 39482 ssh2
Sep  3 14:50:53 nativespace-cdp sshd[1807259]: Received disconnect from 174.138.54.13 port 39482:11: Bye Bye [preauth]
Sep  3 14:50:53 nativespace-cdp sshd[1807259]: Disconnected from 174.138.54.13 port 39482 [preauth]
Sep  3 14:51:33 nativespace-cdp sshd[1807419]: Connection closed by 159.100.136.21 port 33428 [preauth]
Sep  3 14:51:41 nativespace-cdp sshd[1807435]: Invalid user ansible from 174.138.54.13 port 54786
Sep  3 14:51:41 nativespace-cdp sshd[1807435]: input_userauth_request: invalid user ansible [preauth]
Sep  3 14:51:41 nativespace-cdp sshd[1807435]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 14:51:41 nativespace-cdp sshd[1807435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.54.13
Sep  3 14:51:43 nativespace-cdp sshd[1807435]: Failed password for invalid user ansible from 174.138.54.13 port 54786 ssh2
Sep  3 14:51:43 nativespace-cdp sshd[1807435]: Received disconnect from 174.138.54.13 port 54786:11: Bye Bye [preauth]
Sep  3 14:51:43 nativespace-cdp sshd[1807435]: Disconnected from 174.138.54.13 port 54786 [preauth]
Sep  3 14:52:08 nativespace-cdp sshd[1807540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.103.243.157  user=root
Sep  3 14:52:08 nativespace-cdp sshd[1807540]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 14:52:10 nativespace-cdp sshd[1807540]: Failed password for root from 171.103.243.157 port 34676 ssh2
Sep  3 14:52:10 nativespace-cdp sshd[1807540]: Received disconnect from 171.103.243.157 port 34676:11: Bye Bye [preauth]
Sep  3 14:52:10 nativespace-cdp sshd[1807540]: Disconnected from 171.103.243.157 port 34676 [preauth]
Sep  3 14:52:55 nativespace-cdp sshd[1807756]: Invalid user admin from 171.103.243.157 port 47810
Sep  3 14:52:55 nativespace-cdp sshd[1807756]: input_userauth_request: invalid user admin [preauth]
Sep  3 14:52:55 nativespace-cdp sshd[1807756]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 14:52:55 nativespace-cdp sshd[1807756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.103.243.157
Sep  3 14:52:57 nativespace-cdp sshd[1807756]: Failed password for invalid user admin from 171.103.243.157 port 47810 ssh2
Sep  3 14:52:57 nativespace-cdp sshd[1807756]: Received disconnect from 171.103.243.157 port 47810:11: Bye Bye [preauth]
Sep  3 14:52:57 nativespace-cdp sshd[1807756]: Disconnected from 171.103.243.157 port 47810 [preauth]
Sep  3 14:56:33 nativespace-cdp sshd[1809033]: Connection closed by 159.100.136.21 port 43728 [preauth]
Sep  3 15:01:33 nativespace-cdp sshd[1810405]: Connection closed by 159.100.136.21 port 53700 [preauth]
Sep  3 15:06:33 nativespace-cdp sshd[1811902]: Connection closed by 159.100.136.21 port 35814 [preauth]
Sep  3 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:36 nativespace-cdp sudo[1812606]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:36 nativespace-cdp sudo[1812610]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:37 nativespace-cdp sudo[1812615]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 15:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:37 nativespace-cdp sudo[1812622]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 15:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:39 nativespace-cdp sudo[1812628]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:39 nativespace-cdp sudo[1812643]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:39 nativespace-cdp sudo[1812648]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:39 nativespace-cdp sudo[1812652]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:39 nativespace-cdp sudo[1812657]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:39 nativespace-cdp sudo[1812662]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 15:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:40 nativespace-cdp sudo[1812668]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:41 nativespace-cdp sudo[1812679]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 15:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:42 nativespace-cdp sudo[1812686]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=thqkgnbz user-2=connectedshoppin user-3=ianrayne user-4=accooper user-5=fetch user-6=carsinyo user-7=putterfi user-8=hubmaster user-9=elecleis user-10=milloyco user-11=gilpin user-12=highlegh user-13=southlon user-14=firstred user-15=costestimatorco user-16=firstrel user-17=clarkass user-18=coursemc user-19=opaiscyx user-20=firstres user-21=ultbcrra user-22=seftvta user-23=jonhartl user-24=nativene user-25=askhform user-26=stuartge user-27=innovat1 user-28=skyfirec user-29=alexadmin user-30=bemadonn user-31=newstoda user-32=belle user-33=ggaaorgu user-34=bedfords user-35=oneoarco user-36=battlere user-37=vivienn1 user-38=firstre2 user-39=nstriton user-40=brighto1 user-41=leereyn1 user-42=stephani user-43=agproduc user-44=still user-45=theblack user-46=hodgesonweb user-47=spectrum
Sep  3 15:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=jarvisin user-49=ulsukarm user-50=lbscrmod user-51=maflemin user-52=vantagep user-53=athenare user-54=connect9 user-55=booff user-56=foundation user-57=markward user-58=magichat user-59=hhdugcor user-60=lbhyisi user-61=ptkxhsbt user-62=dickemery123 user-63=martsblo user-64=megacards user-65=musorguk user-66=wilsonsw user-67=atestord user-68=sarafoundation user-69=strathar user-70=lakesan1 user-71=brmrjxl user-72=romaldki user-73=branko user-74=ranxterc user-75=hodgsonmail user-76=outdoorc user-77=onlycont user-78=lucy user-79=attlebor user-80=david user-81=nbhavers user-82=careers user-83=mcdermos user-84=chrisdal user-85=jennimil user-86=tomandle user-87=design user-88=kategilpin user-89=stagingerris user-90=dancinggardener user-91=ladburyp user-92=nvihkvu user-93=havantho user-94=cath user-95=sketchy user-96=what user-97=tstardom user-98=oubpgvbx user-99=crrtipdl user-100=sosevalu user-101=bakery
Sep  3 15:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=boldover user-103=nove user-104=dhyana user-105=darkstar user-106=eatspam user-107=beauty user-108=nsceres user-109=fawcettd user-110=burydropin user-111=steve user-112=zebrapho user-113=bwppodcast user-114=asandcoc user-115=sibtoncc user-116=courseme user-117=eugincou user-118=hirefootballgame user-119=cwsocial user-120=paulmca1 user-121=pugwash user-122=howardon user-123=reliable user-124=ninejimm user-125=cathski user-126=cambria1 user-127=tigerlet user-128=barbersh user-129=nomistakes user-130=hidden user-131=smrszyqg user-132=isleofwi user-133=steakbridieme user-134=firstre5 user-135=donnychicago user-136=philmcph user-137=ctedorgu user-138=lkpier user-139=foods user-140=leftie user-141=health2045 user-142=fortunaz user-143=nscdp user-144=putterfc feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 15:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 15:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:43 nativespace-cdp sudo[1812693]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 15:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:43 nativespace-cdp sudo[1812700]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-540ksm3D8KVUwkjs.~
Sep  3 15:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:43 nativespace-cdp sudo[1812705]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-540ksm3D8KVUwkjs.~'
Sep  3 15:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:43 nativespace-cdp sudo[1812709]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-540ksm3D8KVUwkjs.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 15:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:43 nativespace-cdp sudo[1812716]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 15:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:43 nativespace-cdp sudo[1812721]: pam_unix(sudo:session): session closed for user root
Sep  3 15:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 15:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 15:09:55 nativespace-cdp sudo[1812765]: pam_unix(sudo:session): session closed for user root
Sep  3 15:11:33 nativespace-cdp sshd[1813326]: Connection closed by 159.100.136.21 port 45806 [preauth]
Sep  3 15:16:33 nativespace-cdp sshd[1814836]: Connection closed by 159.100.136.21 port 56062 [preauth]
Sep  3 15:21:33 nativespace-cdp sshd[1816351]: Connection closed by 159.100.136.21 port 37778 [preauth]
Sep  3 15:26:33 nativespace-cdp sshd[1817992]: Connection closed by 159.100.136.21 port 48056 [preauth]
Sep  3 15:31:33 nativespace-cdp sshd[1819271]: Connection closed by 159.100.136.21 port 58134 [preauth]
Sep  3 15:36:33 nativespace-cdp sshd[1820758]: Connection closed by 159.100.136.21 port 40186 [preauth]
Sep  3 15:41:33 nativespace-cdp sshd[1822004]: Connection closed by 159.100.136.21 port 49434 [preauth]
Sep  3 15:46:33 nativespace-cdp sshd[1823761]: Connection closed by 159.100.136.21 port 59694 [preauth]
Sep  3 15:51:33 nativespace-cdp sshd[1825046]: Connection closed by 159.100.136.21 port 41432 [preauth]
Sep  3 15:56:33 nativespace-cdp sshd[1826311]: Connection closed by 159.100.136.21 port 51686 [preauth]
Sep  3 16:01:33 nativespace-cdp sshd[1827810]: Connection closed by 159.100.136.21 port 33470 [preauth]
Sep  3 16:06:33 nativespace-cdp sshd[1829122]: Connection closed by 159.100.136.21 port 43768 [preauth]
Sep  3 16:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 16:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:09:53 nativespace-cdp sudo[1830013]: pam_unix(sudo:session): session closed for user root
Sep  3 16:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 16:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:09:53 nativespace-cdp sudo[1830017]: pam_unix(sudo:session): session closed for user root
Sep  3 16:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 16:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:09:56 nativespace-cdp sudo[1830022]: pam_unix(sudo:session): session closed for user root
Sep  3 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:09:56 nativespace-cdp sudo[1830032]: pam_unix(sudo:session): session closed for user root
Sep  3 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:01 nativespace-cdp sudo[1830042]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 16:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:01 nativespace-cdp sudo[1830165]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 16:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:01 nativespace-cdp sudo[1830170]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 16:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:01 nativespace-cdp sudo[1830174]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 16:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:01 nativespace-cdp sudo[1830179]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 16:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:01 nativespace-cdp sudo[1830185]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 16:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:01 nativespace-cdp sudo[1830190]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 16:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:04 nativespace-cdp sudo[1830329]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 16:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:05 nativespace-cdp sudo[1830335]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=booff user-3=foundation user-4=markward user-5=lbscrmod user-6=maflemin user-7=vantagep user-8=connect9 user-9=athenare user-10=agproduc user-11=still user-12=leereyn1 user-13=stephani user-14=jarvisin user-15=theblack user-16=hodgesonweb user-17=spectrum user-18=wilsonsw user-19=megacards user-20=musorguk user-21=brmrjxl user-22=lakesan1 user-23=atestord user-24=sarafoundation user-25=strathar user-26=hhdugcor user-27=lbhyisi user-28=magichat user-29=martsblo user-30=ptkxhsbt user-31=dickemery123 user-32=costestimatorco user-33=firstrel user-34=clarkass user-35=highlegh user-36=southlon user-37=firstred user-38=firstres user-39=ultbcrra user-40=jonhartl user-41=seftvta user-42=opaiscyx user-43=coursemc user-44=ianrayne user-45=accooper user-46=thqkgnbz user-47=connectedshoppin
Sep  3 16:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=elecleis user-49=milloyco user-50=gilpin user-51=fetch user-52=carsinyo user-53=hubmaster user-54=putterfi user-55=bedfords user-56=bemadonn user-57=newstoda user-58=ggaaorgu user-59=belle user-60=nstriton user-61=brighto1 user-62=oneoarco user-63=battlere user-64=vivienn1 user-65=firstre2 user-66=askhform user-67=stuartge user-68=innovat1 user-69=nativene user-70=alexadmin user-71=skyfirec user-72=zebrapho user-73=bwppodcast user-74=steve user-75=asandcoc user-76=sibtoncc user-77=darkstar user-78=eatspam user-79=beauty user-80=dhyana user-81=fawcettd user-82=burydropin user-83=nsceres user-84=smrszyqg user-85=isleofwi user-86=barbersh user-87=tigerlet user-88=nomistakes user-89=hidden user-90=leftie user-91=foods user-92=health2045 user-93=fortunaz user-94=nscdp user-95=putterfc user-96=steakbridieme user-97=firstre5 user-98=donnychicago user-99=ctedorgu user-100=philmcph user-101=lkpier
Sep  3 16:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hirefootballgame user-103=courseme user-104=eugincou user-105=ninejimm user-106=reliable user-107=cambria1 user-108=cathski user-109=cwsocial user-110=paulmca1 user-111=pugwash user-112=howardon user-113=mcdermos user-114=chrisdal user-115=david user-116=nbhavers user-117=careers user-118=tomandle user-119=jennimil user-120=branko user-121=hodgsonmail user-122=outdoorc user-123=ranxterc user-124=romaldki user-125=lucy user-126=attlebor user-127=onlycont user-128=crrtipdl user-129=sosevalu user-130=bakery user-131=nove user-132=boldover user-133=kategilpin user-134=stagingerris user-135=dancinggardener user-136=ladburyp user-137=design user-138=what user-139=tstardom user-140=oubpgvbx user-141=nvihkvu user-142=havantho user-143=sketchy user-144=cath feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 16:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 16:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:07 nativespace-cdp sudo[1830339]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 16:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:08 nativespace-cdp sudo[1830362]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-II1vYRFCFaFegf73.~
Sep  3 16:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:08 nativespace-cdp sudo[1830365]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-II1vYRFCFaFegf73.~'
Sep  3 16:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:08 nativespace-cdp sudo[1830368]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-II1vYRFCFaFegf73.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 16:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:08 nativespace-cdp sudo[1830373]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 16:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:08 nativespace-cdp sudo[1830376]: pam_unix(sudo:session): session closed for user root
Sep  3 16:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 16:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 16:10:40 nativespace-cdp sudo[1830542]: pam_unix(sudo:session): session closed for user root
Sep  3 16:11:33 nativespace-cdp sshd[1830851]: Connection closed by 159.100.136.21 port 53674 [preauth]
Sep  3 16:16:33 nativespace-cdp sshd[1832443]: Connection closed by 159.100.136.21 port 35650 [preauth]
Sep  3 16:21:33 nativespace-cdp sshd[1833625]: Connection closed by 159.100.136.21 port 45646 [preauth]
Sep  3 16:26:33 nativespace-cdp sshd[1835071]: Connection closed by 159.100.136.21 port 55958 [preauth]
Sep  3 16:31:33 nativespace-cdp sshd[1836620]: Connection closed by 159.100.136.21 port 37778 [preauth]
Sep  3 16:36:33 nativespace-cdp sshd[1837719]: Connection closed by 159.100.136.21 port 48120 [preauth]
Sep  3 16:41:33 nativespace-cdp sshd[1839175]: Connection closed by 159.100.136.21 port 58088 [preauth]
Sep  3 16:46:33 nativespace-cdp sshd[1840429]: Connection closed by 159.100.136.21 port 40126 [preauth]
Sep  3 16:51:33 nativespace-cdp sshd[1841896]: Connection closed by 159.100.136.21 port 50138 [preauth]
Sep  3 16:56:33 nativespace-cdp sshd[1843371]: Connection closed by 159.100.136.21 port 60438 [preauth]
Sep  3 17:01:33 nativespace-cdp sshd[1844729]: Connection closed by 159.100.136.21 port 42218 [preauth]
Sep  3 17:06:33 nativespace-cdp sshd[1845930]: Connection closed by 159.100.136.21 port 52548 [preauth]
Sep  3 17:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 17:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:40 nativespace-cdp sudo[1846748]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 17:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:40 nativespace-cdp sudo[1846754]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 17:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:42 nativespace-cdp sudo[1846759]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 17:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:42 nativespace-cdp sudo[1846774]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 17:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:44 nativespace-cdp sudo[1846780]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 17:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:44 nativespace-cdp sudo[1846796]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 17:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:44 nativespace-cdp sudo[1846801]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 17:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:44 nativespace-cdp sudo[1846805]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 17:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:44 nativespace-cdp sudo[1846810]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 17:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:44 nativespace-cdp sudo[1846815]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 17:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:44 nativespace-cdp sudo[1846821]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 17:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:46 nativespace-cdp sudo[1846835]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 17:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:47 nativespace-cdp sudo[1846842]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hodgesonweb user-2=theblack user-3=spectrum user-4=jarvisin user-5=leereyn1 user-6=stephani user-7=agproduc user-8=still user-9=lbscrmod user-10=maflemin user-11=vantagep user-12=athenare user-13=connect9 user-14=foundation user-15=markward user-16=booff user-17=ulsukarm user-18=ptkxhsbt user-19=dickemery123 user-20=martsblo user-21=magichat user-22=hhdugcor user-23=lbhyisi user-24=atestord user-25=sarafoundation user-26=strathar user-27=brmrjxl user-28=lakesan1 user-29=megacards user-30=musorguk user-31=wilsonsw user-32=fetch user-33=carsinyo user-34=putterfi user-35=hubmaster user-36=elecleis user-37=gilpin user-38=milloyco user-39=thqkgnbz user-40=connectedshoppin user-41=ianrayne user-42=accooper user-43=opaiscyx user-44=coursemc user-45=firstres user-46=ultbcrra user-47=jonhartl
Sep  3 17:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=seftvta user-49=highlegh user-50=southlon user-51=firstred user-52=costestimatorco user-53=clarkass user-54=firstrel user-55=alexadmin user-56=skyfirec user-57=nativene user-58=askhform user-59=stuartge user-60=innovat1 user-61=oneoarco user-62=battlere user-63=vivienn1 user-64=firstre2 user-65=nstriton user-66=brighto1 user-67=bemadonn user-68=newstoda user-69=ggaaorgu user-70=belle user-71=bedfords user-72=nsceres user-73=fawcettd user-74=burydropin user-75=dhyana user-76=darkstar user-77=eatspam user-78=beauty user-79=asandcoc user-80=sibtoncc user-81=steve user-82=zebrapho user-83=bwppodcast user-84=cwsocial user-85=howardon user-86=paulmca1 user-87=pugwash user-88=ninejimm user-89=reliable user-90=cambria1 user-91=cathski user-92=courseme user-93=eugincou user-94=hirefootballgame user-95=donnychicago user-96=firstre5 user-97=steakbridieme user-98=ctedorgu user-99=philmcph user-100=lkpier
Sep  3 17:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-101=leftie user-102=foods user-103=fortunaz user-104=health2045 user-105=nscdp user-106=putterfc user-107=barbersh user-108=tigerlet user-109=nomistakes user-110=hidden user-111=smrszyqg user-112=isleofwi user-113=onlycont user-114=lucy user-115=attlebor user-116=romaldki user-117=branko user-118=ranxterc user-119=hodgsonmail user-120=outdoorc user-121=jennimil user-122=tomandle user-123=david user-124=nbhavers user-125=careers user-126=mcdermos user-127=chrisdal user-128=nvihkvu user-129=havantho user-130=sketchy user-131=cath user-132=what user-133=tstardom user-134=oubpgvbx user-135=design user-136=kategilpin user-137=dancinggardener user-138=stagingerris user-139=ladburyp user-140=boldover user-141=nove user-142=crrtipdl user-143=sosevalu user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  3 17:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 17:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:48 nativespace-cdp sudo[1846849]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 17:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:48 nativespace-cdp sudo[1846864]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-G668RO2jRKc2SP6Z.~
Sep  3 17:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:48 nativespace-cdp sudo[1846869]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-G668RO2jRKc2SP6Z.~'
Sep  3 17:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:48 nativespace-cdp sudo[1846874]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-G668RO2jRKc2SP6Z.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 17:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:48 nativespace-cdp sudo[1846880]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 17:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:48 nativespace-cdp sudo[1846885]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep  3 17:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:50 nativespace-cdp sudo[1846892]: pam_unix(sudo:session): session closed for user root
Sep  3 17:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 17:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 17:09:56 nativespace-cdp sudo[1846931]: pam_unix(sudo:session): session closed for user root
Sep  3 17:11:33 nativespace-cdp sshd[1847828]: Connection closed by 159.100.136.21 port 34328 [preauth]
Sep  3 17:16:33 nativespace-cdp sshd[1849165]: Connection closed by 159.100.136.21 port 44556 [preauth]
Sep  3 17:21:33 nativespace-cdp sshd[1850320]: Connection closed by 159.100.136.21 port 54538 [preauth]
Sep  3 17:26:33 nativespace-cdp sshd[1851958]: Connection closed by 159.100.136.21 port 36576 [preauth]
Sep  3 17:27:00 nativespace-cdp sshd[1852137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.133.133  user=root
Sep  3 17:27:00 nativespace-cdp sshd[1852137]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 17:27:02 nativespace-cdp sshd[1852137]: Failed password for root from 64.227.133.133 port 57358 ssh2
Sep  3 17:27:02 nativespace-cdp sshd[1852137]: Received disconnect from 64.227.133.133 port 57358:11: Bye Bye [preauth]
Sep  3 17:27:02 nativespace-cdp sshd[1852137]: Disconnected from 64.227.133.133 port 57358 [preauth]
Sep  3 17:28:35 nativespace-cdp sshd[1852410]: Invalid user nominatim from 201.148.20.53 port 37454
Sep  3 17:28:35 nativespace-cdp sshd[1852410]: input_userauth_request: invalid user nominatim [preauth]
Sep  3 17:28:35 nativespace-cdp sshd[1852410]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 17:28:35 nativespace-cdp sshd[1852410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.148.20.53
Sep  3 17:28:37 nativespace-cdp sshd[1852410]: Failed password for invalid user nominatim from 201.148.20.53 port 37454 ssh2
Sep  3 17:28:37 nativespace-cdp sshd[1852410]: Received disconnect from 201.148.20.53 port 37454:11: Bye Bye [preauth]
Sep  3 17:28:37 nativespace-cdp sshd[1852410]: Disconnected from 201.148.20.53 port 37454 [preauth]
Sep  3 17:31:33 nativespace-cdp sshd[1853250]: Connection closed by 159.100.136.21 port 46594 [preauth]
Sep  3 17:32:29 nativespace-cdp sshd[1853621]: Invalid user zhangxt from 201.148.20.53 port 42228
Sep  3 17:32:29 nativespace-cdp sshd[1853621]: input_userauth_request: invalid user zhangxt [preauth]
Sep  3 17:32:29 nativespace-cdp sshd[1853621]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 17:32:29 nativespace-cdp sshd[1853621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.148.20.53
Sep  3 17:32:31 nativespace-cdp sshd[1853621]: Failed password for invalid user zhangxt from 201.148.20.53 port 42228 ssh2
Sep  3 17:32:31 nativespace-cdp sshd[1853621]: Received disconnect from 201.148.20.53 port 42228:11: Bye Bye [preauth]
Sep  3 17:32:31 nativespace-cdp sshd[1853621]: Disconnected from 201.148.20.53 port 42228 [preauth]
Sep  3 17:32:49 nativespace-cdp sshd[1853665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.133.133  user=root
Sep  3 17:32:49 nativespace-cdp sshd[1853665]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 17:32:51 nativespace-cdp sshd[1853665]: Failed password for root from 64.227.133.133 port 35608 ssh2
Sep  3 17:32:51 nativespace-cdp sshd[1853665]: Received disconnect from 64.227.133.133 port 35608:11: Bye Bye [preauth]
Sep  3 17:32:51 nativespace-cdp sshd[1853665]: Disconnected from 64.227.133.133 port 35608 [preauth]
Sep  3 17:33:13 nativespace-cdp sshd[1853743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.148.20.53  user=root
Sep  3 17:33:13 nativespace-cdp sshd[1853743]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 17:33:15 nativespace-cdp sshd[1853743]: Failed password for root from 201.148.20.53 port 55972 ssh2
Sep  3 17:33:38 nativespace-cdp sshd[1853825]: Invalid user zhangxt from 64.227.133.133 port 59850
Sep  3 17:33:38 nativespace-cdp sshd[1853825]: input_userauth_request: invalid user zhangxt [preauth]
Sep  3 17:33:38 nativespace-cdp sshd[1853825]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 17:33:38 nativespace-cdp sshd[1853825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.133.133
Sep  3 17:33:41 nativespace-cdp sshd[1853825]: Failed password for invalid user zhangxt from 64.227.133.133 port 59850 ssh2
Sep  3 17:36:33 nativespace-cdp sshd[1854501]: Connection closed by 159.100.136.21 port 56904 [preauth]
Sep  3 17:41:33 nativespace-cdp sshd[1856064]: Connection closed by 159.100.136.21 port 38636 [preauth]
Sep  3 17:46:33 nativespace-cdp sshd[1857675]: Connection closed by 159.100.136.21 port 48838 [preauth]
Sep  3 17:51:33 nativespace-cdp sshd[1858946]: Connection closed by 159.100.136.21 port 58834 [preauth]
Sep  3 17:56:33 nativespace-cdp sshd[1860248]: Connection closed by 159.100.136.21 port 40880 [preauth]
Sep  3 17:59:24 nativespace-cdp sshd[1861131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.192.86  user=root
Sep  3 17:59:24 nativespace-cdp sshd[1861131]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 17:59:26 nativespace-cdp sshd[1861131]: Failed password for root from 162.214.192.86 port 35806 ssh2
Sep  3 17:59:26 nativespace-cdp sshd[1861131]: Received disconnect from 162.214.192.86 port 35806:11: Bye Bye [preauth]
Sep  3 17:59:26 nativespace-cdp sshd[1861131]: Disconnected from 162.214.192.86 port 35806 [preauth]
Sep  3 18:01:33 nativespace-cdp sshd[1861815]: Connection closed by 159.100.136.21 port 50848 [preauth]
Sep  3 18:02:47 nativespace-cdp sshd[1862182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.72.45  user=root
Sep  3 18:02:47 nativespace-cdp sshd[1862182]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 18:02:49 nativespace-cdp sshd[1862182]: Failed password for root from 167.172.72.45 port 46658 ssh2
Sep  3 18:02:49 nativespace-cdp sshd[1862182]: Received disconnect from 167.172.72.45 port 46658:11: Bye Bye [preauth]
Sep  3 18:02:49 nativespace-cdp sshd[1862182]: Disconnected from 167.172.72.45 port 46658 [preauth]
Sep  3 18:06:29 nativespace-cdp sshd[1863138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.192.86  user=root
Sep  3 18:06:29 nativespace-cdp sshd[1863138]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 18:06:31 nativespace-cdp sshd[1863138]: Failed password for root from 162.214.192.86 port 34786 ssh2
Sep  3 18:06:31 nativespace-cdp sshd[1863138]: Received disconnect from 162.214.192.86 port 34786:11: Bye Bye [preauth]
Sep  3 18:06:31 nativespace-cdp sshd[1863138]: Disconnected from 162.214.192.86 port 34786 [preauth]
Sep  3 18:06:33 nativespace-cdp sshd[1863152]: Connection closed by 159.100.136.21 port 32946 [preauth]
Sep  3 18:07:15 nativespace-cdp sshd[1863371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.192.86  user=root
Sep  3 18:07:15 nativespace-cdp sshd[1863371]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 18:07:17 nativespace-cdp sshd[1863371]: Failed password for root from 162.214.192.86 port 50492 ssh2
Sep  3 18:07:17 nativespace-cdp sshd[1863371]: Received disconnect from 162.214.192.86 port 50492:11: Bye Bye [preauth]
Sep  3 18:07:17 nativespace-cdp sshd[1863371]: Disconnected from 162.214.192.86 port 50492 [preauth]
Sep  3 18:07:35 nativespace-cdp sshd[1863458]: Invalid user zq from 167.172.72.45 port 44346
Sep  3 18:07:35 nativespace-cdp sshd[1863458]: input_userauth_request: invalid user zq [preauth]
Sep  3 18:07:35 nativespace-cdp sshd[1863458]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 18:07:35 nativespace-cdp sshd[1863458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.72.45
Sep  3 18:07:38 nativespace-cdp sshd[1863458]: Failed password for invalid user zq from 167.172.72.45 port 44346 ssh2
Sep  3 18:07:38 nativespace-cdp sshd[1863458]: Received disconnect from 167.172.72.45 port 44346:11: Bye Bye [preauth]
Sep  3 18:07:38 nativespace-cdp sshd[1863458]: Disconnected from 167.172.72.45 port 44346 [preauth]
Sep  3 18:08:24 nativespace-cdp sshd[1863636]: Invalid user z from 167.172.72.45 port 47718
Sep  3 18:08:24 nativespace-cdp sshd[1863636]: input_userauth_request: invalid user z [preauth]
Sep  3 18:08:24 nativespace-cdp sshd[1863636]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 18:08:24 nativespace-cdp sshd[1863636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.72.45
Sep  3 18:08:26 nativespace-cdp sshd[1863636]: Failed password for invalid user z from 167.172.72.45 port 47718 ssh2
Sep  3 18:08:26 nativespace-cdp sshd[1863636]: Received disconnect from 167.172.72.45 port 47718:11: Bye Bye [preauth]
Sep  3 18:08:26 nativespace-cdp sshd[1863636]: Disconnected from 167.172.72.45 port 47718 [preauth]
Sep  3 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:42 nativespace-cdp sudo[1863900]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:42 nativespace-cdp sudo[1863904]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:43 nativespace-cdp sudo[1863909]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:43 nativespace-cdp sudo[1863916]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:47 nativespace-cdp sudo[1863922]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 18:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:47 nativespace-cdp sudo[1863944]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 18:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:47 nativespace-cdp sudo[1863949]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 18:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:47 nativespace-cdp sudo[1863953]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 18:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:47 nativespace-cdp sudo[1863959]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 18:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:47 nativespace-cdp sudo[1863965]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 18:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:47 nativespace-cdp sudo[1863970]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 18:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:51 nativespace-cdp sudo[1863986]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 18:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:52 nativespace-cdp sudo[1863992]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=highlegh user-2=southlon user-3=firstred user-4=costestimatorco user-5=clarkass user-6=firstrel user-7=opaiscyx user-8=coursemc user-9=firstres user-10=ultbcrra user-11=jonhartl user-12=seftvta user-13=thqkgnbz user-14=connectedshoppin user-15=ianrayne user-16=accooper user-17=fetch user-18=carsinyo user-19=hubmaster user-20=putterfi user-21=elecleis user-22=milloyco user-23=gilpin user-24=bemadonn user-25=newstoda user-26=ggaaorgu user-27=belle user-28=bedfords user-29=oneoarco user-30=battlere user-31=vivienn1 user-32=firstre2 user-33=nstriton user-34=brighto1 user-35=nativene user-36=askhform user-37=stuartge user-38=innovat1 user-39=alexadmin user-40=skyfirec user-41=ulsukarm user-42=lbscrmod user-43=maflemin user-44=vantagep user-45=connect9 user-46=athenare user-47=foundation
Sep  3 18:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=markward user-49=booff user-50=leereyn1 user-51=stephani user-52=agproduc user-53=still user-54=hodgesonweb user-55=theblack user-56=spectrum user-57=jarvisin user-58=megacards user-59=musorguk user-60=wilsonsw user-61=atestord user-62=sarafoundation user-63=strathar user-64=brmrjxl user-65=lakesan1 user-66=magichat user-67=hhdugcor user-68=lbhyisi user-69=ptkxhsbt user-70=dickemery123 user-71=martsblo user-72=david user-73=careers user-74=nbhavers user-75=mcdermos user-76=chrisdal user-77=jennimil user-78=tomandle user-79=romaldki user-80=branko user-81=outdoorc user-82=hodgsonmail user-83=ranxterc user-84=onlycont user-85=lucy user-86=attlebor user-87=crrtipdl user-88=sosevalu user-89=bakery user-90=boldover user-91=nove user-92=design user-93=kategilpin user-94=stagingerris user-95=dancinggardener user-96=ladburyp user-97=nvihkvu user-98=havantho user-99=cath user-100=sketchy user-101=what
Sep  3 18:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=tstardom user-103=oubpgvbx user-104=steve user-105=zebrapho user-106=bwppodcast user-107=sibtoncc user-108=asandcoc user-109=dhyana user-110=darkstar user-111=eatspam user-112=beauty user-113=nsceres user-114=fawcettd user-115=burydropin user-116=tigerlet user-117=barbersh user-118=nomistakes user-119=hidden user-120=isleofwi user-121=smrszyqg user-122=firstre5 user-123=donnychicago user-124=steakbridieme user-125=philmcph user-126=ctedorgu user-127=lkpier user-128=foods user-129=leftie user-130=fortunaz user-131=health2045 user-132=nscdp user-133=putterfc user-134=courseme user-135=eugincou user-136=hirefootballgame user-137=cwsocial user-138=paulmca1 user-139=howardon user-140=pugwash user-141=reliable user-142=ninejimm user-143=cambria1 user-144=cathski feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  3 18:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 18:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:53 nativespace-cdp sudo[1864000]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 18:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:53 nativespace-cdp sudo[1864009]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qkWnjG4R1ZscrLim.~
Sep  3 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:54 nativespace-cdp sudo[1864014]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qkWnjG4R1ZscrLim.~'
Sep  3 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:54 nativespace-cdp sudo[1864019]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qkWnjG4R1ZscrLim.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:54 nativespace-cdp sudo[1864025]: pam_unix(sudo:session): session closed for user root
Sep  3 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:09:54 nativespace-cdp sudo[1864030]: pam_unix(sudo:session): session closed for user root
Sep  3 18:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 18:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 18:10:12 nativespace-cdp sudo[1864303]: pam_unix(sudo:session): session closed for user root
Sep  3 18:11:33 nativespace-cdp sshd[1864569]: Connection closed by 159.100.136.21 port 42918 [preauth]
Sep  3 18:16:33 nativespace-cdp sshd[1866035]: Connection closed by 159.100.136.21 port 53124 [preauth]
Sep  3 18:21:33 nativespace-cdp sshd[1867213]: Connection closed by 159.100.136.21 port 34866 [preauth]
Sep  3 18:26:33 nativespace-cdp sshd[1868831]: Connection closed by 159.100.136.21 port 45104 [preauth]
Sep  3 18:31:33 nativespace-cdp sshd[1870036]: Connection closed by 159.100.136.21 port 55142 [preauth]
Sep  3 18:36:33 nativespace-cdp sshd[1871195]: Connection closed by 159.100.136.21 port 37210 [preauth]
Sep  3 18:41:33 nativespace-cdp sshd[1872680]: Connection closed by 159.100.136.21 port 47176 [preauth]
Sep  3 18:46:33 nativespace-cdp sshd[1873820]: Connection closed by 159.100.136.21 port 57374 [preauth]
Sep  3 18:51:33 nativespace-cdp sshd[1874958]: Connection closed by 159.100.136.21 port 39152 [preauth]
Sep  3 18:56:33 nativespace-cdp sshd[1876064]: Connection closed by 159.100.136.21 port 49398 [preauth]
Sep  3 19:01:33 nativespace-cdp sshd[1877599]: Connection closed by 159.100.136.21 port 59412 [preauth]
Sep  3 19:06:33 nativespace-cdp sshd[1878666]: Connection closed by 159.100.136.21 port 41494 [preauth]
Sep  3 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:36 nativespace-cdp sudo[1879274]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:36 nativespace-cdp sudo[1879278]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:37 nativespace-cdp sudo[1879283]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:37 nativespace-cdp sudo[1879289]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:39 nativespace-cdp sudo[1879296]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:40 nativespace-cdp sudo[1879313]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:40 nativespace-cdp sudo[1879318]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:40 nativespace-cdp sudo[1879322]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:40 nativespace-cdp sudo[1879327]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:40 nativespace-cdp sudo[1879332]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:40 nativespace-cdp sudo[1879338]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 19:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:41 nativespace-cdp sudo[1879349]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 19:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:42 nativespace-cdp sudo[1879355]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=reliable user-2=ninejimm user-3=cambria1 user-4=cathski user-5=paulmca1 user-6=howardon user-7=pugwash user-8=cwsocial user-9=hirefootballgame user-10=courseme user-11=eugincou user-12=fortunaz user-13=health2045 user-14=foods user-15=leftie user-16=putterfc user-17=nscdp user-18=philmcph user-19=ctedorgu user-20=firstre5 user-21=steakbridieme user-22=donnychicago user-23=lkpier user-24=smrszyqg user-25=isleofwi user-26=tigerlet user-27=barbersh user-28=hidden user-29=nomistakes user-30=burydropin user-31=fawcettd user-32=nsceres user-33=eatspam user-34=darkstar user-35=beauty user-36=dhyana user-37=asandcoc user-38=sibtoncc user-39=zebrapho user-40=bwppodcast user-41=steve user-42=what user-43=oubpgvbx user-44=tstardom user-45=nvihkvu user-46=cath user-47=sketchy user-48=havantho
Sep  3 19:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=kategilpin user-50=ladburyp user-51=stagingerris user-52=dancinggardener user-53=design user-54=nove user-55=boldover user-56=sosevalu user-57=crrtipdl user-58=bakery user-59=attlebor user-60=lucy user-61=onlycont user-62=branko user-63=ranxterc user-64=hodgsonmail user-65=outdoorc user-66=romaldki user-67=tomandle user-68=jennimil user-69=mcdermos user-70=chrisdal user-71=nbhavers user-72=careers user-73=david user-74=martsblo user-75=ptkxhsbt user-76=dickemery123 user-77=lbhyisi user-78=hhdugcor user-79=magichat user-80=brmrjxl user-81=lakesan1 user-82=sarafoundation user-83=atestord user-84=strathar user-85=wilsonsw user-86=musorguk user-87=megacards user-88=jarvisin user-89=theblack user-90=hodgesonweb user-91=spectrum user-92=still user-93=agproduc user-94=leereyn1 user-95=stephani user-96=markward user-97=foundation user-98=booff user-99=maflemin user-100=lbscrmod user-101=athenare user-102=connect9
Sep  3 19:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=vantagep user-104=ulsukarm user-105=skyfirec user-106=alexadmin user-107=stuartge user-108=askhform user-109=innovat1 user-110=nativene user-111=brighto1 user-112=nstriton user-113=battlere user-114=oneoarco user-115=firstre2 user-116=vivienn1 user-117=bedfords user-118=bemadonn user-119=belle user-120=ggaaorgu user-121=newstoda user-122=elecleis user-123=gilpin user-124=milloyco user-125=carsinyo user-126=fetch user-127=hubmaster user-128=putterfi user-129=ianrayne user-130=accooper user-131=thqkgnbz user-132=connectedshoppin user-133=firstres user-134=seftvta user-135=jonhartl user-136=ultbcrra user-137=coursemc user-138=opaiscyx user-139=costestimatorco user-140=clarkass user-141=firstrel user-142=southlon user-143=highlegh user-144=firstred feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 19:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 19:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:43 nativespace-cdp sudo[1879363]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:43 nativespace-cdp sudo[1879373]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VX9xRjeXsvlkmc35.~
Sep  3 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:43 nativespace-cdp sudo[1879379]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VX9xRjeXsvlkmc35.~'
Sep  3 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:43 nativespace-cdp sudo[1879383]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VX9xRjeXsvlkmc35.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:43 nativespace-cdp sudo[1879389]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:43 nativespace-cdp sudo[1879394]: pam_unix(sudo:session): session closed for user root
Sep  3 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 19:09:48 nativespace-cdp sudo[1879429]: pam_unix(sudo:session): session closed for user root
Sep  3 19:11:34 nativespace-cdp sshd[1879992]: Connection closed by 159.100.136.21 port 51514 [preauth]
Sep  3 19:16:33 nativespace-cdp sshd[1881535]: Connection closed by 159.100.136.21 port 33500 [preauth]
Sep  3 19:21:33 nativespace-cdp sshd[1882673]: Connection closed by 159.100.136.21 port 43500 [preauth]
Sep  3 19:26:33 nativespace-cdp sshd[1883869]: Connection closed by 159.100.136.21 port 53786 [preauth]
Sep  3 19:31:33 nativespace-cdp sshd[1885285]: Connection closed by 159.100.136.21 port 35630 [preauth]
Sep  3 19:36:33 nativespace-cdp sshd[1886401]: Connection closed by 159.100.136.21 port 45916 [preauth]
Sep  3 19:41:33 nativespace-cdp sshd[1887964]: Connection closed by 159.100.136.21 port 55916 [preauth]
Sep  3 19:46:33 nativespace-cdp sshd[1889310]: Connection closed by 159.100.136.21 port 37942 [preauth]
Sep  3 19:51:33 nativespace-cdp sshd[1890410]: Connection closed by 159.100.136.21 port 47956 [preauth]
Sep  3 19:56:33 nativespace-cdp sshd[1891850]: Connection closed by 159.100.136.21 port 57460 [preauth]
Sep  3 20:01:33 nativespace-cdp sshd[1893245]: Connection closed by 159.100.136.21 port 39240 [preauth]
Sep  3 20:06:33 nativespace-cdp sshd[1894271]: Connection closed by 159.100.136.21 port 49592 [preauth]
Sep  3 20:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 20:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:44 nativespace-cdp sudo[1894938]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 20:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:44 nativespace-cdp sudo[1894942]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 20:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:48 nativespace-cdp sudo[1894947]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:49 nativespace-cdp sudo[1894961]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:52 nativespace-cdp sudo[1894968]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 20:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:52 nativespace-cdp sudo[1894982]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 20:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:52 nativespace-cdp sudo[1894988]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 20:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:52 nativespace-cdp sudo[1894992]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 20:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:52 nativespace-cdp sudo[1894997]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 20:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:52 nativespace-cdp sudo[1895002]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 20:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:52 nativespace-cdp sudo[1895008]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 20:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:55 nativespace-cdp sudo[1895027]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 20:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:56 nativespace-cdp sudo[1895033]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tstardom user-2=oubpgvbx user-3=what user-4=havantho user-5=cath user-6=sketchy user-7=nvihkvu user-8=dancinggardener user-9=stagingerris user-10=ladburyp user-11=kategilpin user-12=design user-13=nove user-14=boldover user-15=bakery user-16=crrtipdl user-17=sosevalu user-18=lucy user-19=attlebor user-20=onlycont user-21=hodgsonmail user-22=ranxterc user-23=outdoorc user-24=branko user-25=romaldki user-26=tomandle user-27=jennimil user-28=chrisdal user-29=mcdermos user-30=david user-31=nbhavers user-32=careers user-33=cathski user-34=cambria1 user-35=reliable user-36=ninejimm user-37=cwsocial user-38=pugwash user-39=paulmca1 user-40=howardon user-41=hirefootballgame user-42=eugincou user-43=courseme user-44=nscdp user-45=putterfc user-46=leftie user-47=foods user-48=fortunaz user-49=health2045
Sep  3 20:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=lkpier user-51=donnychicago user-52=firstre5 user-53=steakbridieme user-54=philmcph user-55=ctedorgu user-56=smrszyqg user-57=isleofwi user-58=nomistakes user-59=hidden user-60=barbersh user-61=tigerlet user-62=fawcettd user-63=burydropin user-64=nsceres user-65=beauty user-66=darkstar user-67=eatspam user-68=dhyana user-69=sibtoncc user-70=asandcoc user-71=bwppodcast user-72=zebrapho user-73=steve user-74=alexadmin user-75=skyfirec user-76=innovat1 user-77=stuartge user-78=askhform user-79=nativene user-80=nstriton user-81=brighto1 user-82=vivienn1 user-83=firstre2 user-84=oneoarco user-85=battlere user-86=bedfords user-87=newstoda user-88=belle user-89=ggaaorgu user-90=bemadonn user-91=milloyco user-92=gilpin user-93=elecleis user-94=hubmaster user-95=putterfi user-96=fetch user-97=carsinyo user-98=accooper user-99=ianrayne user-100=connectedshoppin user-101=thqkgnbz user-102=ultbcrra user-103=seftvta
Sep  3 20:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=jonhartl user-105=firstres user-106=opaiscyx user-107=coursemc user-108=clarkass user-109=firstrel user-110=costestimatorco user-111=firstred user-112=highlegh user-113=southlon user-114=martsblo user-115=dickemery123 user-116=ptkxhsbt user-117=hhdugcor user-118=lbhyisi user-119=magichat user-120=brmrjxl user-121=lakesan1 user-122=strathar user-123=atestord user-124=sarafoundation user-125=wilsonsw user-126=megacards user-127=musorguk user-128=jarvisin user-129=spectrum user-130=hodgesonweb user-131=theblack user-132=agproduc user-133=still user-134=stephani user-135=leereyn1 user-136=markward user-137=foundation user-138=booff user-139=vantagep user-140=connect9 user-141=athenare user-142=lbscrmod user-143=maflemin user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 20:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 20:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:57 nativespace-cdp sudo[1895041]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:58 nativespace-cdp sudo[1895081]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ft4zqstddyp4Ufw3.~
Sep  3 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:58 nativespace-cdp sudo[1895086]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ft4zqstddyp4Ufw3.~'
Sep  3 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:58 nativespace-cdp sudo[1895091]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ft4zqstddyp4Ufw3.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:58 nativespace-cdp sudo[1895097]: pam_unix(sudo:session): session closed for user root
Sep  3 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:09:58 nativespace-cdp sudo[1895102]: pam_unix(sudo:session): session closed for user root
Sep  3 20:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 20:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 20:10:23 nativespace-cdp sudo[1895432]: pam_unix(sudo:session): session closed for user root
Sep  3 20:10:51 nativespace-cdp sshd[1895567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.205.37.233  user=root
Sep  3 20:10:51 nativespace-cdp sshd[1895567]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 20:10:53 nativespace-cdp sshd[1895567]: Failed password for root from 203.205.37.233 port 60486 ssh2
Sep  3 20:10:53 nativespace-cdp sshd[1895567]: Received disconnect from 203.205.37.233 port 60486:11: Bye Bye [preauth]
Sep  3 20:10:53 nativespace-cdp sshd[1895567]: Disconnected from 203.205.37.233 port 60486 [preauth]
Sep  3 20:11:33 nativespace-cdp sshd[1895705]: Connection closed by 159.100.136.21 port 59654 [preauth]
Sep  3 20:16:33 nativespace-cdp sshd[1897037]: Connection closed by 159.100.136.21 port 41658 [preauth]
Sep  3 20:17:06 nativespace-cdp sshd[1897145]: Invalid user discordbot from 190.128.241.2 port 43516
Sep  3 20:17:06 nativespace-cdp sshd[1897145]: input_userauth_request: invalid user discordbot [preauth]
Sep  3 20:17:06 nativespace-cdp sshd[1897145]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 20:17:06 nativespace-cdp sshd[1897145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.128.241.2
Sep  3 20:17:08 nativespace-cdp sshd[1897145]: Failed password for invalid user discordbot from 190.128.241.2 port 43516 ssh2
Sep  3 20:17:08 nativespace-cdp sshd[1897145]: Received disconnect from 190.128.241.2 port 43516:11: Bye Bye [preauth]
Sep  3 20:17:08 nativespace-cdp sshd[1897145]: Disconnected from 190.128.241.2 port 43516 [preauth]
Sep  3 20:18:30 nativespace-cdp sshd[1897474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.205.37.233  user=root
Sep  3 20:18:30 nativespace-cdp sshd[1897474]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 20:18:32 nativespace-cdp sshd[1897474]: Failed password for root from 203.205.37.233 port 60022 ssh2
Sep  3 20:18:33 nativespace-cdp sshd[1897474]: Received disconnect from 203.205.37.233 port 60022:11: Bye Bye [preauth]
Sep  3 20:18:33 nativespace-cdp sshd[1897474]: Disconnected from 203.205.37.233 port 60022 [preauth]
Sep  3 20:19:24 nativespace-cdp sshd[1897628]: Invalid user wcsuser from 190.128.241.2 port 54826
Sep  3 20:19:24 nativespace-cdp sshd[1897628]: input_userauth_request: invalid user wcsuser [preauth]
Sep  3 20:19:24 nativespace-cdp sshd[1897628]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 20:19:24 nativespace-cdp sshd[1897628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.128.241.2
Sep  3 20:19:26 nativespace-cdp sshd[1897628]: Failed password for invalid user wcsuser from 190.128.241.2 port 54826 ssh2
Sep  3 20:19:26 nativespace-cdp sshd[1897628]: Received disconnect from 190.128.241.2 port 54826:11: Bye Bye [preauth]
Sep  3 20:19:26 nativespace-cdp sshd[1897628]: Disconnected from 190.128.241.2 port 54826 [preauth]
Sep  3 20:19:53 nativespace-cdp sshd[1897696]: Invalid user melendez from 203.205.37.233 port 46212
Sep  3 20:19:53 nativespace-cdp sshd[1897696]: input_userauth_request: invalid user melendez [preauth]
Sep  3 20:19:53 nativespace-cdp sshd[1897696]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 20:19:53 nativespace-cdp sshd[1897696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.205.37.233
Sep  3 20:19:56 nativespace-cdp sshd[1897696]: Failed password for invalid user melendez from 203.205.37.233 port 46212 ssh2
Sep  3 20:20:14 nativespace-cdp sshd[1897893]: Invalid user ils from 190.128.241.2 port 40862
Sep  3 20:20:14 nativespace-cdp sshd[1897893]: input_userauth_request: invalid user ils [preauth]
Sep  3 20:20:14 nativespace-cdp sshd[1897893]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 20:20:14 nativespace-cdp sshd[1897893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.128.241.2
Sep  3 20:20:16 nativespace-cdp sshd[1897893]: Failed password for invalid user ils from 190.128.241.2 port 40862 ssh2
Sep  3 20:20:16 nativespace-cdp sshd[1897893]: Received disconnect from 190.128.241.2 port 40862:11: Bye Bye [preauth]
Sep  3 20:20:16 nativespace-cdp sshd[1897893]: Disconnected from 190.128.241.2 port 40862 [preauth]
Sep  3 20:21:33 nativespace-cdp sshd[1898217]: Connection closed by 159.100.136.21 port 50928 [preauth]
Sep  3 20:26:33 nativespace-cdp sshd[1899706]: Connection closed by 159.100.136.21 port 32994 [preauth]
Sep  3 20:31:33 nativespace-cdp sshd[1900975]: Connection closed by 159.100.136.21 port 43066 [preauth]
Sep  3 20:36:33 nativespace-cdp sshd[1902057]: Connection closed by 159.100.136.21 port 53368 [preauth]
Sep  3 20:41:33 nativespace-cdp sshd[1903412]: Connection closed by 159.100.136.21 port 35106 [preauth]
Sep  3 20:46:33 nativespace-cdp sshd[1904642]: Connection closed by 159.100.136.21 port 45358 [preauth]
Sep  3 20:51:33 nativespace-cdp sshd[1905742]: Connection closed by 159.100.136.21 port 55372 [preauth]
Sep  3 20:56:33 nativespace-cdp sshd[1906867]: Connection closed by 159.100.136.21 port 37438 [preauth]
Sep  3 21:01:33 nativespace-cdp sshd[1908514]: Connection closed by 159.100.136.21 port 47456 [preauth]
Sep  3 21:06:33 nativespace-cdp sshd[1909546]: Connection closed by 159.100.136.21 port 57808 [preauth]
Sep  3 21:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 21:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:36 nativespace-cdp sudo[1910133]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 21:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:36 nativespace-cdp sudo[1910138]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 21:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:37 nativespace-cdp sudo[1910143]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 21:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:37 nativespace-cdp sudo[1910149]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 21:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:40 nativespace-cdp sudo[1910157]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:40 nativespace-cdp sudo[1910173]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:40 nativespace-cdp sudo[1910178]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:40 nativespace-cdp sudo[1910182]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:41 nativespace-cdp sudo[1910187]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:41 nativespace-cdp sudo[1910194]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:41 nativespace-cdp sudo[1910200]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:42 nativespace-cdp sudo[1910210]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:43 nativespace-cdp sudo[1910216]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=mcdermos user-2=chrisdal user-3=careers user-4=nbhavers user-5=david user-6=tomandle user-7=jennimil user-8=branko user-9=hodgsonmail user-10=ranxterc user-11=outdoorc user-12=romaldki user-13=attlebor user-14=lucy user-15=onlycont user-16=sosevalu user-17=crrtipdl user-18=bakery user-19=nove user-20=boldover user-21=kategilpin user-22=ladburyp user-23=dancinggardener user-24=stagingerris user-25=design user-26=what user-27=oubpgvbx user-28=tstardom user-29=nvihkvu user-30=sketchy user-31=cath user-32=havantho user-33=zebrapho user-34=bwppodcast user-35=steve user-36=asandcoc user-37=sibtoncc user-38=eatspam user-39=darkstar user-40=beauty user-41=dhyana user-42=burydropin user-43=fawcettd user-44=nsceres user-45=smrszyqg user-46=isleofwi user-47=barbersh user-48=tigerlet user-49=hidden
Sep  3 21:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=nomistakes user-51=health2045 user-52=fortunaz user-53=leftie user-54=foods user-55=putterfc user-56=nscdp user-57=philmcph user-58=ctedorgu user-59=steakbridieme user-60=firstre5 user-61=donnychicago user-62=lkpier user-63=hirefootballgame user-64=courseme user-65=eugincou user-66=reliable user-67=ninejimm user-68=cambria1 user-69=cathski user-70=paulmca1 user-71=pugwash user-72=howardon user-73=cwsocial user-74=costestimatorco user-75=clarkass user-76=firstrel user-77=southlon user-78=highlegh user-79=firstred user-80=firstres user-81=seftvta user-82=jonhartl user-83=ultbcrra user-84=coursemc user-85=opaiscyx user-86=ianrayne user-87=accooper user-88=thqkgnbz user-89=connectedshoppin user-90=elecleis user-91=gilpin user-92=milloyco user-93=carsinyo user-94=fetch user-95=putterfi user-96=hubmaster user-97=bedfords user-98=bemadonn user-99=belle user-100=ggaaorgu user-101=newstoda user-102=brighto1
Sep  3 21:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=nstriton user-104=battlere user-105=oneoarco user-106=firstre2 user-107=vivienn1 user-108=stuartge user-109=askhform user-110=innovat1 user-111=nativene user-112=skyfirec user-113=alexadmin user-114=ulsukarm user-115=markward user-116=booff user-117=foundation user-118=maflemin user-119=lbscrmod user-120=connect9 user-121=athenare user-122=vantagep user-123=still user-124=agproduc user-125=leereyn1 user-126=stephani user-127=jarvisin user-128=hodgesonweb user-129=theblack user-130=spectrum user-131=wilsonsw user-132=musorguk user-133=megacards user-134=lakesan1 user-135=brmrjxl user-136=sarafoundation user-137=atestord user-138=strathar user-139=lbhyisi user-140=hhdugcor user-141=magichat user-142=martsblo user-143=ptkxhsbt user-144=dickemery123 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 21:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:43 nativespace-cdp sudo[1910223]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:44 nativespace-cdp sudo[1910232]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-r3ccg8KHInH0QuGm.~
Sep  3 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:44 nativespace-cdp sudo[1910237]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-r3ccg8KHInH0QuGm.~'
Sep  3 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:44 nativespace-cdp sudo[1910241]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-r3ccg8KHInH0QuGm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:44 nativespace-cdp sudo[1910247]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:44 nativespace-cdp sudo[1910252]: pam_unix(sudo:session): session closed for user root
Sep  3 21:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 21:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:09:48 nativespace-cdp sudo[1910287]: pam_unix(sudo:session): session closed for user root
Sep  3 21:11:33 nativespace-cdp sshd[1911165]: Connection closed by 159.100.136.21 port 39584 [preauth]
Sep  3 21:16:33 nativespace-cdp sshd[1912408]: Connection closed by 159.100.136.21 port 49804 [preauth]
Sep  3 21:21:33 nativespace-cdp sshd[1913432]: Connection closed by 159.100.136.21 port 59784 [preauth]
Sep  3 21:26:33 nativespace-cdp sshd[1914624]: Connection closed by 159.100.136.21 port 41846 [preauth]
Sep  3 21:31:33 nativespace-cdp sshd[1916068]: Connection closed by 159.100.136.21 port 51902 [preauth]
Sep  3 21:36:33 nativespace-cdp sshd[1917401]: Connection closed by 159.100.136.21 port 34004 [preauth]
Sep  3 21:41:33 nativespace-cdp sshd[1918993]: Connection closed by 159.100.136.21 port 43976 [preauth]
Sep  3 21:45:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 21:45:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:45:34 nativespace-cdp sudo[1920332]: pam_unix(sudo:session): session closed for user root
Sep  3 21:45:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status askhform
Sep  3 21:45:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:45:36 nativespace-cdp sudo[1920343]: pam_unix(sudo:session): session closed for user root
Sep  3 21:45:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 21:45:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:45:39 nativespace-cdp sudo[1920380]: pam_unix(sudo:session): session closed for user root
Sep  3 21:45:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  3 21:45:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:45:40 nativespace-cdp sudo[1920385]: pam_unix(sudo:session): session closed for user root
Sep  3 21:45:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 21:45:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:45:42 nativespace-cdp sudo[1920401]: pam_unix(sudo:session): session closed for user root
Sep  3 21:45:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status paulmca1
Sep  3 21:45:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:45:42 nativespace-cdp sudo[1920405]: pam_unix(sudo:session): session closed for user root
Sep  3 21:46:34 nativespace-cdp sshd[1920666]: Connection closed by 159.100.136.21 port 54192 [preauth]
Sep  3 21:51:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 21:51:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:51:31 nativespace-cdp sudo[1922992]: pam_unix(sudo:session): session closed for user root
Sep  3 21:51:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status strathar
Sep  3 21:51:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:51:33 nativespace-cdp sudo[1923042]: pam_unix(sudo:session): session closed for user root
Sep  3 21:51:34 nativespace-cdp sshd[1923047]: Connection closed by 159.100.136.21 port 35964 [preauth]
Sep  3 21:51:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 21:51:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:51:37 nativespace-cdp sudo[1923065]: pam_unix(sudo:session): session closed for user root
Sep  3 21:51:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status strathar
Sep  3 21:51:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:51:38 nativespace-cdp sudo[1923070]: pam_unix(sudo:session): session closed for user root
Sep  3 21:51:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 21:51:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:51:39 nativespace-cdp sudo[1923087]: pam_unix(sudo:session): session closed for user root
Sep  3 21:51:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status strathar
Sep  3 21:51:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:51:40 nativespace-cdp sudo[1923092]: pam_unix(sudo:session): session closed for user root
Sep  3 21:51:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 21:51:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:51:41 nativespace-cdp sudo[1923117]: pam_unix(sudo:session): session closed for user root
Sep  3 21:51:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status strathar
Sep  3 21:51:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 21:51:42 nativespace-cdp sudo[1923122]: pam_unix(sudo:session): session closed for user root
Sep  3 21:56:33 nativespace-cdp sshd[1924780]: Connection closed by 159.100.136.21 port 46248 [preauth]
Sep  3 22:01:33 nativespace-cdp sshd[1926203]: Connection closed by 159.100.136.21 port 56248 [preauth]
Sep  3 22:06:33 nativespace-cdp sshd[1927281]: Connection closed by 159.100.136.21 port 38370 [preauth]
Sep  3 22:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 22:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:42 nativespace-cdp sudo[1927978]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 22:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:42 nativespace-cdp sudo[1927982]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 22:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:43 nativespace-cdp sudo[1927987]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:43 nativespace-cdp sudo[1927993]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:46 nativespace-cdp sudo[1927999]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 22:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:46 nativespace-cdp sudo[1928013]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 22:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:46 nativespace-cdp sudo[1928018]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 22:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:46 nativespace-cdp sudo[1928022]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 22:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:46 nativespace-cdp sudo[1928027]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 22:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:46 nativespace-cdp sudo[1928033]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 22:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:46 nativespace-cdp sudo[1928040]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 22:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:48 nativespace-cdp sudo[1928051]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 22:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:49 nativespace-cdp sudo[1928058]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bakery user-2=sosevalu user-3=crrtipdl user-4=boldover user-5=nove user-6=design user-7=ladburyp user-8=dancinggardener user-9=stagingerris user-10=kategilpin user-11=sketchy user-12=cath user-13=havantho user-14=nvihkvu user-15=tstardom user-16=oubpgvbx user-17=what user-18=careers user-19=nbhavers user-20=david user-21=chrisdal user-22=mcdermos user-23=jennimil user-24=tomandle user-25=romaldki user-26=hodgsonmail user-27=ranxterc user-28=outdoorc user-29=branko user-30=onlycont user-31=attlebor user-32=lucy user-33=hidden user-34=nomistakes user-35=barbersh user-36=tigerlet user-37=isleofwi user-38=smrszyqg user-39=lkpier user-40=philmcph user-41=ctedorgu user-42=donnychicago user-43=firstre5 user-44=steakbridieme user-45=putterfc user-46=nscdp user-47=health2045 user-48=fortunaz
Sep  3 22:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=leftie user-50=foods user-51=eugincou user-52=courseme user-53=hirefootballgame user-54=paulmca1 user-55=pugwash user-56=howardon user-57=cwsocial user-58=cambria1 user-59=cathski user-60=ninejimm user-61=reliable user-62=steve user-63=bwppodcast user-64=zebrapho user-65=asandcoc user-66=sibtoncc user-67=dhyana user-68=beauty user-69=eatspam user-70=darkstar user-71=nsceres user-72=burydropin user-73=fawcettd user-74=ggaaorgu user-75=belle user-76=newstoda user-77=bemadonn user-78=bedfords user-79=firstre2 user-80=vivienn1 user-81=battlere user-82=oneoarco user-83=brighto1 user-84=nstriton user-85=nativene user-86=innovat1 user-87=askhform user-88=stuartge user-89=alexadmin user-90=skyfirec user-91=firstred user-92=southlon user-93=highlegh user-94=firstrel user-95=clarkass user-96=costestimatorco user-97=opaiscyx user-98=coursemc user-99=seftvta user-100=jonhartl user-101=ultbcrra user-102=firstres
Sep  3 22:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=connectedshoppin user-104=thqkgnbz user-105=accooper user-106=ianrayne user-107=putterfi user-108=hubmaster user-109=carsinyo user-110=fetch user-111=milloyco user-112=gilpin user-113=elecleis user-114=musorguk user-115=megacards user-116=wilsonsw user-117=strathar user-118=sarafoundation user-119=atestord user-120=lakesan1 user-121=brmrjxl user-122=magichat user-123=lbhyisi user-124=hhdugcor user-125=dickemery123 user-126=ptkxhsbt user-127=martsblo user-128=ulsukarm user-129=athenare user-130=connect9 user-131=vantagep user-132=maflemin user-133=lbscrmod user-134=markward user-135=foundation user-136=booff user-137=stephani user-138=leereyn1 user-139=still user-140=agproduc user-141=spectrum user-142=hodgesonweb user-143=theblack user-144=jarvisin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 22:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 22:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:49 nativespace-cdp sudo[1928064]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 22:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:50 nativespace-cdp sudo[1928072]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-We7P5OeWQv4LS1Hz.~
Sep  3 22:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:50 nativespace-cdp sudo[1928078]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-We7P5OeWQv4LS1Hz.~'
Sep  3 22:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:50 nativespace-cdp sudo[1928082]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-We7P5OeWQv4LS1Hz.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 22:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:50 nativespace-cdp sudo[1928088]: pam_unix(sudo:session): session closed for user root
Sep  3 22:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 22:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:09:50 nativespace-cdp sudo[1928093]: pam_unix(sudo:session): session closed for user root
Sep  3 22:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 22:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 22:10:05 nativespace-cdp sudo[1928616]: pam_unix(sudo:session): session closed for user root
Sep  3 22:11:33 nativespace-cdp sshd[1928926]: Connection closed by 159.100.136.21 port 48384 [preauth]
Sep  3 22:16:33 nativespace-cdp sshd[1930053]: Connection closed by 159.100.136.21 port 58590 [preauth]
Sep  3 22:21:33 nativespace-cdp sshd[1931121]: Connection closed by 159.100.136.21 port 40338 [preauth]
Sep  3 22:26:33 nativespace-cdp sshd[1932349]: Connection closed by 159.100.136.21 port 50614 [preauth]
Sep  3 22:28:45 nativespace-cdp sshd[1932766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.4.149.237  user=root
Sep  3 22:28:45 nativespace-cdp sshd[1932766]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 22:28:47 nativespace-cdp sshd[1932766]: Failed password for root from 181.4.149.237 port 30061 ssh2
Sep  3 22:28:47 nativespace-cdp sshd[1932766]: Received disconnect from 181.4.149.237 port 30061:11: Bye Bye [preauth]
Sep  3 22:28:47 nativespace-cdp sshd[1932766]: Disconnected from 181.4.149.237 port 30061 [preauth]
Sep  3 22:29:15 nativespace-cdp sshd[1932942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.132.180.115  user=root
Sep  3 22:29:15 nativespace-cdp sshd[1932942]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 22:29:17 nativespace-cdp sshd[1932942]: Failed password for root from 161.132.180.115 port 3419 ssh2
Sep  3 22:29:17 nativespace-cdp sshd[1932942]: Received disconnect from 161.132.180.115 port 3419:11: Bye Bye [preauth]
Sep  3 22:29:17 nativespace-cdp sshd[1932942]: Disconnected from 161.132.180.115 port 3419 [preauth]
Sep  3 22:31:33 nativespace-cdp sshd[1933748]: Connection closed by 159.100.136.21 port 60658 [preauth]
Sep  3 22:32:50 nativespace-cdp sshd[1933976]: Invalid user db2inst1 from 161.132.180.115 port 3420
Sep  3 22:32:50 nativespace-cdp sshd[1933976]: input_userauth_request: invalid user db2inst1 [preauth]
Sep  3 22:32:50 nativespace-cdp sshd[1933976]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 22:32:50 nativespace-cdp sshd[1933976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.132.180.115
Sep  3 22:32:53 nativespace-cdp sshd[1933976]: Failed password for invalid user db2inst1 from 161.132.180.115 port 3420 ssh2
Sep  3 22:32:53 nativespace-cdp sshd[1933976]: Received disconnect from 161.132.180.115 port 3420:11: Bye Bye [preauth]
Sep  3 22:32:53 nativespace-cdp sshd[1933976]: Disconnected from 161.132.180.115 port 3420 [preauth]
Sep  3 22:33:15 nativespace-cdp sshd[1934048]: Invalid user thchen from 181.4.149.237 port 56826
Sep  3 22:33:15 nativespace-cdp sshd[1934048]: input_userauth_request: invalid user thchen [preauth]
Sep  3 22:33:15 nativespace-cdp sshd[1934048]: pam_unix(sshd:auth): check pass; user unknown
Sep  3 22:33:15 nativespace-cdp sshd[1934048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.4.149.237
Sep  3 22:33:18 nativespace-cdp sshd[1934048]: Failed password for invalid user thchen from 181.4.149.237 port 56826 ssh2
Sep  3 22:33:18 nativespace-cdp sshd[1934048]: Received disconnect from 181.4.149.237 port 56826:11: Bye Bye [preauth]
Sep  3 22:33:18 nativespace-cdp sshd[1934048]: Disconnected from 181.4.149.237 port 56826 [preauth]
Sep  3 22:33:39 nativespace-cdp sshd[1934104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.132.180.115  user=root
Sep  3 22:33:39 nativespace-cdp sshd[1934104]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 22:33:42 nativespace-cdp sshd[1934104]: Failed password for root from 161.132.180.115 port 3421 ssh2
Sep  3 22:33:42 nativespace-cdp sshd[1934104]: Received disconnect from 161.132.180.115 port 3421:11: Bye Bye [preauth]
Sep  3 22:33:42 nativespace-cdp sshd[1934104]: Disconnected from 161.132.180.115 port 3421 [preauth]
Sep  3 22:34:10 nativespace-cdp sshd[1934209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.4.149.237  user=root
Sep  3 22:34:10 nativespace-cdp sshd[1934209]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  3 22:34:13 nativespace-cdp sshd[1934209]: Failed password for root from 181.4.149.237 port 28057 ssh2
Sep  3 22:34:13 nativespace-cdp sshd[1934209]: Received disconnect from 181.4.149.237 port 28057:11: Bye Bye [preauth]
Sep  3 22:34:13 nativespace-cdp sshd[1934209]: Disconnected from 181.4.149.237 port 28057 [preauth]
Sep  3 22:36:33 nativespace-cdp sshd[1934839]: Connection closed by 159.100.136.21 port 42702 [preauth]
Sep  3 22:41:33 nativespace-cdp sshd[1936265]: Connection closed by 159.100.136.21 port 52650 [preauth]
Sep  3 22:46:33 nativespace-cdp sshd[1937359]: Connection closed by 159.100.136.21 port 34644 [preauth]
Sep  3 22:51:33 nativespace-cdp sshd[1938461]: Connection closed by 159.100.136.21 port 44636 [preauth]
Sep  3 22:56:33 nativespace-cdp sshd[1939600]: Connection closed by 159.100.136.21 port 54912 [preauth]
Sep  3 23:01:33 nativespace-cdp sshd[1941089]: Connection closed by 159.100.136.21 port 36644 [preauth]
Sep  3 23:06:33 nativespace-cdp sshd[1942144]: Connection closed by 159.100.136.21 port 46966 [preauth]
Sep  3 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  3 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:41 nativespace-cdp sudo[1942761]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  3 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:41 nativespace-cdp sudo[1942765]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  3 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:42 nativespace-cdp sudo[1942770]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  3 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:42 nativespace-cdp sudo[1942779]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  3 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:52 nativespace-cdp sudo[1942785]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  3 23:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:52 nativespace-cdp sudo[1942822]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  3 23:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:52 nativespace-cdp sudo[1942826]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  3 23:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:52 nativespace-cdp sudo[1942831]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  3 23:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:52 nativespace-cdp sudo[1942836]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  3 23:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:52 nativespace-cdp sudo[1942841]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  3 23:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:52 nativespace-cdp sudo[1942847]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  3 23:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:54 nativespace-cdp sudo[1942858]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  3 23:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:54 nativespace-cdp sudo[1942866]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jennimil user-2=tomandle user-3=david user-4=nbhavers user-5=careers user-6=chrisdal user-7=mcdermos user-8=onlycont user-9=lucy user-10=attlebor user-11=romaldki user-12=ranxterc user-13=hodgsonmail user-14=outdoorc user-15=branko user-16=boldover user-17=nove user-18=bakery user-19=crrtipdl user-20=sosevalu user-21=havantho user-22=sketchy user-23=cath user-24=nvihkvu user-25=tstardom user-26=oubpgvbx user-27=what user-28=design user-29=stagingerris user-30=dancinggardener user-31=ladburyp user-32=kategilpin user-33=sibtoncc user-34=asandcoc user-35=steve user-36=bwppodcast user-37=zebrapho user-38=nsceres user-39=fawcettd user-40=burydropin user-41=dhyana user-42=beauty user-43=darkstar user-44=eatspam user-45=lkpier user-46=steakbridieme user-47=firstre5 user-48=donnychicago user-49=philmcph
Sep  3 23:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=ctedorgu user-51=nscdp user-52=putterfc user-53=foods user-54=leftie user-55=health2045 user-56=fortunaz user-57=nomistakes user-58=hidden user-59=tigerlet user-60=barbersh user-61=smrszyqg user-62=isleofwi user-63=cwsocial user-64=howardon user-65=paulmca1 user-66=pugwash user-67=cathski user-68=cambria1 user-69=ninejimm user-70=reliable user-71=eugincou user-72=courseme user-73=hirefootballgame user-74=opaiscyx user-75=coursemc user-76=ultbcrra user-77=seftvta user-78=jonhartl user-79=firstres user-80=firstred user-81=highlegh user-82=southlon user-83=clarkass user-84=firstrel user-85=costestimatorco user-86=hubmaster user-87=putterfi user-88=fetch user-89=carsinyo user-90=milloyco user-91=gilpin user-92=elecleis user-93=connectedshoppin user-94=thqkgnbz user-95=accooper user-96=ianrayne user-97=vivienn1 user-98=firstre2 user-99=oneoarco user-100=battlere user-101=nstriton user-102=brighto1
Sep  3 23:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=newstoda user-104=ggaaorgu user-105=belle user-106=bemadonn user-107=bedfords user-108=skyfirec user-109=alexadmin user-110=nativene user-111=innovat1 user-112=stuartge user-113=askhform user-114=vantagep user-115=connect9 user-116=athenare user-117=lbscrmod user-118=maflemin user-119=foundation user-120=markward user-121=booff user-122=ulsukarm user-123=spectrum user-124=hodgesonweb user-125=theblack user-126=jarvisin user-127=stephani user-128=leereyn1 user-129=agproduc user-130=still user-131=strathar user-132=atestord user-133=sarafoundation user-134=brmrjxl user-135=lakesan1 user-136=megacards user-137=musorguk user-138=wilsonsw user-139=dickemery123 user-140=ptkxhsbt user-141=martsblo user-142=magichat user-143=hhdugcor user-144=lbhyisi feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  3 23:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  3 23:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:55 nativespace-cdp sudo[1942873]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 23:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:55 nativespace-cdp sudo[1942879]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kiaYquV2eyLlDjpo.~
Sep  3 23:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:55 nativespace-cdp sudo[1942885]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kiaYquV2eyLlDjpo.~'
Sep  3 23:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:55 nativespace-cdp sudo[1942889]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kiaYquV2eyLlDjpo.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  3 23:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:55 nativespace-cdp sudo[1942895]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  3 23:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:55 nativespace-cdp sudo[1942900]: pam_unix(sudo:session): session closed for user root
Sep  3 23:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  3 23:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  3 23:09:56 nativespace-cdp sudo[1942924]: pam_unix(sudo:session): session closed for user root
Sep  3 23:11:33 nativespace-cdp sshd[1944071]: Connection closed by 159.100.136.21 port 56944 [preauth]
Sep  3 23:16:33 nativespace-cdp sshd[1945133]: Connection closed by 159.100.136.21 port 38906 [preauth]
Sep  3 23:21:33 nativespace-cdp sshd[1946351]: Connection closed by 159.100.136.21 port 48922 [preauth]
Sep  3 23:26:33 nativespace-cdp sshd[1947642]: Connection closed by 159.100.136.21 port 59178 [preauth]
Sep  3 23:31:33 nativespace-cdp sshd[1948920]: Connection closed by 159.100.136.21 port 40998 [preauth]
Sep  3 23:36:33 nativespace-cdp sshd[1950668]: Connection closed by 159.100.136.21 port 51294 [preauth]
Sep  3 23:41:33 nativespace-cdp sshd[1952102]: Connection closed by 159.100.136.21 port 33030 [preauth]
Sep  3 23:46:33 nativespace-cdp sshd[1953125]: Connection closed by 159.100.136.21 port 43246 [preauth]
Sep  3 23:51:33 nativespace-cdp sshd[1954485]: Connection closed by 159.100.136.21 port 53260 [preauth]
Sep  3 23:56:33 nativespace-cdp sshd[1955832]: Connection closed by 159.100.136.21 port 35274 [preauth]
Sep  4 00:01:33 nativespace-cdp sshd[1957092]: Connection closed by 159.100.136.21 port 45270 [preauth]
Sep  4 00:06:33 nativespace-cdp sshd[1958126]: Connection closed by 159.100.136.21 port 55592 [preauth]
Sep  4 00:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 00:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:44 nativespace-cdp sudo[1958624]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 00:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:44 nativespace-cdp sudo[1958629]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 00:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:45 nativespace-cdp sudo[1958634]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 00:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:45 nativespace-cdp sudo[1958641]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 00:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:47 nativespace-cdp sudo[1958647]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 00:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:47 nativespace-cdp sudo[1958658]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 00:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:47 nativespace-cdp sudo[1958663]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 00:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:47 nativespace-cdp sudo[1958667]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 00:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:47 nativespace-cdp sudo[1958672]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 00:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:47 nativespace-cdp sudo[1958677]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 00:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:47 nativespace-cdp sudo[1958683]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 00:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:49 nativespace-cdp sudo[1958693]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 00:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:49 nativespace-cdp sudo[1958699]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nsceres user-2=fawcettd user-3=burydropin user-4=dhyana user-5=darkstar user-6=eatspam user-7=beauty user-8=asandcoc user-9=sibtoncc user-10=steve user-11=zebrapho user-12=bwppodcast user-13=cwsocial user-14=paulmca1 user-15=howardon user-16=pugwash user-17=ninejimm user-18=reliable user-19=cambria1 user-20=cathski user-21=courseme user-22=eugincou user-23=hirefootballgame user-24=firstre5 user-25=steakbridieme user-26=donnychicago user-27=philmcph user-28=ctedorgu user-29=lkpier user-30=foods user-31=leftie user-32=health2045 user-33=fortunaz user-34=nscdp user-35=putterfc user-36=tigerlet user-37=barbersh user-38=nomistakes user-39=hidden user-40=smrszyqg user-41=isleofwi user-42=onlycont user-43=lucy user-44=attlebor user-45=romaldki user-46=branko user-47=hodgsonmail user-48=outdoorc
Sep  4 00:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ranxterc user-50=jennimil user-51=tomandle user-52=david user-53=nbhavers user-54=careers user-55=mcdermos user-56=chrisdal user-57=nvihkvu user-58=havantho user-59=sketchy user-60=cath user-61=what user-62=tstardom user-63=oubpgvbx user-64=design user-65=kategilpin user-66=stagingerris user-67=dancinggardener user-68=ladburyp user-69=boldover user-70=nove user-71=crrtipdl user-72=sosevalu user-73=bakery user-74=theblack user-75=hodgesonweb user-76=spectrum user-77=jarvisin user-78=leereyn1 user-79=stephani user-80=agproduc user-81=still user-82=lbscrmod user-83=maflemin user-84=vantagep user-85=connect9 user-86=athenare user-87=booff user-88=markward user-89=foundation user-90=ulsukarm user-91=ptkxhsbt user-92=dickemery123 user-93=martsblo user-94=magichat user-95=hhdugcor user-96=lbhyisi user-97=atestord user-98=sarafoundation user-99=strathar user-100=brmrjxl user-101=lakesan1 user-102=megacards
Sep  4 00:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=musorguk user-104=wilsonsw user-105=fetch user-106=carsinyo user-107=putterfi user-108=hubmaster user-109=elecleis user-110=gilpin user-111=milloyco user-112=thqkgnbz user-113=connectedshoppin user-114=ianrayne user-115=accooper user-116=coursemc user-117=opaiscyx user-118=firstres user-119=ultbcrra user-120=jonhartl user-121=seftvta user-122=highlegh user-123=southlon user-124=firstred user-125=costestimatorco user-126=firstrel user-127=clarkass user-128=alexadmin user-129=skyfirec user-130=nativene user-131=askhform user-132=stuartge user-133=innovat1 user-134=oneoarco user-135=battlere user-136=vivienn1 user-137=firstre2 user-138=nstriton user-139=brighto1 user-140=bemadonn user-141=newstoda user-142=ggaaorgu user-143=belle user-144=bedfords feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 00:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 00:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:50 nativespace-cdp sudo[1958706]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 00:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:50 nativespace-cdp sudo[1958714]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Dvcr3Em59S9bUz25.~
Sep  4 00:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:50 nativespace-cdp sudo[1958719]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Dvcr3Em59S9bUz25.~'
Sep  4 00:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:50 nativespace-cdp sudo[1958723]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Dvcr3Em59S9bUz25.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 00:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:50 nativespace-cdp sudo[1958729]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 00:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:50 nativespace-cdp sudo[1958734]: pam_unix(sudo:session): session closed for user root
Sep  4 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 00:09:51 nativespace-cdp sudo[1958754]: pam_unix(sudo:session): session closed for user root
Sep  4 00:11:33 nativespace-cdp sshd[1959389]: Connection closed by 159.100.136.21 port 37318 [preauth]
Sep  4 00:16:33 nativespace-cdp sshd[1960677]: Connection closed by 159.100.136.21 port 47528 [preauth]
Sep  4 00:21:33 nativespace-cdp sshd[1961803]: Connection closed by 159.100.136.21 port 57508 [preauth]
Sep  4 00:26:33 nativespace-cdp sshd[1963056]: Connection closed by 159.100.136.21 port 39524 [preauth]
Sep  4 00:31:33 nativespace-cdp sshd[1964134]: Connection closed by 159.100.136.21 port 49574 [preauth]
Sep  4 00:36:33 nativespace-cdp sshd[1965170]: Connection closed by 159.100.136.21 port 59834 [preauth]
Sep  4 00:41:33 nativespace-cdp sshd[1966613]: Connection closed by 159.100.136.21 port 41564 [preauth]
Sep  4 00:46:33 nativespace-cdp sshd[1967821]: Connection closed by 159.100.136.21 port 51798 [preauth]
Sep  4 00:51:33 nativespace-cdp sshd[1968901]: Connection closed by 159.100.136.21 port 33552 [preauth]
Sep  4 00:56:33 nativespace-cdp sshd[1970013]: Connection closed by 159.100.136.21 port 43828 [preauth]
Sep  4 01:01:33 nativespace-cdp sshd[1971684]: Connection closed by 159.100.136.21 port 53816 [preauth]
Sep  4 01:06:33 nativespace-cdp sshd[1972871]: Connection closed by 159.100.136.21 port 35870 [preauth]
Sep  4 01:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 01:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:45 nativespace-cdp sudo[1973425]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 01:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:45 nativespace-cdp sudo[1973428]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 01:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:47 nativespace-cdp sudo[1973431]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 01:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:47 nativespace-cdp sudo[1973436]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 01:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:49 nativespace-cdp sudo[1973439]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 01:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:49 nativespace-cdp sudo[1973449]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 01:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:49 nativespace-cdp sudo[1973452]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 01:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:49 nativespace-cdp sudo[1973455]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 01:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:49 nativespace-cdp sudo[1973458]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 01:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:49 nativespace-cdp sudo[1973461]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 01:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:49 nativespace-cdp sudo[1973464]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 01:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:51 nativespace-cdp sudo[1973476]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 01:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:51 nativespace-cdp sudo[1973480]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=highlegh user-2=southlon user-3=firstred user-4=costestimatorco user-5=clarkass user-6=firstrel user-7=coursemc user-8=opaiscyx user-9=firstres user-10=ultbcrra user-11=jonhartl user-12=seftvta user-13=thqkgnbz user-14=connectedshoppin user-15=ianrayne user-16=accooper user-17=fetch user-18=carsinyo user-19=putterfi user-20=hubmaster user-21=elecleis user-22=milloyco user-23=gilpin user-24=bemadonn user-25=newstoda user-26=ggaaorgu user-27=belle user-28=bedfords user-29=oneoarco user-30=battlere user-31=vivienn1 user-32=firstre2 user-33=nstriton user-34=brighto1 user-35=nativene user-36=stuartge user-37=askhform user-38=innovat1 user-39=skyfirec user-40=alexadmin user-41=ulsukarm user-42=lbscrmod user-43=maflemin user-44=vantagep user-45=connect9 user-46=athenare user-47=markward
Sep  4 01:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=foundation user-49=booff user-50=leereyn1 user-51=stephani user-52=agproduc user-53=still user-54=theblack user-55=hodgesonweb user-56=spectrum user-57=jarvisin user-58=megacards user-59=musorguk user-60=wilsonsw user-61=atestord user-62=sarafoundation user-63=strathar user-64=lakesan1 user-65=brmrjxl user-66=magichat user-67=hhdugcor user-68=lbhyisi user-69=ptkxhsbt user-70=dickemery123 user-71=martsblo user-72=david user-73=nbhavers user-74=careers user-75=mcdermos user-76=chrisdal user-77=jennimil user-78=tomandle user-79=romaldki user-80=branko user-81=hodgsonmail user-82=ranxterc user-83=outdoorc user-84=onlycont user-85=lucy user-86=attlebor user-87=crrtipdl user-88=sosevalu user-89=bakery user-90=boldover user-91=nove user-92=design user-93=kategilpin user-94=dancinggardener user-95=stagingerris user-96=ladburyp user-97=nvihkvu user-98=havantho user-99=cath user-100=sketchy user-101=what
Sep  4 01:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=tstardom user-103=oubpgvbx user-104=steve user-105=zebrapho user-106=bwppodcast user-107=asandcoc user-108=sibtoncc user-109=dhyana user-110=darkstar user-111=eatspam user-112=beauty user-113=nsceres user-114=fawcettd user-115=burydropin user-116=tigerlet user-117=barbersh user-118=nomistakes user-119=hidden user-120=isleofwi user-121=smrszyqg user-122=firstre5 user-123=steakbridieme user-124=donnychicago user-125=philmcph user-126=ctedorgu user-127=lkpier user-128=leftie user-129=foods user-130=fortunaz user-131=health2045 user-132=nscdp user-133=putterfc user-134=courseme user-135=eugincou user-136=hirefootballgame user-137=cwsocial user-138=pugwash user-139=paulmca1 user-140=howardon user-141=ninejimm user-142=reliable user-143=cambria1 user-144=cathski feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  4 01:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 01:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:52 nativespace-cdp sudo[1973485]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 01:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:52 nativespace-cdp sudo[1973490]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-0WptK7Ra2p91zuxx.~
Sep  4 01:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:52 nativespace-cdp sudo[1973495]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-0WptK7Ra2p91zuxx.~'
Sep  4 01:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:52 nativespace-cdp sudo[1973498]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-0WptK7Ra2p91zuxx.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 01:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:52 nativespace-cdp sudo[1973503]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 01:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:52 nativespace-cdp sudo[1973506]: pam_unix(sudo:session): session closed for user root
Sep  4 01:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 01:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 01:09:54 nativespace-cdp sudo[1973527]: pam_unix(sudo:session): session closed for user root
Sep  4 01:11:33 nativespace-cdp sshd[1974295]: Connection closed by 159.100.136.21 port 45848 [preauth]
Sep  4 01:16:33 nativespace-cdp sshd[1975252]: Connection closed by 159.100.136.21 port 56058 [preauth]
Sep  4 01:21:33 nativespace-cdp sshd[1976580]: Connection closed by 159.100.136.21 port 37820 [preauth]
Sep  4 01:26:33 nativespace-cdp sshd[1977686]: Connection closed by 159.100.136.21 port 48064 [preauth]
Sep  4 01:31:33 nativespace-cdp sshd[1978846]: Connection closed by 159.100.136.21 port 58090 [preauth]
Sep  4 01:36:33 nativespace-cdp sshd[1979859]: Connection closed by 159.100.136.21 port 40148 [preauth]
Sep  4 01:41:33 nativespace-cdp sshd[1981077]: Connection closed by 159.100.136.21 port 50132 [preauth]
Sep  4 01:46:33 nativespace-cdp sshd[1982065]: Connection closed by 159.100.136.21 port 60326 [preauth]
Sep  4 01:51:33 nativespace-cdp sshd[1983170]: Connection closed by 159.100.136.21 port 42110 [preauth]
Sep  4 01:56:33 nativespace-cdp sshd[1984367]: Connection closed by 159.100.136.21 port 52354 [preauth]
Sep  4 02:01:33 nativespace-cdp sshd[1985458]: Connection closed by 159.100.136.21 port 34108 [preauth]
Sep  4 02:06:33 nativespace-cdp sshd[1986484]: Connection closed by 159.100.136.21 port 44430 [preauth]
Sep  4 02:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 02:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:41 nativespace-cdp sudo[1986932]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 02:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:41 nativespace-cdp sudo[1986935]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 02:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:42 nativespace-cdp sudo[1986938]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 02:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:42 nativespace-cdp sudo[1986942]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 02:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:43 nativespace-cdp sudo[1986945]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:43 nativespace-cdp sudo[1986956]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:43 nativespace-cdp sudo[1986960]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:43 nativespace-cdp sudo[1986963]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:43 nativespace-cdp sudo[1986966]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:43 nativespace-cdp sudo[1986969]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:43 nativespace-cdp sudo[1986973]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 02:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:45 nativespace-cdp sudo[1986980]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 02:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:45 nativespace-cdp sudo[1986984]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=stephani user-2=leereyn1 user-3=agproduc user-4=still user-5=spectrum user-6=hodgesonweb user-7=theblack user-8=jarvisin user-9=ulsukarm user-10=vantagep user-11=connect9 user-12=athenare user-13=lbscrmod user-14=maflemin user-15=markward user-16=booff user-17=foundation user-18=magichat user-19=hhdugcor user-20=lbhyisi user-21=dickemery123 user-22=ptkxhsbt user-23=martsblo user-24=megacards user-25=musorguk user-26=wilsonsw user-27=strathar user-28=atestord user-29=sarafoundation user-30=brmrjxl user-31=lakesan1 user-32=connectedshoppin user-33=thqkgnbz user-34=accooper user-35=ianrayne user-36=hubmaster user-37=putterfi user-38=fetch user-39=carsinyo user-40=milloyco user-41=gilpin user-42=elecleis user-43=firstred user-44=highlegh user-45=southlon user-46=clarkass user-47=firstrel
Sep  4 02:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=costestimatorco user-49=coursemc user-50=opaiscyx user-51=ultbcrra user-52=seftvta user-53=jonhartl user-54=firstres user-55=nativene user-56=innovat1 user-57=askhform user-58=stuartge user-59=alexadmin user-60=skyfirec user-61=newstoda user-62=belle user-63=ggaaorgu user-64=bemadonn user-65=bedfords user-66=vivienn1 user-67=firstre2 user-68=oneoarco user-69=battlere user-70=nstriton user-71=brighto1 user-72=dhyana user-73=beauty user-74=darkstar user-75=eatspam user-76=nsceres user-77=fawcettd user-78=burydropin user-79=steve user-80=bwppodcast user-81=zebrapho user-82=sibtoncc user-83=asandcoc user-84=eugincou user-85=courseme user-86=hirefootballgame user-87=cwsocial user-88=paulmca1 user-89=pugwash user-90=howardon user-91=cathski user-92=cambria1 user-93=reliable user-94=ninejimm user-95=nomistakes user-96=hidden user-97=tigerlet user-98=barbersh user-99=isleofwi user-100=smrszyqg user-101=lkpier
Sep  4 02:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=steakbridieme user-103=firstre5 user-104=donnychicago user-105=ctedorgu user-106=philmcph user-107=nscdp user-108=putterfc user-109=foods user-110=leftie user-111=health2045 user-112=fortunaz user-113=romaldki user-114=hodgsonmail user-115=ranxterc user-116=outdoorc user-117=branko user-118=onlycont user-119=lucy user-120=attlebor user-121=david user-122=nbhavers user-123=careers user-124=chrisdal user-125=mcdermos user-126=jennimil user-127=tomandle user-128=design user-129=stagingerris user-130=dancinggardener user-131=ladburyp user-132=kategilpin user-133=havantho user-134=sketchy user-135=cath user-136=nvihkvu user-137=tstardom user-138=oubpgvbx user-139=what user-140=bakery user-141=crrtipdl user-142=sosevalu user-143=boldover user-144=nove feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 02:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 02:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:46 nativespace-cdp sudo[1986988]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 02:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:46 nativespace-cdp sudo[1986994]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tLNmvuspt2JHx2uM.~
Sep  4 02:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:46 nativespace-cdp sudo[1986997]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tLNmvuspt2JHx2uM.~'
Sep  4 02:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:46 nativespace-cdp sudo[1987000]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tLNmvuspt2JHx2uM.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 02:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:46 nativespace-cdp sudo[1987004]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 02:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:46 nativespace-cdp sudo[1987007]: pam_unix(sudo:session): session closed for user root
Sep  4 02:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 02:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:09:47 nativespace-cdp sudo[1987025]: pam_unix(sudo:session): session closed for user root
Sep  4 02:11:36 nativespace-cdp sshd[1987512]: Connection closed by 159.100.136.21 port 54402 [preauth]
Sep  4 02:12:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 02:12:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 02:12:02 nativespace-cdp sudo[1987578]: pam_unix(sudo:session): session closed for user root
Sep  4 02:16:33 nativespace-cdp sshd[1988892]: Connection closed by 159.100.136.21 port 34636 [preauth]
Sep  4 02:21:33 nativespace-cdp sshd[1989914]: Connection closed by 159.100.136.21 port 44598 [preauth]
Sep  4 02:26:33 nativespace-cdp sshd[1991151]: Connection closed by 159.100.136.21 port 54852 [preauth]
Sep  4 02:31:33 nativespace-cdp sshd[1992141]: Connection closed by 159.100.136.21 port 36660 [preauth]
Sep  4 02:36:33 nativespace-cdp sshd[1993073]: Connection closed by 159.100.136.21 port 46966 [preauth]
Sep  4 02:41:33 nativespace-cdp sshd[1994318]: Connection closed by 159.100.136.21 port 56896 [preauth]
Sep  4 02:46:33 nativespace-cdp sshd[1995261]: Connection closed by 159.100.136.21 port 38890 [preauth]
Sep  4 02:51:33 nativespace-cdp sshd[1996219]: Connection closed by 159.100.136.21 port 48894 [preauth]
Sep  4 02:56:33 nativespace-cdp sshd[1997521]: Connection closed by 159.100.136.21 port 59144 [preauth]
Sep  4 03:01:33 nativespace-cdp sshd[1998582]: Connection closed by 159.100.136.21 port 40888 [preauth]
Sep  4 03:06:33 nativespace-cdp sshd[1999476]: Connection closed by 159.100.136.21 port 51216 [preauth]
Sep  4 03:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 03:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:42 nativespace-cdp sudo[1999908]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 03:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:42 nativespace-cdp sudo[1999911]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 03:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:42 nativespace-cdp sudo[1999914]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 03:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:42 nativespace-cdp sudo[1999918]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 03:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:44 nativespace-cdp sudo[1999921]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 03:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:44 nativespace-cdp sudo[1999932]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 03:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:44 nativespace-cdp sudo[1999936]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 03:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:44 nativespace-cdp sudo[1999939]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 03:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:44 nativespace-cdp sudo[1999942]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 03:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:44 nativespace-cdp sudo[1999945]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 03:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:44 nativespace-cdp sudo[1999948]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 03:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:46 nativespace-cdp sudo[1999957]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 03:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:46 nativespace-cdp sudo[1999961]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hodgsonmail user-2=ranxterc user-3=outdoorc user-4=branko user-5=romaldki user-6=lucy user-7=attlebor user-8=onlycont user-9=chrisdal user-10=mcdermos user-11=david user-12=nbhavers user-13=careers user-14=tomandle user-15=jennimil user-16=dancinggardener user-17=stagingerris user-18=ladburyp user-19=kategilpin user-20=design user-21=oubpgvbx user-22=tstardom user-23=what user-24=havantho user-25=cath user-26=sketchy user-27=nvihkvu user-28=bakery user-29=crrtipdl user-30=sosevalu user-31=nove user-32=boldover user-33=beauty user-34=darkstar user-35=eatspam user-36=dhyana user-37=fawcettd user-38=burydropin user-39=nsceres user-40=bwppodcast user-41=zebrapho user-42=steve user-43=asandcoc user-44=sibtoncc user-45=hirefootballgame user-46=eugincou user-47=courseme user-48=cambria1 user-49=cathski
Sep  4 03:09:46 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=ninejimm user-51=reliable user-52=cwsocial user-53=howardon user-54=paulmca1 user-55=pugwash user-56=isleofwi user-57=smrszyqg user-58=nomistakes user-59=hidden user-60=tigerlet user-61=barbersh user-62=nscdp user-63=putterfc user-64=leftie user-65=foods user-66=health2045 user-67=fortunaz user-68=lkpier user-69=steakbridieme user-70=firstre5 user-71=donnychicago user-72=ctedorgu user-73=philmcph user-74=accooper user-75=ianrayne user-76=connectedshoppin user-77=thqkgnbz user-78=milloyco user-79=gilpin user-80=elecleis user-81=hubmaster user-82=putterfi user-83=fetch user-84=carsinyo user-85=clarkass user-86=firstrel user-87=costestimatorco user-88=firstred user-89=highlegh user-90=southlon user-91=ultbcrra user-92=jonhartl user-93=seftvta user-94=firstres user-95=opaiscyx user-96=coursemc user-97=innovat1 user-98=askhform user-99=stuartge user-100=nativene user-101=alexadmin user-102=skyfirec
Sep  4 03:09:46 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=newstoda user-105=ggaaorgu user-106=belle user-107=bemadonn user-108=nstriton user-109=brighto1 user-110=vivienn1 user-111=firstre2 user-112=oneoarco user-113=battlere user-114=agproduc user-115=still user-116=stephani user-117=leereyn1 user-118=jarvisin user-119=spectrum user-120=theblack user-121=hodgesonweb user-122=ulsukarm user-123=booff user-124=foundation user-125=markward user-126=vantagep user-127=connect9 user-128=athenare user-129=lbscrmod user-130=maflemin user-131=hhdugcor user-132=lbhyisi user-133=magichat user-134=martsblo user-135=dickemery123 user-136=ptkxhsbt user-137=wilsonsw user-138=megacards user-139=musorguk user-140=brmrjxl user-141=lakesan1 user-142=strathar user-143=atestord user-144=sarafoundation feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 03:09:46 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 03:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:47 nativespace-cdp sudo[1999967]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 03:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:47 nativespace-cdp sudo[1999972]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-OcsNxLwy4gS33aXO.~
Sep  4 03:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:47 nativespace-cdp sudo[1999975]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-OcsNxLwy4gS33aXO.~'
Sep  4 03:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:47 nativespace-cdp sudo[1999979]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-OcsNxLwy4gS33aXO.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 03:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:47 nativespace-cdp sudo[1999983]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 03:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:47 nativespace-cdp sudo[1999986]: pam_unix(sudo:session): session closed for user root
Sep  4 03:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 03:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 03:09:48 nativespace-cdp sudo[2000005]: pam_unix(sudo:session): session closed for user root
Sep  4 03:11:33 nativespace-cdp sshd[2000783]: Connection closed by 159.100.136.21 port 32948 [preauth]
Sep  4 03:16:33 nativespace-cdp sshd[2001737]: Connection closed by 159.100.136.21 port 43158 [preauth]
Sep  4 03:21:33 nativespace-cdp sshd[2002614]: Connection closed by 159.100.136.21 port 53146 [preauth]
Sep  4 03:26:33 nativespace-cdp sshd[2003578]: Connection closed by 159.100.136.21 port 35158 [preauth]
Sep  4 03:31:33 nativespace-cdp sshd[2004803]: Connection closed by 159.100.136.21 port 45206 [preauth]
Sep  4 03:36:33 nativespace-cdp sshd[2005697]: Connection closed by 159.100.136.21 port 55470 [preauth]
Sep  4 03:41:33 nativespace-cdp sshd[2007082]: Connection closed by 159.100.136.21 port 37210 [preauth]
Sep  4 03:46:33 nativespace-cdp sshd[2008047]: Connection closed by 159.100.136.21 port 47452 [preauth]
Sep  4 03:51:33 nativespace-cdp sshd[2009231]: Connection closed by 159.100.136.21 port 57426 [preauth]
Sep  4 03:54:14 nativespace-cdp sshd[2009679]: Did not receive identification string from 199.45.154.130 port 52052
Sep  4 03:54:32 nativespace-cdp sshd[2009701]: Connection closed by 199.45.154.130 port 43194 [preauth]
Sep  4 03:56:33 nativespace-cdp sshd[2010428]: Connection closed by 159.100.136.21 port 39476 [preauth]
Sep  4 04:01:33 nativespace-cdp sshd[2011493]: Connection closed by 159.100.136.21 port 49452 [preauth]
Sep  4 04:06:33 nativespace-cdp sshd[2012591]: Connection closed by 159.100.136.21 port 59760 [preauth]
Sep  4 04:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 04:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:45 nativespace-cdp sudo[2013145]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 04:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:45 nativespace-cdp sudo[2013148]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 04:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:46 nativespace-cdp sudo[2013151]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 04:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:46 nativespace-cdp sudo[2013155]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 04:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:48 nativespace-cdp sudo[2013159]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:48 nativespace-cdp sudo[2013170]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:48 nativespace-cdp sudo[2013173]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:48 nativespace-cdp sudo[2013176]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:48 nativespace-cdp sudo[2013179]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:48 nativespace-cdp sudo[2013182]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:48 nativespace-cdp sudo[2013185]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 04:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:50 nativespace-cdp sudo[2013193]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 04:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:51 nativespace-cdp sudo[2013197]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=hodgesonweb user-3=theblack user-4=spectrum user-5=still user-6=agproduc user-7=leereyn1 user-8=stephani user-9=foundation user-10=markward user-11=booff user-12=maflemin user-13=lbscrmod user-14=connect9 user-15=athenare user-16=vantagep user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=lbhyisi user-22=hhdugcor user-23=magichat user-24=brmrjxl user-25=lakesan1 user-26=sarafoundation user-27=atestord user-28=strathar user-29=wilsonsw user-30=musorguk user-31=megacards user-32=elecleis user-33=gilpin user-34=milloyco user-35=carsinyo user-36=fetch user-37=putterfi user-38=hubmaster user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=seftvta user-45=jonhartl user-46=ultbcrra user-47=coursemc
Sep  4 04:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=opaiscyx user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=southlon user-53=highlegh user-54=firstred user-55=alexadmin user-56=skyfirec user-57=askhform user-58=stuartge user-59=innovat1 user-60=nativene user-61=brighto1 user-62=nstriton user-63=battlere user-64=oneoarco user-65=firstre2 user-66=vivienn1 user-67=bedfords user-68=bemadonn user-69=ggaaorgu user-70=belle user-71=newstoda user-72=burydropin user-73=fawcettd user-74=nsceres user-75=eatspam user-76=darkstar user-77=beauty user-78=dhyana user-79=asandcoc user-80=sibtoncc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=ninejimm user-85=reliable user-86=cathski user-87=cambria1 user-88=howardon user-89=paulmca1 user-90=pugwash user-91=cwsocial user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=health2045 user-96=fortunaz user-97=foods user-98=leftie user-99=putterfc user-100=nscdp user-101=philmcph
Sep  4 04:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ctedorgu user-103=firstre5 user-104=donnychicago user-105=steakbridieme user-106=lkpier user-107=isleofwi user-108=smrszyqg user-109=tigerlet user-110=barbersh user-111=hidden user-112=nomistakes user-113=attlebor user-114=lucy user-115=onlycont user-116=branko user-117=hodgsonmail user-118=ranxterc user-119=outdoorc user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=nbhavers user-126=careers user-127=david user-128=what user-129=tstardom user-130=oubpgvbx user-131=nvihkvu user-132=cath user-133=sketchy user-134=havantho user-135=kategilpin user-136=ladburyp user-137=stagingerris user-138=dancinggardener user-139=design user-140=nove user-141=boldover user-142=sosevalu user-143=crrtipdl user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 04:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 04:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:51 nativespace-cdp sudo[2013202]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 04:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:51 nativespace-cdp sudo[2013206]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3XqsJXeMnA1cVVf3.~
Sep  4 04:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:51 nativespace-cdp sudo[2013209]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3XqsJXeMnA1cVVf3.~'
Sep  4 04:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:51 nativespace-cdp sudo[2013213]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3XqsJXeMnA1cVVf3.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 04:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:52 nativespace-cdp sudo[2013217]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 04:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:52 nativespace-cdp sudo[2013220]: pam_unix(sudo:session): session closed for user root
Sep  4 04:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 04:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:09:53 nativespace-cdp sudo[2013243]: pam_unix(sudo:session): session closed for user root
Sep  4 04:11:33 nativespace-cdp sshd[2013778]: Connection closed by 159.100.136.21 port 41492 [preauth]
Sep  4 04:16:34 nativespace-cdp sshd[2014927]: Connection closed by 159.100.136.21 port 51710 [preauth]
Sep  4 04:21:33 nativespace-cdp sshd[2016023]: Connection closed by 159.100.136.21 port 33430 [preauth]
Sep  4 04:26:33 nativespace-cdp sshd[2017324]: Connection closed by 159.100.136.21 port 43698 [preauth]
Sep  4 04:31:33 nativespace-cdp sshd[2018361]: Connection closed by 159.100.136.21 port 53724 [preauth]
Sep  4 04:36:32 nativespace-cdp sshd[2020675]: Connection closed by 159.100.136.21 port 35774 [preauth]
Sep  4 04:41:32 nativespace-cdp sshd[2023646]: Connection closed by 159.100.136.21 port 45740 [preauth]
Sep  4 04:46:33 nativespace-cdp sshd[2024834]: Connection closed by 159.100.136.21 port 55956 [preauth]
Sep  4 04:51:33 nativespace-cdp sshd[2025859]: Connection closed by 159.100.136.21 port 37720 [preauth]
Sep  4 04:56:33 nativespace-cdp sshd[2027034]: Connection closed by 159.100.136.21 port 48002 [preauth]
Sep  4 04:56:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 04:56:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:56:47 nativespace-cdp sudo[2027067]: pam_unix(sudo:session): session closed for user root
Sep  4 04:56:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 04:56:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:56:47 nativespace-cdp sudo[2027076]: pam_unix(sudo:session): session closed for user root
Sep  4 04:56:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 04:56:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:56:51 nativespace-cdp sudo[2027087]: pam_unix(sudo:session): session closed for user root
Sep  4 04:56:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=eatspam user-2=darkstar user-3=beauty user-4=dhyana user-5=burydropin user-6=fawcettd user-7=nsceres user-8=zebrapho user-9=bwppodcast user-10=steve user-11=sibtoncc user-12=asandcoc user-13=hirefootballgame user-14=courseme user-15=eugincou user-16=reliable user-17=ninejimm user-18=cathski user-19=cambria1 user-20=paulmca1 user-21=pugwash user-22=howardon user-23=cwsocial user-24=isleofwi user-25=smrszyqg user-26=tigerlet user-27=barbersh user-28=hidden user-29=nomistakes user-30=health2045 user-31=fortunaz user-32=foods user-33=leftie user-34=putterfc user-35=nscdp user-36=ctedorgu user-37=philmcph user-38=firstre5 user-39=steakbridieme user-40=donnychicago user-41=lkpier user-42=branko user-43=hodgsonmail user-44=ranxterc user-45=outdoorc user-46=romaldki user-47=attlebor user-48=lucy
Sep  4 04:56:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=mcdermos user-51=chrisdal user-52=careers user-53=nbhavers user-54=david user-55=tomandle user-56=jennimil user-57=kategilpin user-58=ladburyp user-59=stagingerris user-60=dancinggardener user-61=design user-62=what user-63=tstardom user-64=oubpgvbx user-65=nvihkvu user-66=sketchy user-67=cath user-68=havantho user-69=sosevalu user-70=crrtipdl user-71=bakery user-72=nove user-73=boldover user-74=still user-75=agproduc user-76=leereyn1 user-77=stephani user-78=jarvisin user-79=theblack user-80=hodgesonweb user-81=spectrum user-82=ulsukarm user-83=booff user-84=foundation user-85=markward user-86=maflemin user-87=lbscrmod user-88=connect9 user-89=athenare user-90=vantagep user-91=lbhyisi user-92=hhdugcor user-93=magichat user-94=martsblo user-95=ptkxhsbt user-96=dickemery123 user-97=wilsonsw user-98=musorguk user-99=megacards user-100=brmrjxl user-101=lakesan1 user-102=sarafoundation
Sep  4 04:56:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=atestord user-104=strathar user-105=ianrayne user-106=accooper user-107=thqkgnbz user-108=connectedshoppin user-109=elecleis user-110=milloyco user-111=gilpin user-112=carsinyo user-113=fetch user-114=hubmaster user-115=putterfi user-116=costestimatorco user-117=firstrel user-118=clarkass user-119=southlon user-120=highlegh user-121=firstred user-122=firstres user-123=jonhartl user-124=seftvta user-125=ultbcrra user-126=opaiscyx user-127=coursemc user-128=stuartge user-129=askhform user-130=innovat1 user-131=nativene user-132=alexadmin user-133=skyfirec user-134=bedfords user-135=bemadonn user-136=ggaaorgu user-137=belle user-138=newstoda user-139=brighto1 user-140=nstriton user-141=battlere user-142=oneoarco user-143=firstre2 user-144=vivienn1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 04:56:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 04:56:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:56:52 nativespace-cdp sudo[2027093]: pam_unix(sudo:session): session closed for user root
Sep  4 04:56:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  4 04:56:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:56:53 nativespace-cdp sudo[2027102]: pam_unix(sudo:session): session closed for user root
Sep  4 04:56:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep  4 04:56:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:56:54 nativespace-cdp sudo[2027107]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  4 04:57:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:57:16 nativespace-cdp sudo[2027268]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:57:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  4 04:57:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:57:17 nativespace-cdp sudo[2027274]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep  4 04:57:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:57:18 nativespace-cdp sudo[2027279]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep  4 04:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:57:20 nativespace-cdp sudo[2027286]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  4 04:57:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:57:20 nativespace-cdp sudo[2027296]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep  4 04:57:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:57:24 nativespace-cdp sudo[2027311]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep  4 04:57:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:57:29 nativespace-cdp sudo[2027318]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep  4 04:57:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:57:29 nativespace-cdp sudo[2027350]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep  4 04:57:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:57:30 nativespace-cdp sudo[2027357]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep  4 04:57:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:57:38 nativespace-cdp sudo[2027428]: pam_unix(sudo:session): session closed for user root
Sep  4 04:57:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  4 04:57:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:57:41 nativespace-cdp sudo[2027559]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:57:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  4 04:57:41 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  4 04:57:41 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  4 04:57:41 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:57:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:57:41 nativespace-cdp sudo[2027568]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:57:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  4 04:57:41 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  4 04:57:41 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  4 04:57:41 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:57:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:58:05 nativespace-cdp sudo[2027574]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:58:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  4 04:58:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:58:18 nativespace-cdp sudo[2027743]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:58:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  4 04:58:18 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  4 04:58:18 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  4 04:58:18 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:58:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:58:18 nativespace-cdp sudo[2027749]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:58:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  4 04:58:18 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  4 04:58:18 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  4 04:58:18 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:58:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:58:19 nativespace-cdp sudo[2027756]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:58:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  4 04:58:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:58:21 nativespace-cdp sudo[2027795]: pam_unix(sudo:session): session closed for user root
Sep  4 04:58:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep  4 04:58:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:58:21 nativespace-cdp sudo[2027800]: pam_unix(sudo:session): session closed for user root
Sep  4 04:58:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  4 04:58:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 04:58:33 nativespace-cdp sudo[2027882]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 04:58:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep  4 04:58:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:58:34 nativespace-cdp sudo[2027889]: pam_unix(sudo:session): session closed for user root
Sep  4 04:58:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep  4 04:58:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:58:34 nativespace-cdp sudo[2027893]: pam_unix(sudo:session): session closed for user root
Sep  4 04:58:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  4 04:58:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:58:34 nativespace-cdp sudo[2027898]: pam_unix(sudo:session): session closed for user root
Sep  4 04:58:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep  4 04:58:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:58:35 nativespace-cdp sudo[2027914]: pam_unix(sudo:session): session closed for user root
Sep  4 04:58:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep  4 04:58:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:58:36 nativespace-cdp sudo[2027920]: pam_unix(sudo:session): session closed for user root
Sep  4 04:58:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep  4 04:58:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:58:41 nativespace-cdp sudo[2027990]: pam_unix(sudo:session): session closed for user root
Sep  4 04:58:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  4 04:58:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 04:58:44 nativespace-cdp sudo[2028048]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 04:58:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  4 04:58:44 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  4 04:58:44 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  4 04:58:44 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:58:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 04:58:45 nativespace-cdp sudo[2028055]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 04:58:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  4 04:58:45 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  4 04:58:45 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  4 04:58:45 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:58:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 04:59:01 nativespace-cdp sudo[2028061]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 04:59:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  4 04:59:01 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  4 04:59:01 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  4 04:59:01 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:59:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 04:59:03 nativespace-cdp sudo[2028185]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 04:59:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  4 04:59:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 04:59:10 nativespace-cdp sudo[2028304]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:59:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 04:59:10 nativespace-cdp sudo[2028310]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:59:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 04:59:10 nativespace-cdp sudo[2028317]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  4 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:59:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 04:59:10 nativespace-cdp sudo[2028323]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  4 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:12 nativespace-cdp sudo[2028362]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep  4 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:12 nativespace-cdp sudo[2028393]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep  4 04:59:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:18 nativespace-cdp sudo[2028634]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep  4 04:59:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:18 nativespace-cdp sudo[2028640]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  4 04:59:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  4 04:59:19 nativespace-cdp sudo[2028650]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  4 04:59:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep  4 04:59:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:20 nativespace-cdp sudo[2028658]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep  4 04:59:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:20 nativespace-cdp sudo[2028662]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep  4 04:59:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:21 nativespace-cdp sudo[2028666]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  4 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:21 nativespace-cdp sudo[2028675]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  4 04:59:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:59:29 nativespace-cdp sudo[2028735]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:59:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  4 04:59:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:30 nativespace-cdp sudo[2028742]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  4 04:59:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:30 nativespace-cdp sudo[2028750]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep  4 04:59:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:31 nativespace-cdp sudo[2028766]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep  4 04:59:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 04:59:36 nativespace-cdp sudo[2028833]: pam_unix(sudo:session): session closed for user root
Sep  4 04:59:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  4 04:59:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:59:38 nativespace-cdp sudo[2028889]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:59:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  4 04:59:38 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  4 04:59:38 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  4 04:59:38 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:59:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:59:39 nativespace-cdp sudo[2028895]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 04:59:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  4 04:59:39 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  4 04:59:39 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  4 04:59:39 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 04:59:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 04:59:53 nativespace-cdp sudo[2028904]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 05:00:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  4 05:00:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 05:00:01 nativespace-cdp sudo[2029047]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 05:00:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  4 05:00:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  4 05:00:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  4 05:00:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 05:00:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 05:00:01 nativespace-cdp sudo[2029054]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 05:00:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  4 05:00:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  4 05:00:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  4 05:00:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  4 05:00:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 05:00:01 nativespace-cdp sudo[2029060]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 05:00:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  4 05:00:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:00:04 nativespace-cdp sudo[2029256]: pam_unix(sudo:session): session closed for user root
Sep  4 05:00:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep  4 05:00:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:00:04 nativespace-cdp sudo[2029260]: pam_unix(sudo:session): session closed for user root
Sep  4 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  4 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  4 05:00:54 nativespace-cdp sudo[2029470]: pam_unix(sudo:session): session closed for user fortunaz
Sep  4 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep  4 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:00:54 nativespace-cdp sudo[2029477]: pam_unix(sudo:session): session closed for user root
Sep  4 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep  4 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:00:55 nativespace-cdp sudo[2029480]: pam_unix(sudo:session): session closed for user root
Sep  4 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  4 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:00:55 nativespace-cdp sudo[2029485]: pam_unix(sudo:session): session closed for user root
Sep  4 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep  4 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:00:57 nativespace-cdp sudo[2029503]: pam_unix(sudo:session): session closed for user root
Sep  4 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  4 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:00:58 nativespace-cdp sudo[2029508]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep  4 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:03 nativespace-cdp sudo[2029594]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=eatspam WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "Yoast SEO" on ONE | OAR (https://oneoar.co.uk). Installed version: 19.9. Available version: 23.4.<br/><br/>2. Plugin "Yoast SEO" on Limekilns Heritage Trust (https://limekilnspier.org.uk). Installed version: 22.0. Available version: 23.4.<br/><br/>3. Plugin "Yoast SEO" on Pinstripe Inventories (https://pinstripe.services). Installed version: 21.6. Available version: 23.4.<br/><br/>' installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the
Sep  4 05:01:13 nativespace-cdp sudo: wp-toolkit : (command continued) instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep  4 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:13 nativespace-cdp sudo[2029777]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep  4 05:01:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:23 nativespace-cdp sudo[2029917]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  4 05:01:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:23 nativespace-cdp sudo[2029921]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029926]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029930]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029933]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029936]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029939]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029942]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029945]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029948]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029951]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029954]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029957]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029960]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029963]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029966]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029969]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029972]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029975]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029978]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029981]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029984]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029987]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029990]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029993]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2029996]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2030000]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2030003]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:24 nativespace-cdp sudo[2030006]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030009]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030012]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030015]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030018]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030021]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030024]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030028]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030031]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030034]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030037]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030040]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030043]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030046]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030049]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030052]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030055]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030058]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030061]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030064]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030072]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030077]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030081]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030084]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030087]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030090]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030093]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030096]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030099]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030102]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030105]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030108]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030111]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:25 nativespace-cdp sudo[2030114]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030117]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030120]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030123]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030126]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030129]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030133]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030137]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030140]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030143]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030146]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030149]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030152]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030155]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030158]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030161]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030164]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030167]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030170]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030173]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030176]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030179]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030182]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030185]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030188]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030191]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030193]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030196]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030199]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030202]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030205]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030208]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:26 nativespace-cdp sudo[2030211]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030214]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030217]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030220]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030223]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030226]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030229]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030233]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030236]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030239]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030242]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030246]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030249]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030252]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030255]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030258]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030262]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030266]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030269]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030272]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030275]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030278]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030281]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030284]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030287]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030290]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030293]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030296]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030299]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030302]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030306]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030309]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030312]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030315]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030318]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030321]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:27 nativespace-cdp sudo[2030324]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030327]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030330]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030333]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030336]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030339]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030342]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030345]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030349]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030352]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030355]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030359]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030362]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030365]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030368]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030371]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030375]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030378]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030381]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030384]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030387]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030390]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030393]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030396]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030399]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030402]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030405]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030408]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030411]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030414]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030417]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030420]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030423]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030426]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030429]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030432]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030435]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:28 nativespace-cdp sudo[2030438]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030441]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030444]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030447]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030450]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030453]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030456]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030459]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030463]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030466]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030469]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030472]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030475]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030478]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030481]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030484]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030487]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030490]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030493]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030496]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030499]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030502]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030505]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030508]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030511]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030514]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030517]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030520]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030525]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030528]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030531]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030534]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030537]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030540]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030543]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:29 nativespace-cdp sudo[2030546]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030549]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030552]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030555]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030558]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030561]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030564]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030567]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030570]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030574]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030577]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030580]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030583]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030586]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030589]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030592]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030595]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030598]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030601]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030604]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030607]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030610]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030614]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030617]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  4 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:01:30 nativespace-cdp sudo[2030620]: pam_unix(sudo:session): session closed for user root
Sep  4 05:01:33 nativespace-cdp sshd[2030630]: Connection closed by 159.100.136.21 port 57984 [preauth]
Sep  4 05:06:33 nativespace-cdp sshd[2031561]: Connection closed by 159.100.136.21 port 40066 [preauth]
Sep  4 05:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 05:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:46 nativespace-cdp sudo[2032114]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 05:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:46 nativespace-cdp sudo[2032117]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 05:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:47 nativespace-cdp sudo[2032120]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 05:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:47 nativespace-cdp sudo[2032124]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 05:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:50 nativespace-cdp sudo[2032127]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 05:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:50 nativespace-cdp sudo[2032136]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 05:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:50 nativespace-cdp sudo[2032139]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 05:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:50 nativespace-cdp sudo[2032142]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 05:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:50 nativespace-cdp sudo[2032145]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 05:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:50 nativespace-cdp sudo[2032148]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 05:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:50 nativespace-cdp sudo[2032151]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 05:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:52 nativespace-cdp sudo[2032166]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 05:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:53 nativespace-cdp sudo[2032170]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nomistakes user-2=hidden user-3=barbersh user-4=tigerlet user-5=isleofwi user-6=smrszyqg user-7=lkpier user-8=donnychicago user-9=steakbridieme user-10=firstre5 user-11=philmcph user-12=ctedorgu user-13=nscdp user-14=putterfc user-15=leftie user-16=foods user-17=fortunaz user-18=health2045 user-19=eugincou user-20=courseme user-21=hirefootballgame user-22=cwsocial user-23=howardon user-24=pugwash user-25=paulmca1 user-26=cathski user-27=cambria1 user-28=reliable user-29=ninejimm user-30=steve user-31=bwppodcast user-32=zebrapho user-33=asandcoc user-34=sibtoncc user-35=dhyana user-36=beauty user-37=darkstar user-38=eatspam user-39=nsceres user-40=fawcettd user-41=burydropin user-42=bakery user-43=crrtipdl user-44=sosevalu user-45=boldover user-46=nove user-47=design user-48=stagingerris
Sep  4 05:09:53 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=dancinggardener user-50=ladburyp user-51=kategilpin user-52=havantho user-53=sketchy user-54=cath user-55=nvihkvu user-56=tstardom user-57=oubpgvbx user-58=what user-59=david user-60=careers user-61=nbhavers user-62=chrisdal user-63=mcdermos user-64=jennimil user-65=tomandle user-66=romaldki user-67=outdoorc user-68=hodgsonmail user-69=ranxterc user-70=branko user-71=onlycont user-72=lucy user-73=attlebor user-74=megacards user-75=musorguk user-76=wilsonsw user-77=strathar user-78=atestord user-79=sarafoundation user-80=brmrjxl user-81=lakesan1 user-82=magichat user-83=hhdugcor user-84=lbhyisi user-85=dickemery123 user-86=ptkxhsbt user-87=martsblo user-88=ulsukarm user-89=vantagep user-90=connect9 user-91=athenare user-92=lbscrmod user-93=maflemin user-94=booff user-95=foundation user-96=markward user-97=stephani user-98=leereyn1 user-99=agproduc user-100=still user-101=spectrum user-102=hodgesonweb
Sep  4 05:09:53 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=theblack user-104=jarvisin user-105=newstoda user-106=belle user-107=ggaaorgu user-108=bemadonn user-109=bedfords user-110=vivienn1 user-111=firstre2 user-112=oneoarco user-113=battlere user-114=nstriton user-115=brighto1 user-116=nativene user-117=innovat1 user-118=stuartge user-119=askhform user-120=alexadmin user-121=skyfirec user-122=firstred user-123=highlegh user-124=southlon user-125=firstrel user-126=clarkass user-127=costestimatorco user-128=opaiscyx user-129=coursemc user-130=ultbcrra user-131=seftvta user-132=jonhartl user-133=firstres user-134=connectedshoppin user-135=thqkgnbz user-136=accooper user-137=ianrayne user-138=putterfi user-139=hubmaster user-140=fetch user-141=carsinyo user-142=gilpin user-143=milloyco user-144=elecleis feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 05:09:53 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 05:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:53 nativespace-cdp sudo[2032175]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:54 nativespace-cdp sudo[2032183]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qvPoP97buB1npMby.~
Sep  4 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:54 nativespace-cdp sudo[2032187]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qvPoP97buB1npMby.~'
Sep  4 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:54 nativespace-cdp sudo[2032190]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qvPoP97buB1npMby.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:54 nativespace-cdp sudo[2032194]: pam_unix(sudo:session): session closed for user root
Sep  4 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:09:54 nativespace-cdp sudo[2032198]: pam_unix(sudo:session): session closed for user root
Sep  4 05:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 05:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 05:10:08 nativespace-cdp sudo[2032514]: pam_unix(sudo:session): session closed for user root
Sep  4 05:11:33 nativespace-cdp sshd[2032769]: Connection closed by 159.100.136.21 port 50048 [preauth]
Sep  4 05:12:41 nativespace-cdp sshd[2033082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.171.227.20  user=root
Sep  4 05:12:41 nativespace-cdp sshd[2033082]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 05:12:44 nativespace-cdp sshd[2033082]: Failed password for root from 142.171.227.20 port 37574 ssh2
Sep  4 05:12:44 nativespace-cdp sshd[2033082]: Received disconnect from 142.171.227.20 port 37574:11: Bye Bye [preauth]
Sep  4 05:12:44 nativespace-cdp sshd[2033082]: Disconnected from 142.171.227.20 port 37574 [preauth]
Sep  4 05:14:21 nativespace-cdp sshd[2033412]: Invalid user claire from 103.144.245.15 port 53788
Sep  4 05:14:21 nativespace-cdp sshd[2033412]: input_userauth_request: invalid user claire [preauth]
Sep  4 05:14:21 nativespace-cdp sshd[2033412]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:14:21 nativespace-cdp sshd[2033412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.144.245.15
Sep  4 05:14:23 nativespace-cdp sshd[2033412]: Failed password for invalid user claire from 103.144.245.15 port 53788 ssh2
Sep  4 05:14:24 nativespace-cdp sshd[2033412]: Received disconnect from 103.144.245.15 port 53788:11: Bye Bye [preauth]
Sep  4 05:14:24 nativespace-cdp sshd[2033412]: Disconnected from 103.144.245.15 port 53788 [preauth]
Sep  4 05:15:04 nativespace-cdp sshd[2033638]: Invalid user zhg from 109.75.33.121 port 57040
Sep  4 05:15:04 nativespace-cdp sshd[2033638]: input_userauth_request: invalid user zhg [preauth]
Sep  4 05:15:04 nativespace-cdp sshd[2033638]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:15:04 nativespace-cdp sshd[2033638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.75.33.121
Sep  4 05:15:06 nativespace-cdp sshd[2033638]: Failed password for invalid user zhg from 109.75.33.121 port 57040 ssh2
Sep  4 05:15:06 nativespace-cdp sshd[2033638]: Received disconnect from 109.75.33.121 port 57040:11: Bye Bye [preauth]
Sep  4 05:15:06 nativespace-cdp sshd[2033638]: Disconnected from 109.75.33.121 port 57040 [preauth]
Sep  4 05:15:28 nativespace-cdp sshd[2033745]: Invalid user sahel from 157.230.6.184 port 40456
Sep  4 05:15:28 nativespace-cdp sshd[2033745]: input_userauth_request: invalid user sahel [preauth]
Sep  4 05:15:28 nativespace-cdp sshd[2033745]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:15:28 nativespace-cdp sshd[2033745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.6.184
Sep  4 05:15:31 nativespace-cdp sshd[2033745]: Failed password for invalid user sahel from 157.230.6.184 port 40456 ssh2
Sep  4 05:15:31 nativespace-cdp sshd[2033745]: Received disconnect from 157.230.6.184 port 40456:11: Bye Bye [preauth]
Sep  4 05:15:31 nativespace-cdp sshd[2033745]: Disconnected from 157.230.6.184 port 40456 [preauth]
Sep  4 05:15:57 nativespace-cdp sshd[2033809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.113.181.175  user=root
Sep  4 05:15:57 nativespace-cdp sshd[2033809]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 05:15:58 nativespace-cdp sshd[2033809]: Failed password for root from 20.113.181.175 port 43104 ssh2
Sep  4 05:15:58 nativespace-cdp sshd[2033809]: Received disconnect from 20.113.181.175 port 43104:11: Bye Bye [preauth]
Sep  4 05:15:58 nativespace-cdp sshd[2033809]: Disconnected from 20.113.181.175 port 43104 [preauth]
Sep  4 05:16:33 nativespace-cdp sshd[2033896]: Connection closed by 159.100.136.21 port 60014 [preauth]
Sep  4 05:20:02 nativespace-cdp sshd[2034533]: Invalid user druid from 104.236.201.173 port 52954
Sep  4 05:20:02 nativespace-cdp sshd[2034533]: input_userauth_request: invalid user druid [preauth]
Sep  4 05:20:02 nativespace-cdp sshd[2034533]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:20:02 nativespace-cdp sshd[2034533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.201.173
Sep  4 05:20:04 nativespace-cdp sshd[2034533]: Failed password for invalid user druid from 104.236.201.173 port 52954 ssh2
Sep  4 05:20:04 nativespace-cdp sshd[2034533]: Received disconnect from 104.236.201.173 port 52954:11: Bye Bye [preauth]
Sep  4 05:20:04 nativespace-cdp sshd[2034533]: Disconnected from 104.236.201.173 port 52954 [preauth]
Sep  4 05:20:48 nativespace-cdp sshd[2034669]: Invalid user webdev from 104.236.201.173 port 33418
Sep  4 05:20:48 nativespace-cdp sshd[2034669]: input_userauth_request: invalid user webdev [preauth]
Sep  4 05:20:48 nativespace-cdp sshd[2034669]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:20:48 nativespace-cdp sshd[2034669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.201.173
Sep  4 05:20:49 nativespace-cdp sshd[2034672]: Invalid user siakad from 109.75.33.121 port 44968
Sep  4 05:20:49 nativespace-cdp sshd[2034672]: input_userauth_request: invalid user siakad [preauth]
Sep  4 05:20:49 nativespace-cdp sshd[2034672]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:20:49 nativespace-cdp sshd[2034672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.75.33.121
Sep  4 05:20:50 nativespace-cdp sshd[2034674]: Invalid user dls from 103.144.245.15 port 46212
Sep  4 05:20:50 nativespace-cdp sshd[2034674]: input_userauth_request: invalid user dls [preauth]
Sep  4 05:20:50 nativespace-cdp sshd[2034674]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:20:50 nativespace-cdp sshd[2034674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.144.245.15
Sep  4 05:20:50 nativespace-cdp sshd[2034669]: Failed password for invalid user webdev from 104.236.201.173 port 33418 ssh2
Sep  4 05:20:51 nativespace-cdp sshd[2034669]: Received disconnect from 104.236.201.173 port 33418:11: Bye Bye [preauth]
Sep  4 05:20:51 nativespace-cdp sshd[2034669]: Disconnected from 104.236.201.173 port 33418 [preauth]
Sep  4 05:20:51 nativespace-cdp sshd[2034672]: Failed password for invalid user siakad from 109.75.33.121 port 44968 ssh2
Sep  4 05:20:51 nativespace-cdp sshd[2034672]: Received disconnect from 109.75.33.121 port 44968:11: Bye Bye [preauth]
Sep  4 05:20:51 nativespace-cdp sshd[2034672]: Disconnected from 109.75.33.121 port 44968 [preauth]
Sep  4 05:20:52 nativespace-cdp sshd[2034674]: Failed password for invalid user dls from 103.144.245.15 port 46212 ssh2
Sep  4 05:20:52 nativespace-cdp sshd[2034674]: Received disconnect from 103.144.245.15 port 46212:11: Bye Bye [preauth]
Sep  4 05:20:52 nativespace-cdp sshd[2034674]: Disconnected from 103.144.245.15 port 46212 [preauth]
Sep  4 05:20:58 nativespace-cdp sshd[2034739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.6.184  user=root
Sep  4 05:20:58 nativespace-cdp sshd[2034739]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 05:21:00 nativespace-cdp sshd[2034739]: Failed password for root from 157.230.6.184 port 58932 ssh2
Sep  4 05:21:00 nativespace-cdp sshd[2034739]: Received disconnect from 157.230.6.184 port 58932:11: Bye Bye [preauth]
Sep  4 05:21:00 nativespace-cdp sshd[2034739]: Disconnected from 157.230.6.184 port 58932 [preauth]
Sep  4 05:21:30 nativespace-cdp sshd[2034830]: Invalid user yclin from 103.144.245.15 port 59804
Sep  4 05:21:30 nativespace-cdp sshd[2034830]: input_userauth_request: invalid user yclin [preauth]
Sep  4 05:21:30 nativespace-cdp sshd[2034830]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:21:30 nativespace-cdp sshd[2034830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.144.245.15
Sep  4 05:21:32 nativespace-cdp sshd[2034830]: Failed password for invalid user yclin from 103.144.245.15 port 59804 ssh2
Sep  4 05:21:32 nativespace-cdp sshd[2034830]: Received disconnect from 103.144.245.15 port 59804:11: Bye Bye [preauth]
Sep  4 05:21:32 nativespace-cdp sshd[2034830]: Disconnected from 103.144.245.15 port 59804 [preauth]
Sep  4 05:21:33 nativespace-cdp sshd[2034859]: Invalid user thomas from 109.75.33.121 port 58196
Sep  4 05:21:33 nativespace-cdp sshd[2034859]: input_userauth_request: invalid user thomas [preauth]
Sep  4 05:21:33 nativespace-cdp sshd[2034859]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:21:33 nativespace-cdp sshd[2034859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.75.33.121
Sep  4 05:21:33 nativespace-cdp sshd[2034867]: Connection closed by 159.100.136.21 port 41770 [preauth]
Sep  4 05:21:35 nativespace-cdp sshd[2034859]: Failed password for invalid user thomas from 109.75.33.121 port 58196 ssh2
Sep  4 05:21:36 nativespace-cdp sshd[2034859]: Received disconnect from 109.75.33.121 port 58196:11: Bye Bye [preauth]
Sep  4 05:21:36 nativespace-cdp sshd[2034859]: Disconnected from 109.75.33.121 port 58196 [preauth]
Sep  4 05:21:37 nativespace-cdp sshd[2034884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.6.184  user=root
Sep  4 05:21:37 nativespace-cdp sshd[2034884]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 05:21:39 nativespace-cdp sshd[2034884]: Failed password for root from 157.230.6.184 port 52086 ssh2
Sep  4 05:21:39 nativespace-cdp sshd[2034884]: Received disconnect from 157.230.6.184 port 52086:11: Bye Bye [preauth]
Sep  4 05:21:39 nativespace-cdp sshd[2034884]: Disconnected from 157.230.6.184 port 52086 [preauth]
Sep  4 05:21:41 nativespace-cdp sshd[2034915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.201.173  user=root
Sep  4 05:21:41 nativespace-cdp sshd[2034915]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 05:21:43 nativespace-cdp sshd[2034915]: Failed password for root from 104.236.201.173 port 54646 ssh2
Sep  4 05:23:40 nativespace-cdp sshd[2035242]: Invalid user amir from 20.113.181.175 port 42528
Sep  4 05:23:40 nativespace-cdp sshd[2035242]: input_userauth_request: invalid user amir [preauth]
Sep  4 05:23:40 nativespace-cdp sshd[2035242]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:23:40 nativespace-cdp sshd[2035242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.113.181.175
Sep  4 05:23:42 nativespace-cdp sshd[2035242]: Failed password for invalid user amir from 20.113.181.175 port 42528 ssh2
Sep  4 05:23:42 nativespace-cdp sshd[2035242]: Received disconnect from 20.113.181.175 port 42528:11: Bye Bye [preauth]
Sep  4 05:23:42 nativespace-cdp sshd[2035242]: Disconnected from 20.113.181.175 port 42528 [preauth]
Sep  4 05:24:19 nativespace-cdp sshd[2035420]: Invalid user albert from 20.113.181.175 port 43742
Sep  4 05:24:19 nativespace-cdp sshd[2035420]: input_userauth_request: invalid user albert [preauth]
Sep  4 05:24:19 nativespace-cdp sshd[2035420]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:24:19 nativespace-cdp sshd[2035420]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.113.181.175
Sep  4 05:24:21 nativespace-cdp sshd[2035420]: Failed password for invalid user albert from 20.113.181.175 port 43742 ssh2
Sep  4 05:24:21 nativespace-cdp sshd[2035420]: Received disconnect from 20.113.181.175 port 43742:11: Bye Bye [preauth]
Sep  4 05:24:21 nativespace-cdp sshd[2035420]: Disconnected from 20.113.181.175 port 43742 [preauth]
Sep  4 05:26:33 nativespace-cdp sshd[2036198]: Connection closed by 159.100.136.21 port 52036 [preauth]
Sep  4 05:31:34 nativespace-cdp sshd[2037228]: Connection closed by 159.100.136.21 port 33532 [preauth]
Sep  4 05:35:08 nativespace-cdp su: pam_unix(su:session): session opened for user atestord by (uid=0)
Sep  4 05:35:08 nativespace-cdp su[2037940]: pam_unix(su:session): session closed for user atestord
Sep  4 05:36:33 nativespace-cdp sshd[2038194]: Connection closed by 159.100.136.21 port 43522 [preauth]
Sep  4 05:41:33 nativespace-cdp sshd[2039223]: Connection closed by 159.100.136.21 port 53502 [preauth]
Sep  4 05:46:33 nativespace-cdp sshd[2040432]: Connection closed by 159.100.136.21 port 35478 [preauth]
Sep  4 05:51:33 nativespace-cdp sshd[2041400]: Connection closed by 159.100.136.21 port 45496 [preauth]
Sep  4 05:56:33 nativespace-cdp sshd[2042422]: Connection closed by 159.100.136.21 port 55742 [preauth]
Sep  4 05:58:27 nativespace-cdp sshd[2042806]: Invalid user yangyi from 154.68.39.6 port 55980
Sep  4 05:58:27 nativespace-cdp sshd[2042806]: input_userauth_request: invalid user yangyi [preauth]
Sep  4 05:58:27 nativespace-cdp sshd[2042806]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 05:58:27 nativespace-cdp sshd[2042806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.68.39.6
Sep  4 05:58:29 nativespace-cdp sshd[2042806]: Failed password for invalid user yangyi from 154.68.39.6 port 55980 ssh2
Sep  4 05:58:29 nativespace-cdp sshd[2042806]: Received disconnect from 154.68.39.6 port 55980:11: Bye Bye [preauth]
Sep  4 05:58:29 nativespace-cdp sshd[2042806]: Disconnected from 154.68.39.6 port 55980 [preauth]
Sep  4 06:01:33 nativespace-cdp sshd[2043756]: Connection closed by 159.100.136.21 port 37508 [preauth]
Sep  4 06:05:19 nativespace-cdp sshd[2044522]: Invalid user server from 209.38.216.114 port 45214
Sep  4 06:05:19 nativespace-cdp sshd[2044522]: input_userauth_request: invalid user server [preauth]
Sep  4 06:05:19 nativespace-cdp sshd[2044522]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:05:19 nativespace-cdp sshd[2044522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.216.114
Sep  4 06:05:21 nativespace-cdp sshd[2044522]: Failed password for invalid user server from 209.38.216.114 port 45214 ssh2
Sep  4 06:05:21 nativespace-cdp sshd[2044522]: Received disconnect from 209.38.216.114 port 45214:11: Bye Bye [preauth]
Sep  4 06:05:21 nativespace-cdp sshd[2044522]: Disconnected from 209.38.216.114 port 45214 [preauth]
Sep  4 06:06:33 nativespace-cdp sshd[2044757]: Connection closed by 159.100.136.21 port 47794 [preauth]
Sep  4 06:06:38 nativespace-cdp sshd[2044759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.216.114  user=root
Sep  4 06:06:38 nativespace-cdp sshd[2044759]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 06:06:39 nativespace-cdp sshd[2044759]: Failed password for root from 209.38.216.114 port 45618 ssh2
Sep  4 06:06:39 nativespace-cdp sshd[2044759]: Received disconnect from 209.38.216.114 port 45618:11: Bye Bye [preauth]
Sep  4 06:06:39 nativespace-cdp sshd[2044759]: Disconnected from 209.38.216.114 port 45618 [preauth]
Sep  4 06:07:25 nativespace-cdp sshd[2044897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.216.114  user=root
Sep  4 06:07:25 nativespace-cdp sshd[2044897]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 06:07:27 nativespace-cdp sshd[2044897]: Failed password for root from 209.38.216.114 port 54102 ssh2
Sep  4 06:07:27 nativespace-cdp sshd[2044897]: Received disconnect from 209.38.216.114 port 54102:11: Bye Bye [preauth]
Sep  4 06:07:27 nativespace-cdp sshd[2044897]: Disconnected from 209.38.216.114 port 54102 [preauth]
Sep  4 06:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 06:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:42 nativespace-cdp sudo[2045375]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 06:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:42 nativespace-cdp sudo[2045378]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 06:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:43 nativespace-cdp sudo[2045382]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 06:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:43 nativespace-cdp sudo[2045389]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 06:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:46 nativespace-cdp sudo[2045392]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:46 nativespace-cdp sudo[2045402]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:46 nativespace-cdp sudo[2045406]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:46 nativespace-cdp sudo[2045409]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:46 nativespace-cdp sudo[2045412]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:46 nativespace-cdp sudo[2045415]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:46 nativespace-cdp sudo[2045418]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 06:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:48 nativespace-cdp sudo[2045426]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 06:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:49 nativespace-cdp sudo[2045431]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=boldover user-2=nove user-3=bakery user-4=crrtipdl user-5=sosevalu user-6=havantho user-7=sketchy user-8=cath user-9=nvihkvu user-10=oubpgvbx user-11=tstardom user-12=what user-13=design user-14=stagingerris user-15=dancinggardener user-16=ladburyp user-17=kategilpin user-18=jennimil user-19=tomandle user-20=david user-21=careers user-22=nbhavers user-23=chrisdal user-24=mcdermos user-25=onlycont user-26=lucy user-27=attlebor user-28=romaldki user-29=hodgsonmail user-30=ranxterc user-31=outdoorc user-32=branko user-33=lkpier user-34=donnychicago user-35=firstre5 user-36=steakbridieme user-37=ctedorgu user-38=philmcph user-39=nscdp user-40=putterfc user-41=leftie user-42=foods user-43=fortunaz user-44=health2045 user-45=nomistakes user-46=hidden user-47=tigerlet user-48=barbersh user-49=smrszyqg
Sep  4 06:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=isleofwi user-51=cwsocial user-52=paulmca1 user-53=pugwash user-54=howardon user-55=cambria1 user-56=cathski user-57=reliable user-58=ninejimm user-59=eugincou user-60=courseme user-61=hirefootballgame user-62=sibtoncc user-63=asandcoc user-64=steve user-65=bwppodcast user-66=zebrapho user-67=nsceres user-68=fawcettd user-69=burydropin user-70=dhyana user-71=beauty user-72=darkstar user-73=eatspam user-74=vivienn1 user-75=firstre2 user-76=oneoarco user-77=battlere user-78=nstriton user-79=brighto1 user-80=newstoda user-81=belle user-82=ggaaorgu user-83=bemadonn user-84=bedfords user-85=skyfirec user-86=alexadmin user-87=nativene user-88=innovat1 user-89=askhform user-90=stuartge user-91=opaiscyx user-92=coursemc user-93=ultbcrra user-94=jonhartl user-95=seftvta user-96=firstres user-97=firstred user-98=highlegh user-99=southlon user-100=clarkass user-101=firstrel user-102=costestimatorco
Sep  4 06:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=hubmaster user-104=putterfi user-105=fetch user-106=carsinyo user-107=gilpin user-108=milloyco user-109=elecleis user-110=connectedshoppin user-111=thqkgnbz user-112=accooper user-113=ianrayne user-114=strathar user-115=atestord user-116=sarafoundation user-117=lakesan1 user-118=brmrjxl user-119=megacards user-120=musorguk user-121=wilsonsw user-122=dickemery123 user-123=ptkxhsbt user-124=martsblo user-125=magichat user-126=hhdugcor user-127=lbhyisi user-128=vantagep user-129=athenare user-130=connect9 user-131=lbscrmod user-132=maflemin user-133=markward user-134=booff user-135=foundation user-136=ulsukarm user-137=spectrum user-138=hodgesonweb user-139=theblack user-140=jarvisin user-141=stephani user-142=leereyn1 user-143=agproduc user-144=still feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 06:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 06:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:49 nativespace-cdp sudo[2045436]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 06:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:49 nativespace-cdp sudo[2045445]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SqkH9s5lK0JLm4Zu.~
Sep  4 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:50 nativespace-cdp sudo[2045448]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SqkH9s5lK0JLm4Zu.~'
Sep  4 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:50 nativespace-cdp sudo[2045452]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SqkH9s5lK0JLm4Zu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:50 nativespace-cdp sudo[2045456]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:50 nativespace-cdp sudo[2045459]: pam_unix(sudo:session): session closed for user root
Sep  4 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 06:09:56 nativespace-cdp sudo[2045491]: pam_unix(sudo:session): session closed for user root
Sep  4 06:11:33 nativespace-cdp sshd[2046017]: Connection closed by 159.100.136.21 port 57564 [preauth]
Sep  4 06:11:47 nativespace-cdp sshd[2046043]: Invalid user amit from 154.68.39.6 port 41674
Sep  4 06:11:47 nativespace-cdp sshd[2046043]: input_userauth_request: invalid user amit [preauth]
Sep  4 06:11:47 nativespace-cdp sshd[2046043]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:11:47 nativespace-cdp sshd[2046043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.68.39.6
Sep  4 06:11:49 nativespace-cdp sshd[2046043]: Failed password for invalid user amit from 154.68.39.6 port 41674 ssh2
Sep  4 06:11:49 nativespace-cdp sshd[2046043]: Received disconnect from 154.68.39.6 port 41674:11: Bye Bye [preauth]
Sep  4 06:11:49 nativespace-cdp sshd[2046043]: Disconnected from 154.68.39.6 port 41674 [preauth]
Sep  4 06:13:07 nativespace-cdp sshd[2046417]: Invalid user aat from 154.68.39.6 port 55702
Sep  4 06:13:07 nativespace-cdp sshd[2046417]: input_userauth_request: invalid user aat [preauth]
Sep  4 06:13:07 nativespace-cdp sshd[2046417]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:13:07 nativespace-cdp sshd[2046417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.68.39.6
Sep  4 06:13:08 nativespace-cdp sshd[2046417]: Failed password for invalid user aat from 154.68.39.6 port 55702 ssh2
Sep  4 06:13:09 nativespace-cdp sshd[2046417]: Received disconnect from 154.68.39.6 port 55702:11: Bye Bye [preauth]
Sep  4 06:13:09 nativespace-cdp sshd[2046417]: Disconnected from 154.68.39.6 port 55702 [preauth]
Sep  4 06:16:33 nativespace-cdp sshd[2047220]: Connection closed by 159.100.136.21 port 39558 [preauth]
Sep  4 06:21:33 nativespace-cdp sshd[2048287]: Connection closed by 159.100.136.21 port 49536 [preauth]
Sep  4 06:26:33 nativespace-cdp sshd[2049614]: Connection closed by 159.100.136.21 port 59804 [preauth]
Sep  4 06:31:33 nativespace-cdp sshd[2050600]: Connection closed by 159.100.136.21 port 41582 [preauth]
Sep  4 06:36:33 nativespace-cdp sshd[2051518]: Connection closed by 159.100.136.21 port 51874 [preauth]
Sep  4 06:41:33 nativespace-cdp sshd[2052523]: Connection closed by 159.100.136.21 port 33618 [preauth]
Sep  4 06:46:03 nativespace-cdp sshd[2053720]: Invalid user denis from 103.164.8.158 port 34758
Sep  4 06:46:03 nativespace-cdp sshd[2053720]: input_userauth_request: invalid user denis [preauth]
Sep  4 06:46:03 nativespace-cdp sshd[2053720]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:46:03 nativespace-cdp sshd[2053720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.164.8.158
Sep  4 06:46:05 nativespace-cdp sshd[2053720]: Failed password for invalid user denis from 103.164.8.158 port 34758 ssh2
Sep  4 06:46:05 nativespace-cdp sshd[2053720]: Received disconnect from 103.164.8.158 port 34758:11: Bye Bye [preauth]
Sep  4 06:46:05 nativespace-cdp sshd[2053720]: Disconnected from 103.164.8.158 port 34758 [preauth]
Sep  4 06:46:33 nativespace-cdp sshd[2053800]: Connection closed by 159.100.136.21 port 43806 [preauth]
Sep  4 06:47:29 nativespace-cdp sshd[2053929]: Invalid user ftpuser from 103.170.204.115 port 46922
Sep  4 06:47:29 nativespace-cdp sshd[2053929]: input_userauth_request: invalid user ftpuser [preauth]
Sep  4 06:47:29 nativespace-cdp sshd[2053929]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:47:29 nativespace-cdp sshd[2053929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.170.204.115
Sep  4 06:47:31 nativespace-cdp sshd[2053929]: Failed password for invalid user ftpuser from 103.170.204.115 port 46922 ssh2
Sep  4 06:47:32 nativespace-cdp sshd[2053929]: Received disconnect from 103.170.204.115 port 46922:11: Bye Bye [preauth]
Sep  4 06:47:32 nativespace-cdp sshd[2053929]: Disconnected from 103.170.204.115 port 46922 [preauth]
Sep  4 06:48:04 nativespace-cdp sshd[2054032]: Invalid user cheng from 180.66.207.67 port 35242
Sep  4 06:48:04 nativespace-cdp sshd[2054032]: input_userauth_request: invalid user cheng [preauth]
Sep  4 06:48:04 nativespace-cdp sshd[2054032]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:48:04 nativespace-cdp sshd[2054032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.66.207.67
Sep  4 06:48:06 nativespace-cdp sshd[2054032]: Failed password for invalid user cheng from 180.66.207.67 port 35242 ssh2
Sep  4 06:48:06 nativespace-cdp sshd[2054032]: Received disconnect from 180.66.207.67 port 35242:11: Bye Bye [preauth]
Sep  4 06:48:06 nativespace-cdp sshd[2054032]: Disconnected from 180.66.207.67 port 35242 [preauth]
Sep  4 06:49:27 nativespace-cdp sshd[2054307]: Invalid user children from 109.236.47.90 port 43752
Sep  4 06:49:27 nativespace-cdp sshd[2054307]: input_userauth_request: invalid user children [preauth]
Sep  4 06:49:27 nativespace-cdp sshd[2054307]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:49:27 nativespace-cdp sshd[2054307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.236.47.90
Sep  4 06:49:29 nativespace-cdp sshd[2054307]: Failed password for invalid user children from 109.236.47.90 port 43752 ssh2
Sep  4 06:49:29 nativespace-cdp sshd[2054307]: Received disconnect from 109.236.47.90 port 43752:11: Bye Bye [preauth]
Sep  4 06:49:29 nativespace-cdp sshd[2054307]: Disconnected from 109.236.47.90 port 43752 [preauth]
Sep  4 06:49:56 nativespace-cdp sshd[2054478]: Invalid user postgres from 57.128.62.211 port 54624
Sep  4 06:49:56 nativespace-cdp sshd[2054478]: input_userauth_request: invalid user postgres [preauth]
Sep  4 06:49:56 nativespace-cdp sshd[2054478]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:49:56 nativespace-cdp sshd[2054478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.128.62.211
Sep  4 06:49:58 nativespace-cdp sshd[2054478]: Failed password for invalid user postgres from 57.128.62.211 port 54624 ssh2
Sep  4 06:49:58 nativespace-cdp sshd[2054478]: Received disconnect from 57.128.62.211 port 54624:11: Bye Bye [preauth]
Sep  4 06:49:58 nativespace-cdp sshd[2054478]: Disconnected from 57.128.62.211 port 54624 [preauth]
Sep  4 06:51:34 nativespace-cdp sshd[2054871]: Connection closed by 159.100.136.21 port 53810 [preauth]
Sep  4 06:51:39 nativespace-cdp sshd[2054879]: Invalid user giulio from 202.157.186.116 port 58416
Sep  4 06:51:39 nativespace-cdp sshd[2054879]: input_userauth_request: invalid user giulio [preauth]
Sep  4 06:51:39 nativespace-cdp sshd[2054879]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:51:39 nativespace-cdp sshd[2054879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.186.116
Sep  4 06:51:41 nativespace-cdp sshd[2054879]: Failed password for invalid user giulio from 202.157.186.116 port 58416 ssh2
Sep  4 06:51:41 nativespace-cdp sshd[2054879]: Received disconnect from 202.157.186.116 port 58416:11: Bye Bye [preauth]
Sep  4 06:51:41 nativespace-cdp sshd[2054879]: Disconnected from 202.157.186.116 port 58416 [preauth]
Sep  4 06:53:39 nativespace-cdp sshd[2055184]: Invalid user mel from 57.128.62.211 port 57848
Sep  4 06:53:39 nativespace-cdp sshd[2055184]: input_userauth_request: invalid user mel [preauth]
Sep  4 06:53:39 nativespace-cdp sshd[2055184]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:53:39 nativespace-cdp sshd[2055184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.128.62.211
Sep  4 06:53:41 nativespace-cdp sshd[2055184]: Failed password for invalid user mel from 57.128.62.211 port 57848 ssh2
Sep  4 06:53:41 nativespace-cdp sshd[2055184]: Received disconnect from 57.128.62.211 port 57848:11: Bye Bye [preauth]
Sep  4 06:53:41 nativespace-cdp sshd[2055184]: Disconnected from 57.128.62.211 port 57848 [preauth]
Sep  4 06:53:50 nativespace-cdp sshd[2055210]: Invalid user nz from 103.164.8.158 port 53280
Sep  4 06:53:50 nativespace-cdp sshd[2055210]: input_userauth_request: invalid user nz [preauth]
Sep  4 06:53:50 nativespace-cdp sshd[2055210]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:53:50 nativespace-cdp sshd[2055210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.164.8.158
Sep  4 06:53:52 nativespace-cdp sshd[2055210]: Failed password for invalid user nz from 103.164.8.158 port 53280 ssh2
Sep  4 06:53:52 nativespace-cdp sshd[2055210]: Received disconnect from 103.164.8.158 port 53280:11: Bye Bye [preauth]
Sep  4 06:53:52 nativespace-cdp sshd[2055210]: Disconnected from 103.164.8.158 port 53280 [preauth]
Sep  4 06:54:20 nativespace-cdp sshd[2055276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.54.216.214  user=root
Sep  4 06:54:20 nativespace-cdp sshd[2055276]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 06:54:22 nativespace-cdp sshd[2055276]: Failed password for root from 191.54.216.214 port 35458 ssh2
Sep  4 06:54:22 nativespace-cdp sshd[2055276]: Received disconnect from 191.54.216.214 port 35458:11: Bye Bye [preauth]
Sep  4 06:54:22 nativespace-cdp sshd[2055276]: Disconnected from 191.54.216.214 port 35458 [preauth]
Sep  4 06:54:24 nativespace-cdp sshd[2055290]: Invalid user test from 57.128.62.211 port 43128
Sep  4 06:54:24 nativespace-cdp sshd[2055290]: input_userauth_request: invalid user test [preauth]
Sep  4 06:54:24 nativespace-cdp sshd[2055290]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:54:24 nativespace-cdp sshd[2055290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.128.62.211
Sep  4 06:54:24 nativespace-cdp sshd[2055286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.66.207.67  user=root
Sep  4 06:54:24 nativespace-cdp sshd[2055286]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 06:54:26 nativespace-cdp sshd[2055290]: Failed password for invalid user test from 57.128.62.211 port 43128 ssh2
Sep  4 06:54:26 nativespace-cdp sshd[2055290]: Received disconnect from 57.128.62.211 port 43128:11: Bye Bye [preauth]
Sep  4 06:54:26 nativespace-cdp sshd[2055290]: Disconnected from 57.128.62.211 port 43128 [preauth]
Sep  4 06:54:26 nativespace-cdp sshd[2055286]: Failed password for root from 180.66.207.67 port 58784 ssh2
Sep  4 06:54:27 nativespace-cdp sshd[2055286]: Received disconnect from 180.66.207.67 port 58784:11: Bye Bye [preauth]
Sep  4 06:54:27 nativespace-cdp sshd[2055286]: Disconnected from 180.66.207.67 port 58784 [preauth]
Sep  4 06:54:44 nativespace-cdp sshd[2055357]: Invalid user database from 103.164.8.158 port 58398
Sep  4 06:54:44 nativespace-cdp sshd[2055357]: input_userauth_request: invalid user database [preauth]
Sep  4 06:54:44 nativespace-cdp sshd[2055357]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:54:44 nativespace-cdp sshd[2055357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.164.8.158
Sep  4 06:54:45 nativespace-cdp sshd[2055362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.170.204.115  user=root
Sep  4 06:54:45 nativespace-cdp sshd[2055362]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 06:54:46 nativespace-cdp sshd[2055357]: Failed password for invalid user database from 103.164.8.158 port 58398 ssh2
Sep  4 06:54:46 nativespace-cdp sshd[2055357]: Received disconnect from 103.164.8.158 port 58398:11: Bye Bye [preauth]
Sep  4 06:54:46 nativespace-cdp sshd[2055357]: Disconnected from 103.164.8.158 port 58398 [preauth]
Sep  4 06:54:47 nativespace-cdp sshd[2055362]: Failed password for root from 103.170.204.115 port 34270 ssh2
Sep  4 06:54:47 nativespace-cdp sshd[2055362]: Received disconnect from 103.170.204.115 port 34270:11: Bye Bye [preauth]
Sep  4 06:54:47 nativespace-cdp sshd[2055362]: Disconnected from 103.170.204.115 port 34270 [preauth]
Sep  4 06:55:09 nativespace-cdp sshd[2055901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.186.116  user=root
Sep  4 06:55:09 nativespace-cdp sshd[2055901]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 06:55:09 nativespace-cdp sshd[2055905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.236.47.90  user=root
Sep  4 06:55:09 nativespace-cdp sshd[2055905]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 06:55:11 nativespace-cdp sshd[2055901]: Failed password for root from 202.157.186.116 port 59258 ssh2
Sep  4 06:55:11 nativespace-cdp sshd[2055901]: Received disconnect from 202.157.186.116 port 59258:11: Bye Bye [preauth]
Sep  4 06:55:11 nativespace-cdp sshd[2055901]: Disconnected from 202.157.186.116 port 59258 [preauth]
Sep  4 06:55:12 nativespace-cdp sshd[2055905]: Failed password for root from 109.236.47.90 port 55102 ssh2
Sep  4 06:55:12 nativespace-cdp sshd[2055905]: Received disconnect from 109.236.47.90 port 55102:11: Bye Bye [preauth]
Sep  4 06:55:12 nativespace-cdp sshd[2055905]: Disconnected from 109.236.47.90 port 55102 [preauth]
Sep  4 06:55:25 nativespace-cdp sshd[2055936]: Invalid user kos from 180.66.207.67 port 37446
Sep  4 06:55:25 nativespace-cdp sshd[2055936]: input_userauth_request: invalid user kos [preauth]
Sep  4 06:55:25 nativespace-cdp sshd[2055936]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:55:25 nativespace-cdp sshd[2055936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.66.207.67
Sep  4 06:55:28 nativespace-cdp sshd[2055936]: Failed password for invalid user kos from 180.66.207.67 port 37446 ssh2
Sep  4 06:55:46 nativespace-cdp sshd[2056012]: Invalid user kos from 103.170.204.115 port 43760
Sep  4 06:55:46 nativespace-cdp sshd[2056012]: input_userauth_request: invalid user kos [preauth]
Sep  4 06:55:46 nativespace-cdp sshd[2056012]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:55:46 nativespace-cdp sshd[2056012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.170.204.115
Sep  4 06:55:48 nativespace-cdp sshd[2056012]: Failed password for invalid user kos from 103.170.204.115 port 43760 ssh2
Sep  4 06:55:48 nativespace-cdp sshd[2056012]: Received disconnect from 103.170.204.115 port 43760:11: Bye Bye [preauth]
Sep  4 06:55:48 nativespace-cdp sshd[2056012]: Disconnected from 103.170.204.115 port 43760 [preauth]
Sep  4 06:56:01 nativespace-cdp sshd[2056109]: Invalid user bruno from 202.157.186.116 port 43750
Sep  4 06:56:01 nativespace-cdp sshd[2056109]: input_userauth_request: invalid user bruno [preauth]
Sep  4 06:56:01 nativespace-cdp sshd[2056109]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:56:01 nativespace-cdp sshd[2056109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.186.116
Sep  4 06:56:03 nativespace-cdp sshd[2056109]: Failed password for invalid user bruno from 202.157.186.116 port 43750 ssh2
Sep  4 06:56:04 nativespace-cdp sshd[2056153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.236.47.90  user=root
Sep  4 06:56:04 nativespace-cdp sshd[2056153]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 06:56:06 nativespace-cdp sshd[2056153]: Failed password for root from 109.236.47.90 port 39092 ssh2
Sep  4 06:56:06 nativespace-cdp sshd[2056153]: Received disconnect from 109.236.47.90 port 39092:11: Bye Bye [preauth]
Sep  4 06:56:06 nativespace-cdp sshd[2056153]: Disconnected from 109.236.47.90 port 39092 [preauth]
Sep  4 06:56:11 nativespace-cdp sshd[2056196]: Invalid user kos from 191.54.216.214 port 39612
Sep  4 06:56:11 nativespace-cdp sshd[2056196]: input_userauth_request: invalid user kos [preauth]
Sep  4 06:56:11 nativespace-cdp sshd[2056196]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 06:56:11 nativespace-cdp sshd[2056196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.54.216.214
Sep  4 06:56:14 nativespace-cdp sshd[2056196]: Failed password for invalid user kos from 191.54.216.214 port 39612 ssh2
Sep  4 06:56:14 nativespace-cdp sshd[2056196]: Received disconnect from 191.54.216.214 port 39612:11: Bye Bye [preauth]
Sep  4 06:56:14 nativespace-cdp sshd[2056196]: Disconnected from 191.54.216.214 port 39612 [preauth]
Sep  4 06:56:33 nativespace-cdp sshd[2056270]: Connection closed by 159.100.136.21 port 35868 [preauth]
Sep  4 06:57:04 nativespace-cdp sshd[2056348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.54.216.214  user=root
Sep  4 06:57:04 nativespace-cdp sshd[2056348]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 06:57:06 nativespace-cdp sshd[2056348]: Failed password for root from 191.54.216.214 port 55602 ssh2
Sep  4 06:57:07 nativespace-cdp sshd[2056348]: Received disconnect from 191.54.216.214 port 55602:11: Bye Bye [preauth]
Sep  4 06:57:07 nativespace-cdp sshd[2056348]: Disconnected from 191.54.216.214 port 55602 [preauth]
Sep  4 07:01:33 nativespace-cdp sshd[2057354]: Connection closed by 159.100.136.21 port 45836 [preauth]
Sep  4 07:06:33 nativespace-cdp sshd[2058312]: Connection closed by 159.100.136.21 port 56190 [preauth]
Sep  4 07:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 07:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:42 nativespace-cdp sudo[2058874]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 07:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:42 nativespace-cdp sudo[2058877]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 07:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:43 nativespace-cdp sudo[2058880]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 07:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:43 nativespace-cdp sudo[2058886]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 07:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:46 nativespace-cdp sudo[2058889]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 07:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:46 nativespace-cdp sudo[2058902]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 07:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:46 nativespace-cdp sudo[2058905]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 07:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:46 nativespace-cdp sudo[2058908]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 07:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:46 nativespace-cdp sudo[2058911]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 07:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:46 nativespace-cdp sudo[2058914]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 07:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:46 nativespace-cdp sudo[2058917]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:47 nativespace-cdp sudo[2058925]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:48 nativespace-cdp sudo[2058929]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=costestimatorco user-2=clarkass user-3=firstrel user-4=southlon user-5=highlegh user-6=firstred user-7=firstres user-8=seftvta user-9=jonhartl user-10=ultbcrra user-11=opaiscyx user-12=coursemc user-13=ianrayne user-14=accooper user-15=thqkgnbz user-16=connectedshoppin user-17=elecleis user-18=gilpin user-19=milloyco user-20=carsinyo user-21=fetch user-22=hubmaster user-23=putterfi user-24=bedfords user-25=bemadonn user-26=belle user-27=ggaaorgu user-28=newstoda user-29=brighto1 user-30=nstriton user-31=battlere user-32=oneoarco user-33=firstre2 user-34=vivienn1 user-35=askhform user-36=stuartge user-37=innovat1 user-38=nativene user-39=alexadmin user-40=skyfirec user-41=ulsukarm user-42=markward user-43=booff user-44=foundation user-45=maflemin user-46=lbscrmod user-47=connect9 user-48=athenare
Sep  4 07:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=vantagep user-50=still user-51=agproduc user-52=leereyn1 user-53=stephani user-54=jarvisin user-55=theblack user-56=hodgesonweb user-57=spectrum user-58=wilsonsw user-59=musorguk user-60=megacards user-61=brmrjxl user-62=lakesan1 user-63=sarafoundation user-64=atestord user-65=strathar user-66=lbhyisi user-67=hhdugcor user-68=magichat user-69=martsblo user-70=ptkxhsbt user-71=dickemery123 user-72=mcdermos user-73=chrisdal user-74=careers user-75=nbhavers user-76=david user-77=tomandle user-78=jennimil user-79=branko user-80=ranxterc user-81=outdoorc user-82=hodgsonmail user-83=romaldki user-84=attlebor user-85=lucy user-86=onlycont user-87=sosevalu user-88=crrtipdl user-89=bakery user-90=nove user-91=boldover user-92=kategilpin user-93=ladburyp user-94=dancinggardener user-95=stagingerris user-96=design user-97=what user-98=oubpgvbx user-99=tstardom user-100=nvihkvu user-101=cath user-102=sketchy
Sep  4 07:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=havantho user-104=zebrapho user-105=bwppodcast user-106=steve user-107=asandcoc user-108=sibtoncc user-109=eatspam user-110=darkstar user-111=beauty user-112=dhyana user-113=burydropin user-114=fawcettd user-115=nsceres user-116=smrszyqg user-117=isleofwi user-118=tigerlet user-119=barbersh user-120=hidden user-121=nomistakes user-122=fortunaz user-123=health2045 user-124=leftie user-125=foods user-126=putterfc user-127=nscdp user-128=philmcph user-129=ctedorgu user-130=firstre5 user-131=donnychicago user-132=steakbridieme user-133=lkpier user-134=hirefootballgame user-135=courseme user-136=eugincou user-137=ninejimm user-138=reliable user-139=cambria1 user-140=cathski user-141=pugwash user-142=paulmca1 user-143=howardon user-144=cwsocial feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 07:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 07:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:48 nativespace-cdp sudo[2058935]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:49 nativespace-cdp sudo[2058940]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-COuxeC9te9hanXlr.~
Sep  4 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:49 nativespace-cdp sudo[2058944]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-COuxeC9te9hanXlr.~'
Sep  4 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:49 nativespace-cdp sudo[2058947]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-COuxeC9te9hanXlr.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:49 nativespace-cdp sudo[2058951]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:49 nativespace-cdp sudo[2058954]: pam_unix(sudo:session): session closed for user root
Sep  4 07:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 07:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 07:09:50 nativespace-cdp sudo[2058972]: pam_unix(sudo:session): session closed for user root
Sep  4 07:11:33 nativespace-cdp sshd[2060948]: Connection closed by 159.100.136.21 port 37978 [preauth]
Sep  4 07:16:33 nativespace-cdp sshd[2066464]: Connection closed by 159.100.136.21 port 48200 [preauth]
Sep  4 07:21:33 nativespace-cdp sshd[2067541]: Connection closed by 159.100.136.21 port 58188 [preauth]
Sep  4 07:26:33 nativespace-cdp sshd[2068814]: Connection closed by 159.100.136.21 port 40234 [preauth]
Sep  4 07:31:33 nativespace-cdp sshd[2070013]: Connection closed by 159.100.136.21 port 50286 [preauth]
Sep  4 07:36:34 nativespace-cdp sshd[2071222]: Connection closed by 159.100.136.21 port 60558 [preauth]
Sep  4 07:41:33 nativespace-cdp sshd[2072371]: Connection closed by 159.100.136.21 port 42312 [preauth]
Sep  4 07:46:33 nativespace-cdp sshd[2073570]: Connection closed by 159.100.136.21 port 52564 [preauth]
Sep  4 07:51:33 nativespace-cdp sshd[2074628]: Connection closed by 159.100.136.21 port 34340 [preauth]
Sep  4 07:56:33 nativespace-cdp sshd[2075927]: Connection closed by 159.100.136.21 port 44630 [preauth]
Sep  4 08:01:33 nativespace-cdp sshd[2076996]: Connection closed by 159.100.136.21 port 54646 [preauth]
Sep  4 08:06:33 nativespace-cdp sshd[2078354]: Connection closed by 159.100.136.21 port 36740 [preauth]
Sep  4 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:26 nativespace-cdp sudo[2078951]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:26 nativespace-cdp sudo[2078955]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:27 nativespace-cdp sudo[2078958]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 08:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:27 nativespace-cdp sudo[2078965]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 08:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:30 nativespace-cdp sudo[2078975]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 08:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:30 nativespace-cdp sudo[2078992]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 08:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:31 nativespace-cdp sudo[2078995]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 08:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:31 nativespace-cdp sudo[2078998]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 08:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:31 nativespace-cdp sudo[2079001]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 08:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:31 nativespace-cdp sudo[2079004]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 08:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:31 nativespace-cdp sudo[2079007]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 08:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:33 nativespace-cdp sudo[2079017]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 08:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:34 nativespace-cdp sudo[2079022]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bedfords user-2=belle user-3=ggaaorgu user-4=newstoda user-5=bemadonn user-6=brighto1 user-7=nstriton user-8=firstre2 user-9=vivienn1 user-10=battlere user-11=oneoarco user-12=innovat1 user-13=stuartge user-14=askhform user-15=nativene user-16=skyfirec user-17=alexadmin user-18=firstrel user-19=clarkass user-20=costestimatorco user-21=firstred user-22=southlon user-23=highlegh user-24=jonhartl user-25=seftvta user-26=ultbcrra user-27=firstres user-28=coursemc user-29=opaiscyx user-30=accooper user-31=ianrayne user-32=connectedshoppin user-33=thqkgnbz user-34=milloyco user-35=gilpin user-36=elecleis user-37=hubmaster user-38=putterfi user-39=carsinyo user-40=fetch user-41=wilsonsw user-42=musorguk user-43=megacards user-44=brmrjxl user-45=lakesan1 user-46=strathar user-47=sarafoundation
Sep  4 08:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=atestord user-49=lbhyisi user-50=hhdugcor user-51=magichat user-52=martsblo user-53=dickemery123 user-54=ptkxhsbt user-55=ulsukarm user-56=booff user-57=markward user-58=foundation user-59=athenare user-60=connect9 user-61=vantagep user-62=maflemin user-63=lbscrmod user-64=still user-65=agproduc user-66=stephani user-67=leereyn1 user-68=jarvisin user-69=spectrum user-70=theblack user-71=hodgesonweb user-72=bakery user-73=sosevalu user-74=crrtipdl user-75=nove user-76=boldover user-77=ladburyp user-78=dancinggardener user-79=stagingerris user-80=kategilpin user-81=design user-82=tstardom user-83=oubpgvbx user-84=what user-85=sketchy user-86=cath user-87=havantho user-88=nvihkvu user-89=chrisdal user-90=mcdermos user-91=nbhavers user-92=careers user-93=david user-94=tomandle user-95=jennimil user-96=outdoorc user-97=ranxterc user-98=hodgsonmail user-99=branko user-100=romaldki user-101=attlebor
Sep  4 08:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=lucy user-103=onlycont user-104=isleofwi user-105=smrszyqg user-106=hidden user-107=nomistakes user-108=barbersh user-109=tigerlet user-110=putterfc user-111=nscdp user-112=fortunaz user-113=health2045 user-114=leftie user-115=foods user-116=lkpier user-117=ctedorgu user-118=philmcph user-119=firstre5 user-120=donnychicago user-121=steakbridieme user-122=hirefootballgame user-123=eugincou user-124=courseme user-125=cambria1 user-126=cathski user-127=ninejimm user-128=reliable user-129=pugwash user-130=howardon user-131=paulmca1 user-132=cwsocial user-133=bwppodcast user-134=zebrapho user-135=steve user-136=asandcoc user-137=sibtoncc user-138=beauty user-139=eatspam user-140=darkstar user-141=dhyana user-142=burydropin user-143=fawcettd user-144=nsceres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 08:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 08:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:35 nativespace-cdp sudo[2079030]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 08:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:35 nativespace-cdp sudo[2079036]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-BnMxo4dkIAUtueYA.~
Sep  4 08:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:35 nativespace-cdp sudo[2079039]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-BnMxo4dkIAUtueYA.~'
Sep  4 08:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:35 nativespace-cdp sudo[2079042]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-BnMxo4dkIAUtueYA.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 08:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:35 nativespace-cdp sudo[2079046]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 08:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:35 nativespace-cdp sudo[2079049]: pam_unix(sudo:session): session closed for user root
Sep  4 08:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 08:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 08:09:37 nativespace-cdp sudo[2079073]: pam_unix(sudo:session): session closed for user root
Sep  4 08:11:33 nativespace-cdp sshd[2079747]: Connection closed by 159.100.136.21 port 46752 [preauth]
Sep  4 08:16:33 nativespace-cdp sshd[2081101]: Connection closed by 159.100.136.21 port 56974 [preauth]
Sep  4 08:21:33 nativespace-cdp sshd[2082218]: Connection closed by 159.100.136.21 port 38720 [preauth]
Sep  4 08:26:33 nativespace-cdp sshd[2083592]: Connection closed by 159.100.136.21 port 49026 [preauth]
Sep  4 08:31:33 nativespace-cdp sshd[2084822]: Connection closed by 159.100.136.21 port 59098 [preauth]
Sep  4 08:36:33 nativespace-cdp sshd[2085855]: Connection closed by 159.100.136.21 port 41216 [preauth]
Sep  4 08:41:33 nativespace-cdp sshd[2087277]: Connection closed by 159.100.136.21 port 51188 [preauth]
Sep  4 08:46:33 nativespace-cdp sshd[2088267]: Connection closed by 159.100.136.21 port 33228 [preauth]
Sep  4 08:51:33 nativespace-cdp sshd[2089380]: Connection closed by 159.100.136.21 port 43266 [preauth]
Sep  4 08:56:33 nativespace-cdp sshd[2090593]: Connection closed by 159.100.136.21 port 53566 [preauth]
Sep  4 09:01:34 nativespace-cdp sshd[2092428]: Connection closed by 159.100.136.21 port 35356 [preauth]
Sep  4 09:05:17 nativespace-cdp sshd[2093287]: Invalid user myuser from 62.210.125.190 port 36038
Sep  4 09:05:17 nativespace-cdp sshd[2093287]: input_userauth_request: invalid user myuser [preauth]
Sep  4 09:05:17 nativespace-cdp sshd[2093287]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 09:05:17 nativespace-cdp sshd[2093287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.125.190
Sep  4 09:05:19 nativespace-cdp sshd[2093287]: Failed password for invalid user myuser from 62.210.125.190 port 36038 ssh2
Sep  4 09:05:19 nativespace-cdp sshd[2093287]: Received disconnect from 62.210.125.190 port 36038:11: Bye Bye [preauth]
Sep  4 09:05:19 nativespace-cdp sshd[2093287]: Disconnected from 62.210.125.190 port 36038 [preauth]
Sep  4 09:06:33 nativespace-cdp sshd[2093631]: Connection closed by 159.100.136.21 port 45718 [preauth]
Sep  4 09:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 09:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:29 nativespace-cdp sudo[2094163]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 09:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:29 nativespace-cdp sudo[2094168]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 09:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:31 nativespace-cdp sudo[2094173]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 09:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:31 nativespace-cdp sudo[2094183]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 09:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:34 nativespace-cdp sudo[2094189]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 09:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:34 nativespace-cdp sudo[2094207]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 09:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:34 nativespace-cdp sudo[2094212]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 09:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:34 nativespace-cdp sudo[2094217]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 09:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:34 nativespace-cdp sudo[2094222]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 09:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:34 nativespace-cdp sudo[2094228]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 09:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:34 nativespace-cdp sudo[2094234]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 09:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:36 nativespace-cdp sudo[2094246]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 09:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:38 nativespace-cdp sudo[2094255]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=beauty user-2=eatspam user-3=darkstar user-4=dhyana user-5=burydropin user-6=fawcettd user-7=nsceres user-8=bwppodcast user-9=zebrapho user-10=steve user-11=asandcoc user-12=sibtoncc user-13=hirefootballgame user-14=eugincou user-15=courseme user-16=cathski user-17=cambria1 user-18=ninejimm user-19=reliable user-20=howardon user-21=pugwash user-22=paulmca1 user-23=cwsocial user-24=smrszyqg user-25=isleofwi user-26=hidden user-27=nomistakes user-28=tigerlet user-29=barbersh user-30=putterfc user-31=nscdp user-32=health2045 user-33=fortunaz user-34=leftie user-35=foods user-36=lkpier user-37=philmcph user-38=ctedorgu user-39=firstre5 user-40=donnychicago user-41=steakbridieme user-42=hodgsonmail user-43=outdoorc user-44=ranxterc user-45=branko user-46=romaldki user-47=attlebor user-48=lucy
Sep  4 09:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=chrisdal user-51=mcdermos user-52=nbhavers user-53=careers user-54=david user-55=tomandle user-56=jennimil user-57=ladburyp user-58=dancinggardener user-59=stagingerris user-60=kategilpin user-61=design user-62=tstardom user-63=oubpgvbx user-64=what user-65=sketchy user-66=cath user-67=havantho user-68=nvihkvu user-69=bakery user-70=sosevalu user-71=crrtipdl user-72=nove user-73=boldover user-74=still user-75=agproduc user-76=stephani user-77=leereyn1 user-78=jarvisin user-79=spectrum user-80=hodgesonweb user-81=theblack user-82=ulsukarm user-83=booff user-84=markward user-85=foundation user-86=athenare user-87=connect9 user-88=vantagep user-89=maflemin user-90=lbscrmod user-91=lbhyisi user-92=hhdugcor user-93=magichat user-94=martsblo user-95=dickemery123 user-96=ptkxhsbt user-97=wilsonsw user-98=musorguk user-99=megacards user-100=brmrjxl user-101=lakesan1 user-102=strathar
Sep  4 09:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=sarafoundation user-104=atestord user-105=accooper user-106=ianrayne user-107=connectedshoppin user-108=thqkgnbz user-109=milloyco user-110=gilpin user-111=elecleis user-112=hubmaster user-113=putterfi user-114=carsinyo user-115=fetch user-116=firstrel user-117=clarkass user-118=costestimatorco user-119=firstred user-120=southlon user-121=highlegh user-122=seftvta user-123=jonhartl user-124=ultbcrra user-125=firstres user-126=opaiscyx user-127=coursemc user-128=innovat1 user-129=stuartge user-130=askhform user-131=nativene user-132=alexadmin user-133=skyfirec user-134=bedfords user-135=ggaaorgu user-136=belle user-137=newstoda user-138=bemadonn user-139=brighto1 user-140=nstriton user-141=firstre2 user-142=vivienn1 user-143=battlere user-144=oneoarco feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 09:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 09:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:39 nativespace-cdp sudo[2094265]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 09:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:39 nativespace-cdp sudo[2094279]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-K9dCsFMMU86ohZ4l.~
Sep  4 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:40 nativespace-cdp sudo[2094284]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-K9dCsFMMU86ohZ4l.~'
Sep  4 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:40 nativespace-cdp sudo[2094288]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-K9dCsFMMU86ohZ4l.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:40 nativespace-cdp sudo[2094294]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:40 nativespace-cdp sudo[2094299]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 09:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 09:09:41 nativespace-cdp sudo[2094322]: pam_unix(sudo:session): session closed for user root
Sep  4 09:09:45 nativespace-cdp sshd[2094339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.73.231.122  user=root
Sep  4 09:09:45 nativespace-cdp sshd[2094339]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 09:09:48 nativespace-cdp sshd[2094339]: Failed password for root from 65.73.231.122 port 55266 ssh2
Sep  4 09:09:48 nativespace-cdp sshd[2094339]: Received disconnect from 65.73.231.122 port 55266:11: Bye Bye [preauth]
Sep  4 09:09:48 nativespace-cdp sshd[2094339]: Disconnected from 65.73.231.122 port 55266 [preauth]
Sep  4 09:11:33 nativespace-cdp sshd[2095227]: Connection closed by 159.100.136.21 port 55748 [preauth]
Sep  4 09:12:24 nativespace-cdp sshd[2095367]: Invalid user user03 from 62.210.125.190 port 36222
Sep  4 09:12:24 nativespace-cdp sshd[2095367]: input_userauth_request: invalid user user03 [preauth]
Sep  4 09:12:24 nativespace-cdp sshd[2095367]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 09:12:24 nativespace-cdp sshd[2095367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.125.190
Sep  4 09:12:26 nativespace-cdp sshd[2095367]: Failed password for invalid user user03 from 62.210.125.190 port 36222 ssh2
Sep  4 09:12:26 nativespace-cdp sshd[2095367]: Received disconnect from 62.210.125.190 port 36222:11: Bye Bye [preauth]
Sep  4 09:12:26 nativespace-cdp sshd[2095367]: Disconnected from 62.210.125.190 port 36222 [preauth]
Sep  4 09:12:50 nativespace-cdp sshd[2095439]: Invalid user vc from 143.110.243.70 port 54542
Sep  4 09:12:50 nativespace-cdp sshd[2095439]: input_userauth_request: invalid user vc [preauth]
Sep  4 09:12:50 nativespace-cdp sshd[2095439]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 09:12:50 nativespace-cdp sshd[2095439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.243.70
Sep  4 09:12:52 nativespace-cdp sshd[2095439]: Failed password for invalid user vc from 143.110.243.70 port 54542 ssh2
Sep  4 09:12:52 nativespace-cdp sshd[2095439]: Received disconnect from 143.110.243.70 port 54542:11: Bye Bye [preauth]
Sep  4 09:12:52 nativespace-cdp sshd[2095439]: Disconnected from 143.110.243.70 port 54542 [preauth]
Sep  4 09:13:01 nativespace-cdp sshd[2095463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.125.190  user=root
Sep  4 09:13:01 nativespace-cdp sshd[2095463]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 09:13:03 nativespace-cdp sshd[2095463]: Failed password for root from 62.210.125.190 port 36288 ssh2
Sep  4 09:13:03 nativespace-cdp sshd[2095463]: Received disconnect from 62.210.125.190 port 36288:11: Bye Bye [preauth]
Sep  4 09:13:03 nativespace-cdp sshd[2095463]: Disconnected from 62.210.125.190 port 36288 [preauth]
Sep  4 09:13:38 nativespace-cdp sshd[2095630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.73.231.122  user=root
Sep  4 09:13:38 nativespace-cdp sshd[2095630]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 09:13:40 nativespace-cdp sshd[2095630]: Failed password for root from 65.73.231.122 port 33920 ssh2
Sep  4 09:13:40 nativespace-cdp sshd[2095630]: Received disconnect from 65.73.231.122 port 33920:11: Bye Bye [preauth]
Sep  4 09:13:40 nativespace-cdp sshd[2095630]: Disconnected from 65.73.231.122 port 33920 [preauth]
Sep  4 09:14:19 nativespace-cdp sshd[2095746]: Invalid user alex from 65.73.231.122 port 47432
Sep  4 09:14:19 nativespace-cdp sshd[2095746]: input_userauth_request: invalid user alex [preauth]
Sep  4 09:14:19 nativespace-cdp sshd[2095746]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 09:14:19 nativespace-cdp sshd[2095746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.73.231.122
Sep  4 09:14:21 nativespace-cdp sshd[2095746]: Failed password for invalid user alex from 65.73.231.122 port 47432 ssh2
Sep  4 09:14:31 nativespace-cdp sshd[2095826]: Invalid user wangzhen from 143.110.243.70 port 51562
Sep  4 09:14:31 nativespace-cdp sshd[2095826]: input_userauth_request: invalid user wangzhen [preauth]
Sep  4 09:14:31 nativespace-cdp sshd[2095826]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 09:14:31 nativespace-cdp sshd[2095826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.243.70
Sep  4 09:14:34 nativespace-cdp sshd[2095826]: Failed password for invalid user wangzhen from 143.110.243.70 port 51562 ssh2
Sep  4 09:14:34 nativespace-cdp sshd[2095826]: Received disconnect from 143.110.243.70 port 51562:11: Bye Bye [preauth]
Sep  4 09:14:34 nativespace-cdp sshd[2095826]: Disconnected from 143.110.243.70 port 51562 [preauth]
Sep  4 09:15:18 nativespace-cdp sshd[2096111]: Invalid user testuser from 143.110.243.70 port 41284
Sep  4 09:15:18 nativespace-cdp sshd[2096111]: input_userauth_request: invalid user testuser [preauth]
Sep  4 09:15:18 nativespace-cdp sshd[2096111]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 09:15:18 nativespace-cdp sshd[2096111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.243.70
Sep  4 09:15:20 nativespace-cdp sshd[2096111]: Failed password for invalid user testuser from 143.110.243.70 port 41284 ssh2
Sep  4 09:15:20 nativespace-cdp sshd[2096111]: Received disconnect from 143.110.243.70 port 41284:11: Bye Bye [preauth]
Sep  4 09:15:20 nativespace-cdp sshd[2096111]: Disconnected from 143.110.243.70 port 41284 [preauth]
Sep  4 09:16:33 nativespace-cdp sshd[2096449]: Connection closed by 159.100.136.21 port 37754 [preauth]
Sep  4 09:21:33 nativespace-cdp sshd[2097702]: Connection closed by 159.100.136.21 port 47798 [preauth]
Sep  4 09:26:33 nativespace-cdp sshd[2098856]: Connection closed by 159.100.136.21 port 58098 [preauth]
Sep  4 09:31:33 nativespace-cdp sshd[2100468]: Connection closed by 159.100.136.21 port 39936 [preauth]
Sep  4 09:36:33 nativespace-cdp sshd[2101639]: Connection closed by 159.100.136.21 port 50276 [preauth]
Sep  4 09:41:33 nativespace-cdp sshd[2102926]: Connection closed by 159.100.136.21 port 60294 [preauth]
Sep  4 09:46:33 nativespace-cdp sshd[2104452]: Connection closed by 159.100.136.21 port 42346 [preauth]
Sep  4 09:51:33 nativespace-cdp sshd[2105886]: Connection closed by 159.100.136.21 port 52400 [preauth]
Sep  4 09:56:33 nativespace-cdp sshd[2107270]: Connection closed by 159.100.136.21 port 34450 [preauth]
Sep  4 10:01:34 nativespace-cdp sshd[2108983]: Connection closed by 159.100.136.21 port 44486 [preauth]
Sep  4 10:06:33 nativespace-cdp sshd[2110234]: Connection closed by 159.100.136.21 port 54832 [preauth]
Sep  4 10:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 10:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:22 nativespace-cdp sudo[2110783]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 10:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:22 nativespace-cdp sudo[2110787]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 10:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:23 nativespace-cdp sudo[2110792]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 10:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:23 nativespace-cdp sudo[2110802]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 10:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:25 nativespace-cdp sudo[2110808]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 10:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:25 nativespace-cdp sudo[2110823]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 10:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:25 nativespace-cdp sudo[2110828]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 10:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:25 nativespace-cdp sudo[2110832]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 10:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:25 nativespace-cdp sudo[2110837]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 10:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:25 nativespace-cdp sudo[2110843]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 10:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:25 nativespace-cdp sudo[2110848]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:27 nativespace-cdp sudo[2110857]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:27 nativespace-cdp sudo[2110864]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=southlon user-2=highlegh user-3=firstred user-4=costestimatorco user-5=firstrel user-6=clarkass user-7=opaiscyx user-8=coursemc user-9=firstres user-10=jonhartl user-11=seftvta user-12=ultbcrra user-13=thqkgnbz user-14=connectedshoppin user-15=ianrayne user-16=accooper user-17=carsinyo user-18=fetch user-19=hubmaster user-20=putterfi user-21=elecleis user-22=milloyco user-23=gilpin user-24=bemadonn user-25=belle user-26=ggaaorgu user-27=newstoda user-28=bedfords user-29=battlere user-30=oneoarco user-31=firstre2 user-32=vivienn1 user-33=brighto1 user-34=nstriton user-35=nativene user-36=stuartge user-37=askhform user-38=innovat1 user-39=alexadmin user-40=skyfirec user-41=ulsukarm user-42=maflemin user-43=lbscrmod user-44=connect9 user-45=athenare user-46=vantagep user-47=foundation user-48=booff
Sep  4 10:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=markward user-50=leereyn1 user-51=stephani user-52=still user-53=agproduc user-54=hodgesonweb user-55=theblack user-56=spectrum user-57=jarvisin user-58=musorguk user-59=megacards user-60=wilsonsw user-61=sarafoundation user-62=atestord user-63=strathar user-64=lakesan1 user-65=brmrjxl user-66=magichat user-67=lbhyisi user-68=hhdugcor user-69=ptkxhsbt user-70=dickemery123 user-71=martsblo user-72=careers user-73=nbhavers user-74=david user-75=mcdermos user-76=chrisdal user-77=jennimil user-78=tomandle user-79=romaldki user-80=branko user-81=hodgsonmail user-82=outdoorc user-83=ranxterc user-84=onlycont user-85=attlebor user-86=lucy user-87=sosevalu user-88=crrtipdl user-89=bakery user-90=boldover user-91=nove user-92=design user-93=kategilpin user-94=ladburyp user-95=stagingerris user-96=dancinggardener user-97=nvihkvu user-98=sketchy user-99=cath user-100=havantho user-101=what user-102=oubpgvbx
Sep  4 10:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=tstardom user-104=steve user-105=zebrapho user-106=bwppodcast user-107=asandcoc user-108=sibtoncc user-109=dhyana user-110=eatspam user-111=darkstar user-112=beauty user-113=nsceres user-114=burydropin user-115=fawcettd user-116=barbersh user-117=tigerlet user-118=hidden user-119=nomistakes user-120=smrszyqg user-121=isleofwi user-122=philmcph user-123=ctedorgu user-124=firstre5 user-125=donnychicago user-126=steakbridieme user-127=lkpier user-128=health2045 user-129=fortunaz user-130=leftie user-131=foods user-132=putterfc user-133=nscdp user-134=courseme user-135=eugincou user-136=hirefootballgame user-137=howardon user-138=pugwash user-139=paulmca1 user-140=cwsocial user-141=reliable user-142=ninejimm user-143=cambria1 user-144=cathski feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 10:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:28 nativespace-cdp sudo[2110871]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 10:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:29 nativespace-cdp sudo[2110881]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xGebeUDPcv3XfNjf.~
Sep  4 10:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:29 nativespace-cdp sudo[2110886]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xGebeUDPcv3XfNjf.~'
Sep  4 10:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:29 nativespace-cdp sudo[2110890]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xGebeUDPcv3XfNjf.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 10:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:29 nativespace-cdp sudo[2110896]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 10:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:29 nativespace-cdp sudo[2110902]: pam_unix(sudo:session): session closed for user root
Sep  4 10:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 10:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 10:09:30 nativespace-cdp sudo[2110925]: pam_unix(sudo:session): session closed for user root
Sep  4 10:11:33 nativespace-cdp sshd[2111800]: Connection closed by 159.100.136.21 port 36600 [preauth]
Sep  4 10:16:33 nativespace-cdp sshd[2112888]: Connection closed by 159.100.136.21 port 46872 [preauth]
Sep  4 10:21:33 nativespace-cdp sshd[2114192]: Connection closed by 159.100.136.21 port 56882 [preauth]
Sep  4 10:26:33 nativespace-cdp sshd[2115392]: Connection closed by 159.100.136.21 port 38966 [preauth]
Sep  4 10:31:33 nativespace-cdp sshd[2116871]: Connection closed by 159.100.136.21 port 49054 [preauth]
Sep  4 10:33:27 nativespace-cdp sshd[2117432]: Invalid user wv from 186.124.22.55 port 33362
Sep  4 10:33:27 nativespace-cdp sshd[2117432]: input_userauth_request: invalid user wv [preauth]
Sep  4 10:33:27 nativespace-cdp sshd[2117432]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:33:27 nativespace-cdp sshd[2117432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.124.22.55
Sep  4 10:33:29 nativespace-cdp sshd[2117432]: Failed password for invalid user wv from 186.124.22.55 port 33362 ssh2
Sep  4 10:33:29 nativespace-cdp sshd[2117432]: Received disconnect from 186.124.22.55 port 33362:11: Bye Bye [preauth]
Sep  4 10:33:29 nativespace-cdp sshd[2117432]: Disconnected from 186.124.22.55 port 33362 [preauth]
Sep  4 10:35:12 nativespace-cdp sshd[2117854]: Invalid user aos from 128.199.194.1 port 42351
Sep  4 10:35:12 nativespace-cdp sshd[2117854]: input_userauth_request: invalid user aos [preauth]
Sep  4 10:35:12 nativespace-cdp sshd[2117854]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:35:12 nativespace-cdp sshd[2117854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.194.1
Sep  4 10:35:14 nativespace-cdp sshd[2117854]: Failed password for invalid user aos from 128.199.194.1 port 42351 ssh2
Sep  4 10:35:15 nativespace-cdp sshd[2117854]: Received disconnect from 128.199.194.1 port 42351:11: Bye Bye [preauth]
Sep  4 10:35:15 nativespace-cdp sshd[2117854]: Disconnected from 128.199.194.1 port 42351 [preauth]
Sep  4 10:36:33 nativespace-cdp sshd[2118282]: Connection closed by 159.100.136.21 port 59372 [preauth]
Sep  4 10:37:49 nativespace-cdp sshd[2118755]: Invalid user swm from 212.47.250.207 port 48496
Sep  4 10:37:49 nativespace-cdp sshd[2118755]: input_userauth_request: invalid user swm [preauth]
Sep  4 10:37:49 nativespace-cdp sshd[2118755]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:37:49 nativespace-cdp sshd[2118755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.250.207
Sep  4 10:37:51 nativespace-cdp sshd[2118755]: Failed password for invalid user swm from 212.47.250.207 port 48496 ssh2
Sep  4 10:37:51 nativespace-cdp sshd[2118755]: Received disconnect from 212.47.250.207 port 48496:11: Bye Bye [preauth]
Sep  4 10:37:51 nativespace-cdp sshd[2118755]: Disconnected from 212.47.250.207 port 48496 [preauth]
Sep  4 10:41:18 nativespace-cdp sshd[2119817]: Invalid user yeyang from 186.124.22.55 port 50288
Sep  4 10:41:18 nativespace-cdp sshd[2119817]: input_userauth_request: invalid user yeyang [preauth]
Sep  4 10:41:18 nativespace-cdp sshd[2119817]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:41:18 nativespace-cdp sshd[2119817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.124.22.55
Sep  4 10:41:19 nativespace-cdp sshd[2119817]: Failed password for invalid user yeyang from 186.124.22.55 port 50288 ssh2
Sep  4 10:41:20 nativespace-cdp sshd[2119817]: Received disconnect from 186.124.22.55 port 50288:11: Bye Bye [preauth]
Sep  4 10:41:20 nativespace-cdp sshd[2119817]: Disconnected from 186.124.22.55 port 50288 [preauth]
Sep  4 10:41:24 nativespace-cdp sshd[2119842]: Invalid user hsr from 212.47.250.207 port 48640
Sep  4 10:41:24 nativespace-cdp sshd[2119842]: input_userauth_request: invalid user hsr [preauth]
Sep  4 10:41:24 nativespace-cdp sshd[2119842]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:41:24 nativespace-cdp sshd[2119842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.250.207
Sep  4 10:41:26 nativespace-cdp sshd[2119842]: Failed password for invalid user hsr from 212.47.250.207 port 48640 ssh2
Sep  4 10:41:26 nativespace-cdp sshd[2119842]: Received disconnect from 212.47.250.207 port 48640:11: Bye Bye [preauth]
Sep  4 10:41:26 nativespace-cdp sshd[2119842]: Disconnected from 212.47.250.207 port 48640 [preauth]
Sep  4 10:41:34 nativespace-cdp sshd[2119882]: Connection closed by 159.100.136.21 port 41164 [preauth]
Sep  4 10:42:01 nativespace-cdp sshd[2119968]: Invalid user test from 212.47.250.207 port 39176
Sep  4 10:42:01 nativespace-cdp sshd[2119968]: input_userauth_request: invalid user test [preauth]
Sep  4 10:42:01 nativespace-cdp sshd[2119968]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:42:01 nativespace-cdp sshd[2119968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.250.207
Sep  4 10:42:03 nativespace-cdp sshd[2119968]: Failed password for invalid user test from 212.47.250.207 port 39176 ssh2
Sep  4 10:42:03 nativespace-cdp sshd[2119968]: Received disconnect from 212.47.250.207 port 39176:11: Bye Bye [preauth]
Sep  4 10:42:03 nativespace-cdp sshd[2119968]: Disconnected from 212.47.250.207 port 39176 [preauth]
Sep  4 10:42:08 nativespace-cdp sshd[2120017]: Invalid user taoli from 128.199.194.1 port 39192
Sep  4 10:42:08 nativespace-cdp sshd[2120017]: input_userauth_request: invalid user taoli [preauth]
Sep  4 10:42:08 nativespace-cdp sshd[2120017]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:42:08 nativespace-cdp sshd[2120017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.194.1
Sep  4 10:42:10 nativespace-cdp sshd[2120022]: Invalid user sheng from 186.124.22.55 port 38972
Sep  4 10:42:10 nativespace-cdp sshd[2120022]: input_userauth_request: invalid user sheng [preauth]
Sep  4 10:42:10 nativespace-cdp sshd[2120022]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:42:10 nativespace-cdp sshd[2120022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.124.22.55
Sep  4 10:42:10 nativespace-cdp sshd[2120017]: Failed password for invalid user taoli from 128.199.194.1 port 39192 ssh2
Sep  4 10:42:10 nativespace-cdp sshd[2120017]: Received disconnect from 128.199.194.1 port 39192:11: Bye Bye [preauth]
Sep  4 10:42:10 nativespace-cdp sshd[2120017]: Disconnected from 128.199.194.1 port 39192 [preauth]
Sep  4 10:42:11 nativespace-cdp sshd[2120022]: Failed password for invalid user sheng from 186.124.22.55 port 38972 ssh2
Sep  4 10:42:11 nativespace-cdp sshd[2120022]: Received disconnect from 186.124.22.55 port 38972:11: Bye Bye [preauth]
Sep  4 10:42:11 nativespace-cdp sshd[2120022]: Disconnected from 186.124.22.55 port 38972 [preauth]
Sep  4 10:42:43 nativespace-cdp sshd[2120172]: Invalid user luca from 103.179.56.51 port 51874
Sep  4 10:42:43 nativespace-cdp sshd[2120172]: input_userauth_request: invalid user luca [preauth]
Sep  4 10:42:43 nativespace-cdp sshd[2120172]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:42:43 nativespace-cdp sshd[2120172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.56.51
Sep  4 10:42:45 nativespace-cdp sshd[2120172]: Failed password for invalid user luca from 103.179.56.51 port 51874 ssh2
Sep  4 10:42:45 nativespace-cdp sshd[2120172]: Received disconnect from 103.179.56.51 port 51874:11: Bye Bye [preauth]
Sep  4 10:42:45 nativespace-cdp sshd[2120172]: Disconnected from 103.179.56.51 port 51874 [preauth]
Sep  4 10:42:56 nativespace-cdp sshd[2120228]: Invalid user jboss from 128.199.194.1 port 45607
Sep  4 10:42:56 nativespace-cdp sshd[2120228]: input_userauth_request: invalid user jboss [preauth]
Sep  4 10:42:56 nativespace-cdp sshd[2120228]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 10:42:56 nativespace-cdp sshd[2120228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.194.1
Sep  4 10:42:58 nativespace-cdp sshd[2120228]: Failed password for invalid user jboss from 128.199.194.1 port 45607 ssh2
Sep  4 10:42:58 nativespace-cdp sshd[2120228]: Received disconnect from 128.199.194.1 port 45607:11: Bye Bye [preauth]
Sep  4 10:42:58 nativespace-cdp sshd[2120228]: Disconnected from 128.199.194.1 port 45607 [preauth]
Sep  4 10:43:56 nativespace-cdp sshd[2120447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.56.51  user=root
Sep  4 10:43:56 nativespace-cdp sshd[2120447]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 10:43:58 nativespace-cdp sshd[2120447]: Failed password for root from 103.179.56.51 port 42160 ssh2
Sep  4 10:43:58 nativespace-cdp sshd[2120447]: Received disconnect from 103.179.56.51 port 42160:11: Bye Bye [preauth]
Sep  4 10:43:58 nativespace-cdp sshd[2120447]: Disconnected from 103.179.56.51 port 42160 [preauth]
Sep  4 10:44:53 nativespace-cdp sshd[2120705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.56.51  user=root
Sep  4 10:44:53 nativespace-cdp sshd[2120705]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 10:44:55 nativespace-cdp sshd[2120705]: Failed password for root from 103.179.56.51 port 53512 ssh2
Sep  4 10:44:56 nativespace-cdp sshd[2120705]: Received disconnect from 103.179.56.51 port 53512:11: Bye Bye [preauth]
Sep  4 10:44:56 nativespace-cdp sshd[2120705]: Disconnected from 103.179.56.51 port 53512 [preauth]
Sep  4 10:46:33 nativespace-cdp sshd[2121318]: Connection closed by 159.100.136.21 port 51432 [preauth]
Sep  4 10:51:33 nativespace-cdp sshd[2122720]: Connection closed by 159.100.136.21 port 33216 [preauth]
Sep  4 10:56:33 nativespace-cdp sshd[2123975]: Connection closed by 159.100.136.21 port 43534 [preauth]
Sep  4 11:01:33 nativespace-cdp sshd[2125688]: Connection closed by 159.100.136.21 port 53578 [preauth]
Sep  4 11:06:33 nativespace-cdp sshd[2127025]: Connection closed by 159.100.136.21 port 35688 [preauth]
Sep  4 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:25 nativespace-cdp sudo[2127642]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:25 nativespace-cdp sudo[2127646]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:25 nativespace-cdp sudo[2127651]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:25 nativespace-cdp sudo[2127658]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:29 nativespace-cdp sudo[2127664]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:29 nativespace-cdp sudo[2127681]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:29 nativespace-cdp sudo[2127686]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:29 nativespace-cdp sudo[2127690]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:29 nativespace-cdp sudo[2127695]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:29 nativespace-cdp sudo[2127701]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:29 nativespace-cdp sudo[2127708]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 11:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:31 nativespace-cdp sudo[2127718]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 11:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:31 nativespace-cdp sudo[2127726]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=leereyn1 user-2=stephani user-3=agproduc user-4=still user-5=theblack user-6=hodgesonweb user-7=spectrum user-8=jarvisin user-9=ulsukarm user-10=lbscrmod user-11=maflemin user-12=vantagep user-13=athenare user-14=connect9 user-15=foundation user-16=booff user-17=markward user-18=magichat user-19=hhdugcor user-20=lbhyisi user-21=ptkxhsbt user-22=dickemery123 user-23=martsblo user-24=megacards user-25=musorguk user-26=wilsonsw user-27=atestord user-28=sarafoundation user-29=strathar user-30=lakesan1 user-31=brmrjxl user-32=thqkgnbz user-33=connectedshoppin user-34=ianrayne user-35=accooper user-36=fetch user-37=carsinyo user-38=putterfi user-39=hubmaster user-40=elecleis user-41=gilpin user-42=milloyco user-43=highlegh user-44=southlon user-45=firstred user-46=costestimatorco user-47=clarkass
Sep  4 11:09:31 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=firstrel user-49=opaiscyx user-50=coursemc user-51=firstres user-52=ultbcrra user-53=seftvta user-54=jonhartl user-55=nativene user-56=askhform user-57=stuartge user-58=innovat1 user-59=alexadmin user-60=skyfirec user-61=bemadonn user-62=newstoda user-63=ggaaorgu user-64=belle user-65=bedfords user-66=oneoarco user-67=battlere user-68=vivienn1 user-69=firstre2 user-70=nstriton user-71=brighto1 user-72=dhyana user-73=darkstar user-74=eatspam user-75=beauty user-76=nsceres user-77=fawcettd user-78=burydropin user-79=steve user-80=zebrapho user-81=bwppodcast user-82=sibtoncc user-83=asandcoc user-84=courseme user-85=eugincou user-86=hirefootballgame user-87=cwsocial user-88=paulmca1 user-89=howardon user-90=pugwash user-91=reliable user-92=ninejimm user-93=cambria1 user-94=cathski user-95=tigerlet user-96=barbersh user-97=nomistakes user-98=hidden user-99=isleofwi user-100=smrszyqg user-101=steakbridieme
Sep  4 11:09:31 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=donnychicago user-103=firstre5 user-104=philmcph user-105=ctedorgu user-106=lkpier user-107=foods user-108=leftie user-109=fortunaz user-110=health2045 user-111=nscdp user-112=putterfc user-113=romaldki user-114=branko user-115=ranxterc user-116=hodgsonmail user-117=outdoorc user-118=onlycont user-119=lucy user-120=attlebor user-121=david user-122=careers user-123=nbhavers user-124=mcdermos user-125=chrisdal user-126=jennimil user-127=tomandle user-128=design user-129=kategilpin user-130=stagingerris user-131=dancinggardener user-132=ladburyp user-133=nvihkvu user-134=havantho user-135=cath user-136=sketchy user-137=what user-138=oubpgvbx user-139=tstardom user-140=crrtipdl user-141=sosevalu user-142=bakery user-143=boldover user-144=nove feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 11:09:31 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 11:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:32 nativespace-cdp sudo[2127733]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  4 11:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:34 nativespace-cdp sudo[2127747]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep  4 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  4 11:09:34 nativespace-cdp sudo[2127752]: pam_unix(sudo:session): session closed for user onlycont
Sep  4 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  4 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:35 nativespace-cdp sudo[2127766]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  4 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 11:09:35 nativespace-cdp sudo[2127774]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 11:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  4 11:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:38 nativespace-cdp sudo[2127802]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep  4 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  4 11:09:38 nativespace-cdp sudo[2127807]: pam_unix(sudo:session): session closed for user lkpier
Sep  4 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  4 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:39 nativespace-cdp sudo[2127824]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep  4 11:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  4 11:09:39 nativespace-cdp sudo[2127828]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  4 11:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  4 11:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  4 11:09:39 nativespace-cdp sudo[2127842]: pam_unix(sudo:session): session closed for user oneoarco
Sep  4 11:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  4 11:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:40 nativespace-cdp sudo[2127855]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep  4 11:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  4 11:09:40 nativespace-cdp sudo[2127862]: pam_unix(sudo:session): session closed for user fortunaz
Sep  4 11:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep  4 11:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:40 nativespace-cdp sudo[2127876]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 11:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:40 nativespace-cdp sudo[2127881]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep  4 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:58 nativespace-cdp sudo[2128961]: pam_unix(sudo:session): session closed for user root
Sep  4 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep  4 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:09:58 nativespace-cdp sudo[2128972]: pam_unix(sudo:session): session closed for user root
Sep  4 11:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 11:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:10:00 nativespace-cdp sudo[2129086]: pam_unix(sudo:session): session closed for user root
Sep  4 11:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ESGMFnvxkiCoH48T.~
Sep  4 11:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:10:00 nativespace-cdp sudo[2129096]: pam_unix(sudo:session): session closed for user root
Sep  4 11:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ESGMFnvxkiCoH48T.~'
Sep  4 11:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:10:00 nativespace-cdp sudo[2129100]: pam_unix(sudo:session): session closed for user root
Sep  4 11:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ESGMFnvxkiCoH48T.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 11:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:10:00 nativespace-cdp sudo[2129109]: pam_unix(sudo:session): session closed for user root
Sep  4 11:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 11:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:10:00 nativespace-cdp sudo[2129115]: pam_unix(sudo:session): session closed for user root
Sep  4 11:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 11:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:10:10 nativespace-cdp sudo[2129309]: pam_unix(sudo:session): session closed for user root
Sep  4 11:11:33 nativespace-cdp sshd[2129855]: Connection closed by 159.100.136.21 port 45748 [preauth]
Sep  4 11:16:33 nativespace-cdp sshd[2131063]: Connection closed by 159.100.136.21 port 56022 [preauth]
Sep  4 11:21:33 nativespace-cdp sshd[2132442]: Connection closed by 159.100.136.21 port 37784 [preauth]
Sep  4 11:24:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 11:24:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:24:01 nativespace-cdp sudo[2132884]: pam_unix(sudo:session): session closed for user root
Sep  4 11:24:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status hubmaster
Sep  4 11:24:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 11:24:02 nativespace-cdp sudo[2132890]: pam_unix(sudo:session): session closed for user root
Sep  4 11:26:33 nativespace-cdp sshd[2133957]: Connection closed by 159.100.136.21 port 48102 [preauth]
Sep  4 11:31:33 nativespace-cdp sshd[2135403]: Connection closed by 159.100.136.21 port 58196 [preauth]
Sep  4 11:36:33 nativespace-cdp sshd[2136699]: Connection closed by 159.100.136.21 port 40268 [preauth]
Sep  4 11:41:33 nativespace-cdp sshd[2138394]: Connection closed by 159.100.136.21 port 50262 [preauth]
Sep  4 11:46:33 nativespace-cdp sshd[2139636]: Connection closed by 159.100.136.21 port 60524 [preauth]
Sep  4 11:51:33 nativespace-cdp sshd[2140829]: Connection closed by 159.100.136.21 port 42334 [preauth]
Sep  4 11:56:33 nativespace-cdp sshd[2141957]: Connection closed by 159.100.136.21 port 52654 [preauth]
Sep  4 12:01:33 nativespace-cdp sshd[2143566]: Connection closed by 159.100.136.21 port 34436 [preauth]
Sep  4 12:06:33 nativespace-cdp sshd[2144702]: Connection closed by 159.100.136.21 port 44804 [preauth]
Sep  4 12:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 12:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:21 nativespace-cdp sudo[2145353]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 12:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:21 nativespace-cdp sudo[2145358]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 12:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:22 nativespace-cdp sudo[2145363]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 12:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:22 nativespace-cdp sudo[2145369]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 12:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:24 nativespace-cdp sudo[2145375]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 12:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:24 nativespace-cdp sudo[2145392]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:25 nativespace-cdp sudo[2145397]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:25 nativespace-cdp sudo[2145401]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:25 nativespace-cdp sudo[2145406]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:25 nativespace-cdp sudo[2145411]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:25 nativespace-cdp sudo[2145417]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 12:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:27 nativespace-cdp sudo[2145431]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 12:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:27 nativespace-cdp sudo[2145438]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=booff user-3=foundation user-4=markward user-5=connect9 user-6=athenare user-7=vantagep user-8=maflemin user-9=lbscrmod user-10=still user-11=agproduc user-12=stephani user-13=leereyn1 user-14=jarvisin user-15=spectrum user-16=theblack user-17=hodgesonweb user-18=wilsonsw user-19=musorguk user-20=megacards user-21=brmrjxl user-22=lakesan1 user-23=strathar user-24=sarafoundation user-25=atestord user-26=lbhyisi user-27=hhdugcor user-28=magichat user-29=martsblo user-30=dickemery123 user-31=ptkxhsbt user-32=clarkass user-33=firstrel user-34=costestimatorco user-35=firstred user-36=southlon user-37=highlegh user-38=jonhartl user-39=seftvta user-40=ultbcrra user-41=firstres user-42=coursemc user-43=opaiscyx user-44=accooper user-45=ianrayne user-46=connectedshoppin user-47=thqkgnbz
Sep  4 12:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=milloyco user-49=gilpin user-50=elecleis user-51=hubmaster user-52=putterfi user-53=carsinyo user-54=fetch user-55=bedfords user-56=ggaaorgu user-57=belle user-58=newstoda user-59=bemadonn user-60=brighto1 user-61=nstriton user-62=firstre2 user-63=vivienn1 user-64=battlere user-65=oneoarco user-66=innovat1 user-67=askhform user-68=stuartge user-69=nativene user-70=alexadmin user-71=skyfirec user-72=bwppodcast user-73=zebrapho user-74=steve user-75=sibtoncc user-76=asandcoc user-77=beauty user-78=eatspam user-79=darkstar user-80=dhyana user-81=burydropin user-82=fawcettd user-83=nsceres user-84=smrszyqg user-85=isleofwi user-86=hidden user-87=nomistakes user-88=barbersh user-89=tigerlet user-90=putterfc user-91=nscdp user-92=fortunaz user-93=health2045 user-94=leftie user-95=foods user-96=lkpier user-97=philmcph user-98=ctedorgu user-99=donnychicago user-100=steakbridieme user-101=firstre5
Sep  4 12:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hirefootballgame user-103=eugincou user-104=courseme user-105=cathski user-106=cambria1 user-107=reliable user-108=ninejimm user-109=pugwash user-110=paulmca1 user-111=howardon user-112=cwsocial user-113=chrisdal user-114=mcdermos user-115=nbhavers user-116=careers user-117=david user-118=tomandle user-119=jennimil user-120=hodgsonmail user-121=ranxterc user-122=outdoorc user-123=branko user-124=romaldki user-125=attlebor user-126=lucy user-127=onlycont user-128=bakery user-129=sosevalu user-130=crrtipdl user-131=nove user-132=boldover user-133=ladburyp user-134=stagingerris user-135=dancinggardener user-136=kategilpin user-137=design user-138=oubpgvbx user-139=tstardom user-140=what user-141=cath user-142=sketchy user-143=havantho user-144=nvihkvu feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 12:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 12:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:28 nativespace-cdp sudo[2145445]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:28 nativespace-cdp sudo[2145455]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-khEtQulsvalQWOC9.~
Sep  4 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:28 nativespace-cdp sudo[2145460]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-khEtQulsvalQWOC9.~'
Sep  4 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:28 nativespace-cdp sudo[2145464]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-khEtQulsvalQWOC9.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:28 nativespace-cdp sudo[2145470]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:28 nativespace-cdp sudo[2145475]: pam_unix(sudo:session): session closed for user root
Sep  4 12:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 12:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 12:09:33 nativespace-cdp sudo[2145512]: pam_unix(sudo:session): session closed for user root
Sep  4 12:11:33 nativespace-cdp sshd[2146311]: Connection closed by 159.100.136.21 port 54806 [preauth]
Sep  4 12:16:33 nativespace-cdp sshd[2147909]: Connection closed by 159.100.136.21 port 36824 [preauth]
Sep  4 12:21:33 nativespace-cdp sshd[2149133]: Connection closed by 159.100.136.21 port 45626 [preauth]
Sep  4 12:26:33 nativespace-cdp sshd[2150314]: Connection closed by 159.100.136.21 port 55938 [preauth]
Sep  4 12:31:33 nativespace-cdp sshd[2151908]: Connection closed by 159.100.136.21 port 37794 [preauth]
Sep  4 12:36:33 nativespace-cdp sshd[2153140]: Connection closed by 159.100.136.21 port 48130 [preauth]
Sep  4 12:41:33 nativespace-cdp sshd[2154750]: Connection closed by 159.100.136.21 port 58132 [preauth]
Sep  4 12:46:33 nativespace-cdp sshd[2156280]: Connection closed by 159.100.136.21 port 40160 [preauth]
Sep  4 12:51:33 nativespace-cdp sshd[2157622]: Connection closed by 159.100.136.21 port 50170 [preauth]
Sep  4 12:56:33 nativespace-cdp sshd[2158994]: Connection closed by 159.100.136.21 port 60486 [preauth]
Sep  4 13:01:33 nativespace-cdp sshd[2160311]: Connection closed by 159.100.136.21 port 42286 [preauth]
Sep  4 13:06:34 nativespace-cdp sshd[2161471]: Connection closed by 159.100.136.21 port 52634 [preauth]
Sep  4 13:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 13:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:43 nativespace-cdp sudo[2162505]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 13:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:43 nativespace-cdp sudo[2162510]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 13:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:51 nativespace-cdp sudo[2162516]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 13:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:51 nativespace-cdp sudo[2162548]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 13:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:57 nativespace-cdp sudo[2162554]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 13:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:58 nativespace-cdp sudo[2162655]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 13:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:58 nativespace-cdp sudo[2162665]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 13:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:58 nativespace-cdp sudo[2162672]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 13:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:58 nativespace-cdp sudo[2162677]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 13:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:58 nativespace-cdp sudo[2162688]: pam_unix(sudo:session): session closed for user root
Sep  4 13:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 13:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:09:58 nativespace-cdp sudo[2162697]: pam_unix(sudo:session): session closed for user root
Sep  4 13:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 13:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:10:03 nativespace-cdp sudo[2162879]: pam_unix(sudo:session): session closed for user root
Sep  4 13:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 13:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:10:08 nativespace-cdp sudo[2162919]: pam_unix(sudo:session): session closed for user root
Sep  4 13:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=romaldki user-2=branko user-3=outdoorc user-4=ranxterc user-5=hodgsonmail user-6=onlycont user-7=attlebor user-8=lucy user-9=careers user-10=nbhavers user-11=david user-12=mcdermos user-13=chrisdal user-14=jennimil user-15=tomandle user-16=design user-17=kategilpin user-18=ladburyp user-19=stagingerris user-20=dancinggardener user-21=nvihkvu user-22=cath user-23=sketchy user-24=havantho user-25=what user-26=oubpgvbx user-27=tstardom user-28=sosevalu user-29=crrtipdl user-30=bakery user-31=boldover user-32=nove user-33=dhyana user-34=eatspam user-35=darkstar user-36=beauty user-37=nsceres user-38=burydropin user-39=fawcettd user-40=steve user-41=zebrapho user-42=bwppodcast user-43=asandcoc user-44=sibtoncc user-45=courseme user-46=eugincou user-47=hirefootballgame user-48=paulmca1 user-49=pugwash
Sep  4 13:10:08 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=howardon user-51=cwsocial user-52=reliable user-53=ninejimm user-54=cambria1 user-55=cathski user-56=tigerlet user-57=barbersh user-58=hidden user-59=nomistakes user-60=smrszyqg user-61=isleofwi user-62=ctedorgu user-63=philmcph user-64=steakbridieme user-65=donnychicago user-66=firstre5 user-67=lkpier user-68=fortunaz user-69=health2045 user-70=leftie user-71=foods user-72=putterfc user-73=nscdp user-74=thqkgnbz user-75=connectedshoppin user-76=ianrayne user-77=accooper user-78=carsinyo user-79=fetch user-80=hubmaster user-81=putterfi user-82=elecleis user-83=gilpin user-84=milloyco user-85=southlon user-86=highlegh user-87=firstred user-88=costestimatorco user-89=clarkass user-90=firstrel user-91=coursemc user-92=opaiscyx user-93=firstres user-94=seftvta user-95=jonhartl user-96=ultbcrra user-97=nativene user-98=askhform user-99=stuartge user-100=innovat1 user-101=alexadmin user-102=skyfirec
Sep  4 13:10:08 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bemadonn user-104=ggaaorgu user-105=belle user-106=newstoda user-107=bedfords user-108=battlere user-109=oneoarco user-110=firstre2 user-111=vivienn1 user-112=brighto1 user-113=nstriton user-114=leereyn1 user-115=stephani user-116=still user-117=agproduc user-118=theblack user-119=hodgesonweb user-120=spectrum user-121=jarvisin user-122=ulsukarm user-123=maflemin user-124=lbscrmod user-125=connect9 user-126=athenare user-127=vantagep user-128=booff user-129=markward user-130=foundation user-131=magichat user-132=lbhyisi user-133=hhdugcor user-134=ptkxhsbt user-135=dickemery123 user-136=martsblo user-137=musorguk user-138=megacards user-139=wilsonsw user-140=sarafoundation user-141=atestord user-142=strathar user-143=brmrjxl user-144=lakesan1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 13:10:08 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 13:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:10:10 nativespace-cdp sudo[2163014]: pam_unix(sudo:session): session closed for user root
Sep  4 13:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 13:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:10:10 nativespace-cdp sudo[2163029]: pam_unix(sudo:session): session closed for user root
Sep  4 13:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4y307oc8Gm3Ey85h.~
Sep  4 13:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:10:10 nativespace-cdp sudo[2163034]: pam_unix(sudo:session): session closed for user root
Sep  4 13:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4y307oc8Gm3Ey85h.~'
Sep  4 13:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:10:10 nativespace-cdp sudo[2163037]: pam_unix(sudo:session): session closed for user root
Sep  4 13:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4y307oc8Gm3Ey85h.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 13:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:10:10 nativespace-cdp sudo[2163042]: pam_unix(sudo:session): session closed for user root
Sep  4 13:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 13:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:10:11 nativespace-cdp sudo[2163045]: pam_unix(sudo:session): session closed for user root
Sep  4 13:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 13:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 13:10:33 nativespace-cdp sudo[2163221]: pam_unix(sudo:session): session closed for user root
Sep  4 13:11:33 nativespace-cdp sshd[2163713]: Connection closed by 159.100.136.21 port 34402 [preauth]
Sep  4 13:16:33 nativespace-cdp sshd[2167141]: Connection closed by 159.100.136.21 port 44656 [preauth]
Sep  4 13:21:33 nativespace-cdp sshd[2171363]: Connection closed by 159.100.136.21 port 54680 [preauth]
Sep  4 13:26:33 nativespace-cdp sshd[2173285]: Connection closed by 159.100.136.21 port 36734 [preauth]
Sep  4 13:31:33 nativespace-cdp sshd[2174683]: Connection closed by 159.100.136.21 port 46800 [preauth]
Sep  4 13:36:33 nativespace-cdp sshd[2176112]: Connection closed by 159.100.136.21 port 57108 [preauth]
Sep  4 13:41:33 nativespace-cdp sshd[2177554]: Connection closed by 159.100.136.21 port 38870 [preauth]
Sep  4 13:46:33 nativespace-cdp sshd[2178780]: Connection closed by 159.100.136.21 port 49146 [preauth]
Sep  4 13:51:33 nativespace-cdp sshd[2179980]: Connection closed by 159.100.136.21 port 59148 [preauth]
Sep  4 13:56:33 nativespace-cdp sshd[2181357]: Connection closed by 159.100.136.21 port 41198 [preauth]
Sep  4 13:58:30 nativespace-cdp sshd[2181783]: Invalid user nilay from 58.8.0.82 port 49212
Sep  4 13:58:30 nativespace-cdp sshd[2181783]: input_userauth_request: invalid user nilay [preauth]
Sep  4 13:58:30 nativespace-cdp sshd[2181783]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 13:58:30 nativespace-cdp sshd[2181783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.8.0.82
Sep  4 13:58:32 nativespace-cdp sshd[2181783]: Failed password for invalid user nilay from 58.8.0.82 port 49212 ssh2
Sep  4 13:58:32 nativespace-cdp sshd[2181783]: Received disconnect from 58.8.0.82 port 49212:11: Bye Bye [preauth]
Sep  4 13:58:32 nativespace-cdp sshd[2181783]: Disconnected from 58.8.0.82 port 49212 [preauth]
Sep  4 14:01:33 nativespace-cdp sshd[2182639]: Connection closed by 159.100.136.21 port 51200 [preauth]
Sep  4 14:02:34 nativespace-cdp sshd[2182880]: Invalid user ftp_user from 58.8.0.82 port 51434
Sep  4 14:02:34 nativespace-cdp sshd[2182880]: input_userauth_request: invalid user ftp_user [preauth]
Sep  4 14:02:34 nativespace-cdp sshd[2182880]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:02:34 nativespace-cdp sshd[2182880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.8.0.82
Sep  4 14:02:35 nativespace-cdp sshd[2182880]: Failed password for invalid user ftp_user from 58.8.0.82 port 51434 ssh2
Sep  4 14:02:35 nativespace-cdp sshd[2182880]: Received disconnect from 58.8.0.82 port 51434:11: Bye Bye [preauth]
Sep  4 14:02:35 nativespace-cdp sshd[2182880]: Disconnected from 58.8.0.82 port 51434 [preauth]
Sep  4 14:02:56 nativespace-cdp sshd[2182937]: Invalid user admin from 181.115.146.26 port 52928
Sep  4 14:02:56 nativespace-cdp sshd[2182937]: input_userauth_request: invalid user admin [preauth]
Sep  4 14:02:56 nativespace-cdp sshd[2182937]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:02:56 nativespace-cdp sshd[2182937]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.115.146.26
Sep  4 14:02:58 nativespace-cdp sshd[2182937]: Failed password for invalid user admin from 181.115.146.26 port 52928 ssh2
Sep  4 14:02:58 nativespace-cdp sshd[2182937]: Received disconnect from 181.115.146.26 port 52928:11: Bye Bye [preauth]
Sep  4 14:02:58 nativespace-cdp sshd[2182937]: Disconnected from 181.115.146.26 port 52928 [preauth]
Sep  4 14:03:00 nativespace-cdp sshd[2182953]: Invalid user sml from 58.8.0.82 port 45930
Sep  4 14:03:00 nativespace-cdp sshd[2182953]: input_userauth_request: invalid user sml [preauth]
Sep  4 14:03:00 nativespace-cdp sshd[2182953]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:03:00 nativespace-cdp sshd[2182953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.8.0.82
Sep  4 14:03:03 nativespace-cdp sshd[2182953]: Failed password for invalid user sml from 58.8.0.82 port 45930 ssh2
Sep  4 14:03:03 nativespace-cdp sshd[2182953]: Received disconnect from 58.8.0.82 port 45930:11: Bye Bye [preauth]
Sep  4 14:03:03 nativespace-cdp sshd[2182953]: Disconnected from 58.8.0.82 port 45930 [preauth]
Sep  4 14:04:44 nativespace-cdp sshd[2183303]: Invalid user ste from 23.94.38.86 port 35340
Sep  4 14:04:44 nativespace-cdp sshd[2183303]: input_userauth_request: invalid user ste [preauth]
Sep  4 14:04:44 nativespace-cdp sshd[2183303]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:04:44 nativespace-cdp sshd[2183303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.94.38.86
Sep  4 14:04:46 nativespace-cdp sshd[2183303]: Failed password for invalid user ste from 23.94.38.86 port 35340 ssh2
Sep  4 14:04:46 nativespace-cdp sshd[2183303]: Received disconnect from 23.94.38.86 port 35340:11: Bye Bye [preauth]
Sep  4 14:04:46 nativespace-cdp sshd[2183303]: Disconnected from 23.94.38.86 port 35340 [preauth]
Sep  4 14:05:46 nativespace-cdp sshd[2183629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.10.178.118  user=root
Sep  4 14:05:46 nativespace-cdp sshd[2183629]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 14:05:47 nativespace-cdp sshd[2183629]: Failed password for root from 119.10.178.118 port 12208 ssh2
Sep  4 14:05:48 nativespace-cdp sshd[2183629]: Received disconnect from 119.10.178.118 port 12208:11: Bye Bye [preauth]
Sep  4 14:05:48 nativespace-cdp sshd[2183629]: Disconnected from 119.10.178.118 port 12208 [preauth]
Sep  4 14:06:33 nativespace-cdp sshd[2183773]: Connection closed by 159.100.136.21 port 33296 [preauth]
Sep  4 14:06:39 nativespace-cdp sshd[2183786]: Invalid user desktop from 51.91.249.38 port 39112
Sep  4 14:06:39 nativespace-cdp sshd[2183786]: input_userauth_request: invalid user desktop [preauth]
Sep  4 14:06:39 nativespace-cdp sshd[2183786]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:06:39 nativespace-cdp sshd[2183786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.249.38
Sep  4 14:06:41 nativespace-cdp sshd[2183786]: Failed password for invalid user desktop from 51.91.249.38 port 39112 ssh2
Sep  4 14:06:41 nativespace-cdp sshd[2183786]: Received disconnect from 51.91.249.38 port 39112:11: Bye Bye [preauth]
Sep  4 14:06:41 nativespace-cdp sshd[2183786]: Disconnected from 51.91.249.38 port 39112 [preauth]
Sep  4 14:07:04 nativespace-cdp sshd[2183862]: Invalid user nina from 23.94.38.86 port 35410
Sep  4 14:07:04 nativespace-cdp sshd[2183862]: input_userauth_request: invalid user nina [preauth]
Sep  4 14:07:04 nativespace-cdp sshd[2183862]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:07:04 nativespace-cdp sshd[2183862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.94.38.86
Sep  4 14:07:06 nativespace-cdp sshd[2183862]: Failed password for invalid user nina from 23.94.38.86 port 35410 ssh2
Sep  4 14:07:07 nativespace-cdp sshd[2183862]: Received disconnect from 23.94.38.86 port 35410:11: Bye Bye [preauth]
Sep  4 14:07:07 nativespace-cdp sshd[2183862]: Disconnected from 23.94.38.86 port 35410 [preauth]
Sep  4 14:07:36 nativespace-cdp sshd[2184031]: Invalid user stoyan from 51.91.249.38 port 50554
Sep  4 14:07:36 nativespace-cdp sshd[2184031]: input_userauth_request: invalid user stoyan [preauth]
Sep  4 14:07:36 nativespace-cdp sshd[2184031]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:07:36 nativespace-cdp sshd[2184031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.249.38
Sep  4 14:07:38 nativespace-cdp sshd[2184031]: Failed password for invalid user stoyan from 51.91.249.38 port 50554 ssh2
Sep  4 14:07:38 nativespace-cdp sshd[2184031]: Received disconnect from 51.91.249.38 port 50554:11: Bye Bye [preauth]
Sep  4 14:07:38 nativespace-cdp sshd[2184031]: Disconnected from 51.91.249.38 port 50554 [preauth]
Sep  4 14:07:47 nativespace-cdp sshd[2184079]: Invalid user kathleen from 181.115.146.26 port 41004
Sep  4 14:07:47 nativespace-cdp sshd[2184079]: input_userauth_request: invalid user kathleen [preauth]
Sep  4 14:07:47 nativespace-cdp sshd[2184079]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:07:47 nativespace-cdp sshd[2184079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.115.146.26
Sep  4 14:07:48 nativespace-cdp sshd[2184086]: Invalid user aap from 23.94.38.86 port 35462
Sep  4 14:07:48 nativespace-cdp sshd[2184086]: input_userauth_request: invalid user aap [preauth]
Sep  4 14:07:48 nativespace-cdp sshd[2184086]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:07:48 nativespace-cdp sshd[2184086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.94.38.86
Sep  4 14:07:49 nativespace-cdp sshd[2184079]: Failed password for invalid user kathleen from 181.115.146.26 port 41004 ssh2
Sep  4 14:07:49 nativespace-cdp sshd[2184079]: Received disconnect from 181.115.146.26 port 41004:11: Bye Bye [preauth]
Sep  4 14:07:49 nativespace-cdp sshd[2184079]: Disconnected from 181.115.146.26 port 41004 [preauth]
Sep  4 14:07:50 nativespace-cdp sshd[2184086]: Failed password for invalid user aap from 23.94.38.86 port 35462 ssh2
Sep  4 14:07:50 nativespace-cdp sshd[2184086]: Received disconnect from 23.94.38.86 port 35462:11: Bye Bye [preauth]
Sep  4 14:07:50 nativespace-cdp sshd[2184086]: Disconnected from 23.94.38.86 port 35462 [preauth]
Sep  4 14:08:20 nativespace-cdp sshd[2184225]: Invalid user cif from 119.10.178.118 port 13180
Sep  4 14:08:20 nativespace-cdp sshd[2184225]: input_userauth_request: invalid user cif [preauth]
Sep  4 14:08:20 nativespace-cdp sshd[2184225]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:08:20 nativespace-cdp sshd[2184225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.10.178.118
Sep  4 14:08:20 nativespace-cdp sshd[2184232]: Invalid user crodrigo from 51.91.249.38 port 38448
Sep  4 14:08:20 nativespace-cdp sshd[2184232]: input_userauth_request: invalid user crodrigo [preauth]
Sep  4 14:08:20 nativespace-cdp sshd[2184232]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:08:20 nativespace-cdp sshd[2184232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.249.38
Sep  4 14:08:22 nativespace-cdp sshd[2184225]: Failed password for invalid user cif from 119.10.178.118 port 13180 ssh2
Sep  4 14:08:22 nativespace-cdp sshd[2184225]: Received disconnect from 119.10.178.118 port 13180:11: Bye Bye [preauth]
Sep  4 14:08:22 nativespace-cdp sshd[2184225]: Disconnected from 119.10.178.118 port 13180 [preauth]
Sep  4 14:08:22 nativespace-cdp sshd[2184232]: Failed password for invalid user crodrigo from 51.91.249.38 port 38448 ssh2
Sep  4 14:08:22 nativespace-cdp sshd[2184232]: Received disconnect from 51.91.249.38 port 38448:11: Bye Bye [preauth]
Sep  4 14:08:22 nativespace-cdp sshd[2184232]: Disconnected from 51.91.249.38 port 38448 [preauth]
Sep  4 14:08:46 nativespace-cdp sshd[2184325]: Invalid user guara from 181.115.146.26 port 47568
Sep  4 14:08:46 nativespace-cdp sshd[2184325]: input_userauth_request: invalid user guara [preauth]
Sep  4 14:08:46 nativespace-cdp sshd[2184325]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 14:08:46 nativespace-cdp sshd[2184325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.115.146.26
Sep  4 14:08:48 nativespace-cdp sshd[2184325]: Failed password for invalid user guara from 181.115.146.26 port 47568 ssh2
Sep  4 14:09:15 nativespace-cdp sshd[2184452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.10.178.118  user=root
Sep  4 14:09:15 nativespace-cdp sshd[2184452]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 14:09:18 nativespace-cdp sshd[2184452]: Failed password for root from 119.10.178.118 port 7290 ssh2
Sep  4 14:09:18 nativespace-cdp sshd[2184452]: Received disconnect from 119.10.178.118 port 7290:11: Bye Bye [preauth]
Sep  4 14:09:18 nativespace-cdp sshd[2184452]: Disconnected from 119.10.178.118 port 7290 [preauth]
Sep  4 14:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 14:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:29 nativespace-cdp sudo[2184520]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 14:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:29 nativespace-cdp sudo[2184525]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 14:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:31 nativespace-cdp sudo[2184530]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 14:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:31 nativespace-cdp sudo[2184540]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 14:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:34 nativespace-cdp sudo[2184546]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 14:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:34 nativespace-cdp sudo[2184561]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 14:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:34 nativespace-cdp sudo[2184566]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 14:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:34 nativespace-cdp sudo[2184570]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 14:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:34 nativespace-cdp sudo[2184574]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 14:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:34 nativespace-cdp sudo[2184582]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 14:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:35 nativespace-cdp sudo[2184587]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 14:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:37 nativespace-cdp sudo[2184598]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 14:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:38 nativespace-cdp sudo[2184606]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=wilsonsw user-2=megacards user-3=musorguk user-4=brmrjxl user-5=lakesan1 user-6=strathar user-7=atestord user-8=sarafoundation user-9=hhdugcor user-10=lbhyisi user-11=magichat user-12=martsblo user-13=dickemery123 user-14=ptkxhsbt user-15=ulsukarm user-16=foundation user-17=booff user-18=markward user-19=vantagep user-20=athenare user-21=connect9 user-22=lbscrmod user-23=maflemin user-24=agproduc user-25=still user-26=stephani user-27=leereyn1 user-28=jarvisin user-29=spectrum user-30=theblack user-31=hodgesonweb user-32=bedfords user-33=newstoda user-34=belle user-35=ggaaorgu user-36=bemadonn user-37=nstriton user-38=brighto1 user-39=vivienn1 user-40=firstre2 user-41=oneoarco user-42=battlere user-43=innovat1 user-44=stuartge user-45=askhform user-46=nativene user-47=alexadmin user-48=skyfirec
Sep  4 14:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=clarkass user-50=firstrel user-51=costestimatorco user-52=firstred user-53=highlegh user-54=southlon user-55=ultbcrra user-56=jonhartl user-57=seftvta user-58=firstres user-59=coursemc user-60=opaiscyx user-61=accooper user-62=ianrayne user-63=connectedshoppin user-64=thqkgnbz user-65=milloyco user-66=gilpin user-67=elecleis user-68=putterfi user-69=hubmaster user-70=fetch user-71=carsinyo user-72=isleofwi user-73=smrszyqg user-74=nomistakes user-75=hidden user-76=tigerlet user-77=barbersh user-78=nscdp user-79=putterfc user-80=leftie user-81=foods user-82=fortunaz user-83=health2045 user-84=lkpier user-85=donnychicago user-86=steakbridieme user-87=firstre5 user-88=philmcph user-89=ctedorgu user-90=hirefootballgame user-91=eugincou user-92=courseme user-93=cambria1 user-94=cathski user-95=reliable user-96=ninejimm user-97=cwsocial user-98=howardon user-99=paulmca1 user-100=pugwash user-101=bwppodcast
Sep  4 14:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=zebrapho user-103=steve user-104=sibtoncc user-105=asandcoc user-106=beauty user-107=darkstar user-108=eatspam user-109=dhyana user-110=fawcettd user-111=burydropin user-112=nsceres user-113=bakery user-114=crrtipdl user-115=sosevalu user-116=nove user-117=boldover user-118=dancinggardener user-119=stagingerris user-120=ladburyp user-121=kategilpin user-122=design user-123=oubpgvbx user-124=tstardom user-125=what user-126=havantho user-127=sketchy user-128=cath user-129=nvihkvu user-130=chrisdal user-131=mcdermos user-132=david user-133=nbhavers user-134=careers user-135=tomandle user-136=jennimil user-137=hodgsonmail user-138=ranxterc user-139=outdoorc user-140=branko user-141=romaldki user-142=lucy user-143=attlebor user-144=onlycont feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 14:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 14:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:40 nativespace-cdp sudo[2184621]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:40 nativespace-cdp sudo[2184631]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5GNO3q67wFNCh6i7.~
Sep  4 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:40 nativespace-cdp sudo[2184637]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5GNO3q67wFNCh6i7.~'
Sep  4 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:40 nativespace-cdp sudo[2184641]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5GNO3q67wFNCh6i7.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:40 nativespace-cdp sudo[2184647]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:40 nativespace-cdp sudo[2184652]: pam_unix(sudo:session): session closed for user root
Sep  4 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 14:09:42 nativespace-cdp sudo[2184674]: pam_unix(sudo:session): session closed for user root
Sep  4 14:11:33 nativespace-cdp sshd[2185335]: Connection closed by 159.100.136.21 port 43308 [preauth]
Sep  4 14:16:33 nativespace-cdp sshd[2186722]: Connection closed by 159.100.136.21 port 53506 [preauth]
Sep  4 14:21:33 nativespace-cdp sshd[2187978]: Connection closed by 159.100.136.21 port 35296 [preauth]
Sep  4 14:26:33 nativespace-cdp sshd[2189424]: Connection closed by 159.100.136.21 port 45594 [preauth]
Sep  4 14:31:33 nativespace-cdp sshd[2190762]: Connection closed by 159.100.136.21 port 55672 [preauth]
Sep  4 14:36:33 nativespace-cdp sshd[2192441]: Connection closed by 159.100.136.21 port 37768 [preauth]
Sep  4 14:41:33 nativespace-cdp sshd[2193552]: Connection closed by 159.100.136.21 port 47756 [preauth]
Sep  4 14:46:33 nativespace-cdp sshd[2194976]: Connection closed by 159.100.136.21 port 58014 [preauth]
Sep  4 14:51:33 nativespace-cdp sshd[2196092]: Connection closed by 159.100.136.21 port 39826 [preauth]
Sep  4 14:56:33 nativespace-cdp sshd[2197456]: Connection closed by 159.100.136.21 port 49416 [preauth]
Sep  4 15:01:35 nativespace-cdp sshd[2198828]: Connection closed by 159.100.136.21 port 59360 [preauth]
Sep  4 15:06:34 nativespace-cdp sshd[2199879]: Connection closed by 159.100.136.21 port 40982 [preauth]
Sep  4 15:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 15:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:30 nativespace-cdp sudo[2200641]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 15:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:30 nativespace-cdp sudo[2200647]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 15:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:32 nativespace-cdp sudo[2200652]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 15:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:32 nativespace-cdp sudo[2200660]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 15:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:35 nativespace-cdp sudo[2200666]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:35 nativespace-cdp sudo[2200681]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:35 nativespace-cdp sudo[2200686]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:35 nativespace-cdp sudo[2200690]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:35 nativespace-cdp sudo[2200695]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:35 nativespace-cdp sudo[2200701]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:35 nativespace-cdp sudo[2200707]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 15:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:37 nativespace-cdp sudo[2200719]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 15:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:39 nativespace-cdp sudo[2200727]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bedfords user-2=ggaaorgu user-3=belle user-4=newstoda user-5=bemadonn user-6=brighto1 user-7=nstriton user-8=firstre2 user-9=vivienn1 user-10=battlere user-11=oneoarco user-12=innovat1 user-13=askhform user-14=stuartge user-15=nativene user-16=skyfirec user-17=alexadmin user-18=firstrel user-19=clarkass user-20=costestimatorco user-21=firstred user-22=southlon user-23=highlegh user-24=seftvta user-25=jonhartl user-26=ultbcrra user-27=firstres user-28=opaiscyx user-29=coursemc user-30=accooper user-31=ianrayne user-32=connectedshoppin user-33=thqkgnbz user-34=gilpin user-35=milloyco user-36=elecleis user-37=putterfi user-38=hubmaster user-39=carsinyo user-40=fetch user-41=wilsonsw user-42=musorguk user-43=megacards user-44=brmrjxl user-45=lakesan1 user-46=strathar user-47=sarafoundation
Sep  4 15:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=atestord user-49=lbhyisi user-50=hhdugcor user-51=magichat user-52=martsblo user-53=dickemery123 user-54=ptkxhsbt user-55=ulsukarm user-56=markward user-57=booff user-58=foundation user-59=connect9 user-60=athenare user-61=vantagep user-62=maflemin user-63=lbscrmod user-64=still user-65=agproduc user-66=stephani user-67=leereyn1 user-68=jarvisin user-69=spectrum user-70=hodgesonweb user-71=theblack user-72=bakery user-73=sosevalu user-74=crrtipdl user-75=nove user-76=boldover user-77=ladburyp user-78=dancinggardener user-79=stagingerris user-80=kategilpin user-81=design user-82=oubpgvbx user-83=tstardom user-84=what user-85=cath user-86=sketchy user-87=havantho user-88=nvihkvu user-89=chrisdal user-90=mcdermos user-91=nbhavers user-92=careers user-93=david user-94=tomandle user-95=jennimil user-96=outdoorc user-97=hodgsonmail user-98=ranxterc user-99=branko user-100=romaldki user-101=attlebor
Sep  4 15:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=lucy user-103=onlycont user-104=smrszyqg user-105=isleofwi user-106=hidden user-107=nomistakes user-108=barbersh user-109=tigerlet user-110=putterfc user-111=nscdp user-112=health2045 user-113=fortunaz user-114=leftie user-115=foods user-116=lkpier user-117=philmcph user-118=ctedorgu user-119=donnychicago user-120=steakbridieme user-121=firstre5 user-122=hirefootballgame user-123=eugincou user-124=courseme user-125=cambria1 user-126=cathski user-127=ninejimm user-128=reliable user-129=pugwash user-130=howardon user-131=paulmca1 user-132=cwsocial user-133=bwppodcast user-134=zebrapho user-135=steve user-136=sibtoncc user-137=asandcoc user-138=beauty user-139=eatspam user-140=darkstar user-141=dhyana user-142=burydropin user-143=fawcettd user-144=nsceres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 15:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:40 nativespace-cdp sudo[2200741]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:41 nativespace-cdp sudo[2200751]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-e9PUMZAJH5baovqC.~
Sep  4 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:41 nativespace-cdp sudo[2200757]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-e9PUMZAJH5baovqC.~'
Sep  4 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:41 nativespace-cdp sudo[2200762]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-e9PUMZAJH5baovqC.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:41 nativespace-cdp sudo[2200768]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:41 nativespace-cdp sudo[2200773]: pam_unix(sudo:session): session closed for user root
Sep  4 15:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 15:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 15:09:53 nativespace-cdp sudo[2200816]: pam_unix(sudo:session): session closed for user root
Sep  4 15:11:33 nativespace-cdp sshd[2201495]: Connection closed by 159.100.136.21 port 51014 [preauth]
Sep  4 15:16:33 nativespace-cdp sshd[2202786]: Connection closed by 159.100.136.21 port 33030 [preauth]
Sep  4 15:21:33 nativespace-cdp sshd[2204026]: Connection closed by 159.100.136.21 port 43002 [preauth]
Sep  4 15:26:33 nativespace-cdp sshd[2205103]: Connection closed by 159.100.136.21 port 53320 [preauth]
Sep  4 15:31:33 nativespace-cdp sshd[2206647]: Connection closed by 159.100.136.21 port 35116 [preauth]
Sep  4 15:34:22 nativespace-cdp sshd[2207300]: Invalid user prueba from 47.234.143.55 port 59644
Sep  4 15:34:22 nativespace-cdp sshd[2207300]: input_userauth_request: invalid user prueba [preauth]
Sep  4 15:34:22 nativespace-cdp sshd[2207300]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 15:34:22 nativespace-cdp sshd[2207300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.234.143.55
Sep  4 15:34:24 nativespace-cdp sshd[2207300]: Failed password for invalid user prueba from 47.234.143.55 port 59644 ssh2
Sep  4 15:34:24 nativespace-cdp sshd[2207300]: Received disconnect from 47.234.143.55 port 59644:11: Bye Bye [preauth]
Sep  4 15:34:24 nativespace-cdp sshd[2207300]: Disconnected from 47.234.143.55 port 59644 [preauth]
Sep  4 15:36:33 nativespace-cdp sshd[2207837]: Connection closed by 159.100.136.21 port 45436 [preauth]
Sep  4 15:37:44 nativespace-cdp sshd[2208083]: Invalid user jerry from 47.234.143.55 port 33092
Sep  4 15:37:44 nativespace-cdp sshd[2208083]: input_userauth_request: invalid user jerry [preauth]
Sep  4 15:37:44 nativespace-cdp sshd[2208083]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 15:37:44 nativespace-cdp sshd[2208083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.234.143.55
Sep  4 15:37:45 nativespace-cdp sshd[2208083]: Failed password for invalid user jerry from 47.234.143.55 port 33092 ssh2
Sep  4 15:37:46 nativespace-cdp sshd[2208083]: Received disconnect from 47.234.143.55 port 33092:11: Bye Bye [preauth]
Sep  4 15:37:46 nativespace-cdp sshd[2208083]: Disconnected from 47.234.143.55 port 33092 [preauth]
Sep  4 15:38:31 nativespace-cdp sshd[2208343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.234.143.55  user=root
Sep  4 15:38:31 nativespace-cdp sshd[2208343]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 15:38:33 nativespace-cdp sshd[2208343]: Failed password for root from 47.234.143.55 port 46368 ssh2
Sep  4 15:38:33 nativespace-cdp sshd[2208343]: Received disconnect from 47.234.143.55 port 46368:11: Bye Bye [preauth]
Sep  4 15:38:33 nativespace-cdp sshd[2208343]: Disconnected from 47.234.143.55 port 46368 [preauth]
Sep  4 15:41:33 nativespace-cdp sshd[2209051]: Connection closed by 159.100.136.21 port 55426 [preauth]
Sep  4 15:46:33 nativespace-cdp sshd[2210434]: Connection closed by 159.100.136.21 port 37444 [preauth]
Sep  4 15:51:33 nativespace-cdp sshd[2211987]: Connection closed by 159.100.136.21 port 47438 [preauth]
Sep  4 15:56:33 nativespace-cdp sshd[2213244]: Connection closed by 159.100.136.21 port 57742 [preauth]
Sep  4 16:01:33 nativespace-cdp sshd[2214819]: Connection closed by 159.100.136.21 port 39496 [preauth]
Sep  4 16:06:33 nativespace-cdp sshd[2216091]: Connection closed by 159.100.136.21 port 49862 [preauth]
Sep  4 16:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 16:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:29 nativespace-cdp sudo[2216690]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 16:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:29 nativespace-cdp sudo[2216696]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 16:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:30 nativespace-cdp sudo[2216701]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 16:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:30 nativespace-cdp sudo[2216707]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 16:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:33 nativespace-cdp sudo[2216713]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 16:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:33 nativespace-cdp sudo[2216724]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 16:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:33 nativespace-cdp sudo[2216729]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 16:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:33 nativespace-cdp sudo[2216735]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 16:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:33 nativespace-cdp sudo[2216740]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 16:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:33 nativespace-cdp sudo[2216747]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 16:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:33 nativespace-cdp sudo[2216752]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 16:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:35 nativespace-cdp sudo[2216774]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 16:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:36 nativespace-cdp sudo[2216782]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=agproduc user-2=still user-3=leereyn1 user-4=stephani user-5=jarvisin user-6=theblack user-7=hodgesonweb user-8=spectrum user-9=ulsukarm user-10=booff user-11=markward user-12=foundation user-13=lbscrmod user-14=maflemin user-15=vantagep user-16=athenare user-17=connect9 user-18=hhdugcor user-19=lbhyisi user-20=magichat user-21=martsblo user-22=ptkxhsbt user-23=dickemery123 user-24=wilsonsw user-25=megacards user-26=musorguk user-27=brmrjxl user-28=lakesan1 user-29=atestord user-30=sarafoundation user-31=strathar user-32=ianrayne user-33=accooper user-34=thqkgnbz user-35=connectedshoppin user-36=elecleis user-37=milloyco user-38=gilpin user-39=fetch user-40=carsinyo user-41=hubmaster user-42=putterfi user-43=costestimatorco user-44=firstrel user-45=clarkass user-46=highlegh user-47=southlon
Sep  4 16:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=firstred user-49=firstres user-50=ultbcrra user-51=jonhartl user-52=seftvta user-53=coursemc user-54=opaiscyx user-55=askhform user-56=stuartge user-57=innovat1 user-58=nativene user-59=skyfirec user-60=alexadmin user-61=bedfords user-62=bemadonn user-63=newstoda user-64=belle user-65=ggaaorgu user-66=nstriton user-67=brighto1 user-68=oneoarco user-69=battlere user-70=vivienn1 user-71=firstre2 user-72=darkstar user-73=eatspam user-74=beauty user-75=dhyana user-76=fawcettd user-77=burydropin user-78=nsceres user-79=zebrapho user-80=bwppodcast user-81=steve user-82=asandcoc user-83=sibtoncc user-84=hirefootballgame user-85=courseme user-86=eugincou user-87=reliable user-88=ninejimm user-89=cambria1 user-90=cathski user-91=cwsocial user-92=pugwash user-93=paulmca1 user-94=howardon user-95=smrszyqg user-96=isleofwi user-97=barbersh user-98=tigerlet user-99=nomistakes user-100=hidden user-101=foods
Sep  4 16:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=leftie user-103=fortunaz user-104=health2045 user-105=nscdp user-106=putterfc user-107=donnychicago user-108=steakbridieme user-109=firstre5 user-110=philmcph user-111=ctedorgu user-112=lkpier user-113=branko user-114=ranxterc user-115=hodgsonmail user-116=outdoorc user-117=romaldki user-118=lucy user-119=attlebor user-120=onlycont user-121=mcdermos user-122=chrisdal user-123=david user-124=careers user-125=nbhavers user-126=tomandle user-127=jennimil user-128=kategilpin user-129=stagingerris user-130=dancinggardener user-131=ladburyp user-132=design user-133=what user-134=tstardom user-135=oubpgvbx user-136=nvihkvu user-137=havantho user-138=sketchy user-139=cath user-140=crrtipdl user-141=sosevalu user-142=bakery user-143=nove user-144=boldover feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 16:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 16:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:37 nativespace-cdp sudo[2216789]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:37 nativespace-cdp sudo[2216797]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tNlEjoJPK7XVHmiU.~
Sep  4 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:37 nativespace-cdp sudo[2216802]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tNlEjoJPK7XVHmiU.~'
Sep  4 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:37 nativespace-cdp sudo[2216806]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tNlEjoJPK7XVHmiU.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:37 nativespace-cdp sudo[2216812]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:37 nativespace-cdp sudo[2216817]: pam_unix(sudo:session): session closed for user root
Sep  4 16:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 16:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 16:09:39 nativespace-cdp sudo[2216843]: pam_unix(sudo:session): session closed for user root
Sep  4 16:11:33 nativespace-cdp sshd[2217421]: Connection closed by 159.100.136.21 port 59862 [preauth]
Sep  4 16:16:33 nativespace-cdp sshd[2218757]: Connection closed by 159.100.136.21 port 41876 [preauth]
Sep  4 16:21:16 nativespace-cdp sshd[2219893]: Invalid user sam from 103.217.144.30 port 33302
Sep  4 16:21:16 nativespace-cdp sshd[2219893]: input_userauth_request: invalid user sam [preauth]
Sep  4 16:21:16 nativespace-cdp sshd[2219893]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 16:21:16 nativespace-cdp sshd[2219893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.217.144.30
Sep  4 16:21:18 nativespace-cdp sshd[2219893]: Failed password for invalid user sam from 103.217.144.30 port 33302 ssh2
Sep  4 16:21:18 nativespace-cdp sshd[2219893]: Received disconnect from 103.217.144.30 port 33302:11: Bye Bye [preauth]
Sep  4 16:21:18 nativespace-cdp sshd[2219893]: Disconnected from 103.217.144.30 port 33302 [preauth]
Sep  4 16:21:33 nativespace-cdp sshd[2220134]: Connection closed by 159.100.136.21 port 51832 [preauth]
Sep  4 16:26:15 nativespace-cdp sshd[2221244]: Invalid user andri from 103.217.144.30 port 55710
Sep  4 16:26:15 nativespace-cdp sshd[2221244]: input_userauth_request: invalid user andri [preauth]
Sep  4 16:26:15 nativespace-cdp sshd[2221244]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 16:26:15 nativespace-cdp sshd[2221244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.217.144.30
Sep  4 16:26:17 nativespace-cdp sshd[2221244]: Failed password for invalid user andri from 103.217.144.30 port 55710 ssh2
Sep  4 16:26:17 nativespace-cdp sshd[2221244]: Received disconnect from 103.217.144.30 port 55710:11: Bye Bye [preauth]
Sep  4 16:26:17 nativespace-cdp sshd[2221244]: Disconnected from 103.217.144.30 port 55710 [preauth]
Sep  4 16:26:33 nativespace-cdp sshd[2221301]: Connection closed by 159.100.136.21 port 33896 [preauth]
Sep  4 16:27:16 nativespace-cdp sshd[2221444]: Invalid user tmax from 103.217.144.30 port 39218
Sep  4 16:27:16 nativespace-cdp sshd[2221444]: input_userauth_request: invalid user tmax [preauth]
Sep  4 16:27:16 nativespace-cdp sshd[2221444]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 16:27:16 nativespace-cdp sshd[2221444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.217.144.30
Sep  4 16:27:18 nativespace-cdp sshd[2221444]: Failed password for invalid user tmax from 103.217.144.30 port 39218 ssh2
Sep  4 16:27:19 nativespace-cdp sshd[2221444]: Received disconnect from 103.217.144.30 port 39218:11: Bye Bye [preauth]
Sep  4 16:27:19 nativespace-cdp sshd[2221444]: Disconnected from 103.217.144.30 port 39218 [preauth]
Sep  4 16:31:33 nativespace-cdp sshd[2222829]: Connection closed by 159.100.136.21 port 43956 [preauth]
Sep  4 16:36:33 nativespace-cdp sshd[2223988]: Connection closed by 159.100.136.21 port 54282 [preauth]
Sep  4 16:41:33 nativespace-cdp sshd[2225844]: Connection closed by 159.100.136.21 port 36040 [preauth]
Sep  4 16:46:33 nativespace-cdp sshd[2226997]: Connection closed by 159.100.136.21 port 46268 [preauth]
Sep  4 16:51:33 nativespace-cdp sshd[2228308]: Connection closed by 159.100.136.21 port 56270 [preauth]
Sep  4 16:56:33 nativespace-cdp sshd[2229869]: Connection closed by 159.100.136.21 port 38344 [preauth]
Sep  4 17:01:33 nativespace-cdp sshd[2231270]: Connection closed by 159.100.136.21 port 48360 [preauth]
Sep  4 17:06:33 nativespace-cdp sshd[2232524]: Connection closed by 159.100.136.21 port 58682 [preauth]
Sep  4 17:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 17:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:23 nativespace-cdp sudo[2233385]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 17:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:23 nativespace-cdp sudo[2233389]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 17:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:24 nativespace-cdp sudo[2233395]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 17:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:24 nativespace-cdp sudo[2233401]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 17:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:34 nativespace-cdp sudo[2233407]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 17:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:34 nativespace-cdp sudo[2233445]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 17:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:34 nativespace-cdp sudo[2233451]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 17:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:34 nativespace-cdp sudo[2233455]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 17:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:34 nativespace-cdp sudo[2233460]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 17:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:34 nativespace-cdp sudo[2233465]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 17:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:34 nativespace-cdp sudo[2233472]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 17:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:38 nativespace-cdp sudo[2233486]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 17:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:38 nativespace-cdp sudo[2233492]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=spectrum user-3=theblack user-4=hodgesonweb user-5=still user-6=agproduc user-7=stephani user-8=leereyn1 user-9=markward user-10=booff user-11=foundation user-12=connect9 user-13=athenare user-14=vantagep user-15=maflemin user-16=lbscrmod user-17=ulsukarm user-18=martsblo user-19=dickemery123 user-20=ptkxhsbt user-21=lbhyisi user-22=hhdugcor user-23=magichat user-24=brmrjxl user-25=lakesan1 user-26=strathar user-27=sarafoundation user-28=atestord user-29=wilsonsw user-30=musorguk user-31=megacards user-32=gilpin user-33=milloyco user-34=elecleis user-35=putterfi user-36=hubmaster user-37=carsinyo user-38=fetch user-39=accooper user-40=ianrayne user-41=connectedshoppin user-42=thqkgnbz user-43=seftvta user-44=jonhartl user-45=ultbcrra user-46=firstres user-47=opaiscyx
Sep  4 17:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=coursemc user-49=firstrel user-50=clarkass user-51=costestimatorco user-52=firstred user-53=southlon user-54=highlegh user-55=skyfirec user-56=alexadmin user-57=innovat1 user-58=stuartge user-59=askhform user-60=nativene user-61=brighto1 user-62=nstriton user-63=firstre2 user-64=vivienn1 user-65=battlere user-66=oneoarco user-67=bedfords user-68=belle user-69=ggaaorgu user-70=newstoda user-71=bemadonn user-72=burydropin user-73=fawcettd user-74=nsceres user-75=beauty user-76=eatspam user-77=darkstar user-78=dhyana user-79=asandcoc user-80=sibtoncc user-81=bwppodcast user-82=zebrapho user-83=steve user-84=cambria1 user-85=cathski user-86=ninejimm user-87=reliable user-88=howardon user-89=paulmca1 user-90=pugwash user-91=cwsocial user-92=hirefootballgame user-93=eugincou user-94=courseme user-95=putterfc user-96=nscdp user-97=health2045 user-98=fortunaz user-99=leftie user-100=foods user-101=lkpier
Sep  4 17:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ctedorgu user-103=philmcph user-104=donnychicago user-105=steakbridieme user-106=firstre5 user-107=smrszyqg user-108=isleofwi user-109=hidden user-110=nomistakes user-111=tigerlet user-112=barbersh user-113=attlebor user-114=lucy user-115=onlycont user-116=outdoorc user-117=hodgsonmail user-118=ranxterc user-119=branko user-120=romaldki user-121=tomandle user-122=jennimil user-123=chrisdal user-124=mcdermos user-125=nbhavers user-126=careers user-127=david user-128=oubpgvbx user-129=tstardom user-130=what user-131=cath user-132=sketchy user-133=havantho user-134=nvihkvu user-135=ladburyp user-136=stagingerris user-137=dancinggardener user-138=kategilpin user-139=design user-140=nove user-141=boldover user-142=bakery user-143=sosevalu user-144=crrtipdl feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 17:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 17:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:39 nativespace-cdp sudo[2233503]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 17:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:39 nativespace-cdp sudo[2233511]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Hm12EewnRMtOj7Vp.~
Sep  4 17:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:39 nativespace-cdp sudo[2233516]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Hm12EewnRMtOj7Vp.~'
Sep  4 17:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:39 nativespace-cdp sudo[2233520]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Hm12EewnRMtOj7Vp.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 17:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:39 nativespace-cdp sudo[2233526]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 17:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:39 nativespace-cdp sudo[2233531]: pam_unix(sudo:session): session closed for user root
Sep  4 17:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 17:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 17:09:47 nativespace-cdp sudo[2233571]: pam_unix(sudo:session): session closed for user root
Sep  4 17:11:33 nativespace-cdp sshd[2234024]: Connection closed by 159.100.136.21 port 40452 [preauth]
Sep  4 17:12:46 nativespace-cdp sshd[2234274]: Invalid user scan from 212.233.136.201 port 46412
Sep  4 17:12:46 nativespace-cdp sshd[2234274]: input_userauth_request: invalid user scan [preauth]
Sep  4 17:12:46 nativespace-cdp sshd[2234274]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 17:12:46 nativespace-cdp sshd[2234274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.233.136.201
Sep  4 17:12:48 nativespace-cdp sshd[2234274]: Failed password for invalid user scan from 212.233.136.201 port 46412 ssh2
Sep  4 17:12:49 nativespace-cdp sshd[2234274]: Received disconnect from 212.233.136.201 port 46412:11: Bye Bye [preauth]
Sep  4 17:12:49 nativespace-cdp sshd[2234274]: Disconnected from 212.233.136.201 port 46412 [preauth]
Sep  4 17:15:11 nativespace-cdp sshd[2234915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.35.197.134  user=root
Sep  4 17:15:11 nativespace-cdp sshd[2234915]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 17:15:13 nativespace-cdp sshd[2234915]: Failed password for root from 70.35.197.134 port 51973 ssh2
Sep  4 17:15:13 nativespace-cdp sshd[2234915]: Received disconnect from 70.35.197.134 port 51973:11: Bye Bye [preauth]
Sep  4 17:15:13 nativespace-cdp sshd[2234915]: Disconnected from 70.35.197.134 port 51973 [preauth]
Sep  4 17:15:46 nativespace-cdp sshd[2235056]: Invalid user cheng from 51.68.92.24 port 46218
Sep  4 17:15:46 nativespace-cdp sshd[2235056]: input_userauth_request: invalid user cheng [preauth]
Sep  4 17:15:46 nativespace-cdp sshd[2235056]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 17:15:46 nativespace-cdp sshd[2235056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.92.24
Sep  4 17:15:48 nativespace-cdp sshd[2235056]: Failed password for invalid user cheng from 51.68.92.24 port 46218 ssh2
Sep  4 17:15:48 nativespace-cdp sshd[2235056]: Received disconnect from 51.68.92.24 port 46218:11: Bye Bye [preauth]
Sep  4 17:15:48 nativespace-cdp sshd[2235056]: Disconnected from 51.68.92.24 port 46218 [preauth]
Sep  4 17:16:33 nativespace-cdp sshd[2235248]: Connection closed by 159.100.136.21 port 50692 [preauth]
Sep  4 17:17:13 nativespace-cdp sshd[2235476]: Invalid user jorgen from 103.139.10.66 port 7541
Sep  4 17:17:13 nativespace-cdp sshd[2235476]: input_userauth_request: invalid user jorgen [preauth]
Sep  4 17:17:13 nativespace-cdp sshd[2235476]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 17:17:13 nativespace-cdp sshd[2235476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.139.10.66
Sep  4 17:17:15 nativespace-cdp sshd[2235476]: Failed password for invalid user jorgen from 103.139.10.66 port 7541 ssh2
Sep  4 17:17:15 nativespace-cdp sshd[2235476]: Received disconnect from 103.139.10.66 port 7541:11: Bye Bye [preauth]
Sep  4 17:17:15 nativespace-cdp sshd[2235476]: Disconnected from 103.139.10.66 port 7541 [preauth]
Sep  4 17:18:46 nativespace-cdp sshd[2236057]: Invalid user chirag from 70.35.197.134 port 39346
Sep  4 17:18:46 nativespace-cdp sshd[2236057]: input_userauth_request: invalid user chirag [preauth]
Sep  4 17:18:46 nativespace-cdp sshd[2236057]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 17:18:46 nativespace-cdp sshd[2236057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.35.197.134
Sep  4 17:18:48 nativespace-cdp sshd[2236057]: Failed password for invalid user chirag from 70.35.197.134 port 39346 ssh2
Sep  4 17:18:48 nativespace-cdp sshd[2236057]: Received disconnect from 70.35.197.134 port 39346:11: Bye Bye [preauth]
Sep  4 17:18:48 nativespace-cdp sshd[2236057]: Disconnected from 70.35.197.134 port 39346 [preauth]
Sep  4 17:19:01 nativespace-cdp sshd[2236098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.139.10.66  user=root
Sep  4 17:19:01 nativespace-cdp sshd[2236098]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 17:19:03 nativespace-cdp sshd[2236098]: Failed password for root from 103.139.10.66 port 27550 ssh2
Sep  4 17:19:03 nativespace-cdp sshd[2236098]: Received disconnect from 103.139.10.66 port 27550:11: Bye Bye [preauth]
Sep  4 17:19:03 nativespace-cdp sshd[2236098]: Disconnected from 103.139.10.66 port 27550 [preauth]
Sep  4 17:19:12 nativespace-cdp sshd[2236143]: Invalid user asmon from 51.68.92.24 port 58158
Sep  4 17:19:12 nativespace-cdp sshd[2236143]: input_userauth_request: invalid user asmon [preauth]
Sep  4 17:19:12 nativespace-cdp sshd[2236143]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 17:19:12 nativespace-cdp sshd[2236143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.92.24
Sep  4 17:19:14 nativespace-cdp sshd[2236143]: Failed password for invalid user asmon from 51.68.92.24 port 58158 ssh2
Sep  4 17:19:14 nativespace-cdp sshd[2236143]: Received disconnect from 51.68.92.24 port 58158:11: Bye Bye [preauth]
Sep  4 17:19:14 nativespace-cdp sshd[2236143]: Disconnected from 51.68.92.24 port 58158 [preauth]
Sep  4 17:19:30 nativespace-cdp sshd[2236197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.35.197.134  user=root
Sep  4 17:19:30 nativespace-cdp sshd[2236197]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 17:19:32 nativespace-cdp sshd[2236197]: Failed password for root from 70.35.197.134 port 46203 ssh2
Sep  4 17:19:32 nativespace-cdp sshd[2236197]: Received disconnect from 70.35.197.134 port 46203:11: Bye Bye [preauth]
Sep  4 17:19:32 nativespace-cdp sshd[2236197]: Disconnected from 70.35.197.134 port 46203 [preauth]
Sep  4 17:19:53 nativespace-cdp sshd[2236298]: Invalid user rana from 51.68.92.24 port 60708
Sep  4 17:19:53 nativespace-cdp sshd[2236298]: input_userauth_request: invalid user rana [preauth]
Sep  4 17:19:53 nativespace-cdp sshd[2236298]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 17:19:53 nativespace-cdp sshd[2236298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.92.24
Sep  4 17:19:54 nativespace-cdp sshd[2236298]: Failed password for invalid user rana from 51.68.92.24 port 60708 ssh2
Sep  4 17:19:54 nativespace-cdp sshd[2236298]: Received disconnect from 51.68.92.24 port 60708:11: Bye Bye [preauth]
Sep  4 17:19:54 nativespace-cdp sshd[2236298]: Disconnected from 51.68.92.24 port 60708 [preauth]
Sep  4 17:20:03 nativespace-cdp sshd[2236469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.139.10.66  user=root
Sep  4 17:20:03 nativespace-cdp sshd[2236469]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 17:20:05 nativespace-cdp sshd[2236469]: Failed password for root from 103.139.10.66 port 13224 ssh2
Sep  4 17:21:33 nativespace-cdp sshd[2236883]: Connection closed by 159.100.136.21 port 60668 [preauth]
Sep  4 17:24:04 nativespace-cdp sshd[2237467]: Invalid user kp from 212.233.136.201 port 60386
Sep  4 17:24:04 nativespace-cdp sshd[2237467]: input_userauth_request: invalid user kp [preauth]
Sep  4 17:24:04 nativespace-cdp sshd[2237467]: pam_unix(sshd:auth): check pass; user unknown
Sep  4 17:24:04 nativespace-cdp sshd[2237467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.233.136.201
Sep  4 17:24:06 nativespace-cdp sshd[2237467]: Failed password for invalid user kp from 212.233.136.201 port 60386 ssh2
Sep  4 17:24:06 nativespace-cdp sshd[2237467]: Received disconnect from 212.233.136.201 port 60386:11: Bye Bye [preauth]
Sep  4 17:24:06 nativespace-cdp sshd[2237467]: Disconnected from 212.233.136.201 port 60386 [preauth]
Sep  4 17:25:11 nativespace-cdp sshd[2238267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.233.136.201  user=root
Sep  4 17:25:11 nativespace-cdp sshd[2238267]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  4 17:25:13 nativespace-cdp sshd[2238267]: Failed password for root from 212.233.136.201 port 55552 ssh2
Sep  4 17:25:13 nativespace-cdp sshd[2238267]: Received disconnect from 212.233.136.201 port 55552:11: Bye Bye [preauth]
Sep  4 17:25:13 nativespace-cdp sshd[2238267]: Disconnected from 212.233.136.201 port 55552 [preauth]
Sep  4 17:26:33 nativespace-cdp sshd[2238556]: Connection closed by 159.100.136.21 port 42722 [preauth]
Sep  4 17:31:33 nativespace-cdp sshd[2239842]: Connection closed by 159.100.136.21 port 52792 [preauth]
Sep  4 17:36:33 nativespace-cdp sshd[2241198]: Connection closed by 159.100.136.21 port 34858 [preauth]
Sep  4 17:41:33 nativespace-cdp sshd[2242479]: Connection closed by 159.100.136.21 port 44856 [preauth]
Sep  4 17:46:33 nativespace-cdp sshd[2244170]: Connection closed by 159.100.136.21 port 55094 [preauth]
Sep  4 17:51:33 nativespace-cdp sshd[2245268]: Connection closed by 159.100.136.21 port 36876 [preauth]
Sep  4 17:56:33 nativespace-cdp sshd[2246797]: Connection closed by 159.100.136.21 port 47156 [preauth]
Sep  4 18:01:33 nativespace-cdp sshd[2247985]: Connection closed by 159.100.136.21 port 57156 [preauth]
Sep  4 18:06:33 nativespace-cdp sshd[2249131]: Connection closed by 159.100.136.21 port 39274 [preauth]
Sep  4 18:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 18:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:23 nativespace-cdp sudo[2249706]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 18:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:23 nativespace-cdp sudo[2249710]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 18:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:24 nativespace-cdp sudo[2249715]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 18:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:24 nativespace-cdp sudo[2249721]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 18:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:25 nativespace-cdp sudo[2249727]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 18:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:25 nativespace-cdp sudo[2249736]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 18:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:25 nativespace-cdp sudo[2249741]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 18:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:25 nativespace-cdp sudo[2249746]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 18:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:25 nativespace-cdp sudo[2249752]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 18:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:25 nativespace-cdp sudo[2249757]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 18:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:25 nativespace-cdp sudo[2249763]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 18:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:27 nativespace-cdp sudo[2249784]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 18:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:27 nativespace-cdp sudo[2249790]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=magichat user-2=lbhyisi user-3=hhdugcor user-4=ptkxhsbt user-5=dickemery123 user-6=martsblo user-7=musorguk user-8=megacards user-9=wilsonsw user-10=sarafoundation user-11=atestord user-12=strathar user-13=brmrjxl user-14=lakesan1 user-15=leereyn1 user-16=stephani user-17=still user-18=agproduc user-19=hodgesonweb user-20=theblack user-21=spectrum user-22=jarvisin user-23=ulsukarm user-24=maflemin user-25=lbscrmod user-26=athenare user-27=connect9 user-28=vantagep user-29=booff user-30=markward user-31=foundation user-32=nativene user-33=askhform user-34=stuartge user-35=innovat1 user-36=alexadmin user-37=skyfirec user-38=bemadonn user-39=ggaaorgu user-40=belle user-41=newstoda user-42=bedfords user-43=battlere user-44=oneoarco user-45=firstre2 user-46=vivienn1 user-47=brighto1 user-48=nstriton
Sep  4 18:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=thqkgnbz user-50=connectedshoppin user-51=ianrayne user-52=accooper user-53=carsinyo user-54=fetch user-55=hubmaster user-56=putterfi user-57=elecleis user-58=gilpin user-59=milloyco user-60=southlon user-61=highlegh user-62=firstred user-63=costestimatorco user-64=clarkass user-65=firstrel user-66=opaiscyx user-67=coursemc user-68=firstres user-69=seftvta user-70=jonhartl user-71=ultbcrra user-72=courseme user-73=eugincou user-74=hirefootballgame user-75=pugwash user-76=paulmca1 user-77=howardon user-78=cwsocial user-79=ninejimm user-80=reliable user-81=cambria1 user-82=cathski user-83=barbersh user-84=tigerlet user-85=hidden user-86=nomistakes user-87=isleofwi user-88=smrszyqg user-89=ctedorgu user-90=philmcph user-91=firstre5 user-92=steakbridieme user-93=donnychicago user-94=lkpier user-95=health2045 user-96=fortunaz user-97=leftie user-98=foods user-99=putterfc user-100=nscdp user-101=dhyana
Sep  4 18:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=eatspam user-103=darkstar user-104=beauty user-105=nsceres user-106=burydropin user-107=fawcettd user-108=steve user-109=zebrapho user-110=bwppodcast user-111=asandcoc user-112=sibtoncc user-113=design user-114=kategilpin user-115=ladburyp user-116=stagingerris user-117=dancinggardener user-118=nvihkvu user-119=sketchy user-120=cath user-121=havantho user-122=what user-123=oubpgvbx user-124=tstardom user-125=sosevalu user-126=crrtipdl user-127=bakery user-128=boldover user-129=nove user-130=romaldki user-131=branko user-132=hodgsonmail user-133=outdoorc user-134=ranxterc user-135=onlycont user-136=attlebor user-137=lucy user-138=nbhavers user-139=careers user-140=david user-141=mcdermos user-142=chrisdal user-143=jennimil user-144=tomandle feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 18:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 18:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:28 nativespace-cdp sudo[2249797]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 18:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:28 nativespace-cdp sudo[2249806]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ul8hAyVIv6GLLjH4.~
Sep  4 18:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:28 nativespace-cdp sudo[2249811]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ul8hAyVIv6GLLjH4.~'
Sep  4 18:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:28 nativespace-cdp sudo[2249815]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ul8hAyVIv6GLLjH4.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 18:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:28 nativespace-cdp sudo[2249821]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 18:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:28 nativespace-cdp sudo[2249826]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep  4 18:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:29 nativespace-cdp sudo[2249832]: pam_unix(sudo:session): session closed for user root
Sep  4 18:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 18:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 18:09:30 nativespace-cdp sudo[2249857]: pam_unix(sudo:session): session closed for user root
Sep  4 18:11:33 nativespace-cdp sshd[2250449]: Connection closed by 159.100.136.21 port 49290 [preauth]
Sep  4 18:16:33 nativespace-cdp sshd[2251615]: Connection closed by 159.100.136.21 port 59504 [preauth]
Sep  4 18:21:33 nativespace-cdp sshd[2252911]: Connection closed by 159.100.136.21 port 41274 [preauth]
Sep  4 18:26:33 nativespace-cdp sshd[2254329]: Connection closed by 159.100.136.21 port 51570 [preauth]
Sep  4 18:31:33 nativespace-cdp sshd[2255424]: Connection closed by 159.100.136.21 port 33376 [preauth]
Sep  4 18:36:33 nativespace-cdp sshd[2256487]: Connection closed by 159.100.136.21 port 43704 [preauth]
Sep  4 18:41:33 nativespace-cdp sshd[2257773]: Connection closed by 159.100.136.21 port 53686 [preauth]
Sep  4 18:46:33 nativespace-cdp sshd[2258794]: Connection closed by 159.100.136.21 port 35686 [preauth]
Sep  4 18:51:33 nativespace-cdp sshd[2259960]: Connection closed by 159.100.136.21 port 45704 [preauth]
Sep  4 18:56:33 nativespace-cdp sshd[2261053]: Connection closed by 159.100.136.21 port 56014 [preauth]
Sep  4 19:01:33 nativespace-cdp sshd[2262491]: Connection closed by 159.100.136.21 port 37776 [preauth]
Sep  4 19:06:33 nativespace-cdp sshd[2263681]: Connection closed by 159.100.136.21 port 48096 [preauth]
Sep  4 19:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 19:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:23 nativespace-cdp sudo[2264400]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 19:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:23 nativespace-cdp sudo[2264404]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 19:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:25 nativespace-cdp sudo[2264409]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 19:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:25 nativespace-cdp sudo[2264421]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 19:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:26 nativespace-cdp sudo[2264427]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 19:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:26 nativespace-cdp sudo[2264442]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 19:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:26 nativespace-cdp sudo[2264447]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 19:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:26 nativespace-cdp sudo[2264451]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 19:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:26 nativespace-cdp sudo[2264456]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 19:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:26 nativespace-cdp sudo[2264461]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 19:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:26 nativespace-cdp sudo[2264467]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 19:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:28 nativespace-cdp sudo[2264479]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 19:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:28 nativespace-cdp sudo[2264486]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=mcdermos user-2=chrisdal user-3=david user-4=careers user-5=nbhavers user-6=tomandle user-7=jennimil user-8=branko user-9=hodgsonmail user-10=outdoorc user-11=ranxterc user-12=romaldki user-13=lucy user-14=attlebor user-15=onlycont user-16=crrtipdl user-17=sosevalu user-18=bakery user-19=nove user-20=boldover user-21=kategilpin user-22=dancinggardener user-23=stagingerris user-24=ladburyp user-25=design user-26=what user-27=tstardom user-28=oubpgvbx user-29=nvihkvu user-30=havantho user-31=sketchy user-32=cath user-33=zebrapho user-34=bwppodcast user-35=steve user-36=sibtoncc user-37=asandcoc user-38=darkstar user-39=eatspam user-40=beauty user-41=dhyana user-42=fawcettd user-43=burydropin user-44=nsceres user-45=smrszyqg user-46=isleofwi user-47=barbersh user-48=tigerlet user-49=nomistakes
Sep  4 19:09:28 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=hidden user-51=leftie user-52=foods user-53=fortunaz user-54=health2045 user-55=nscdp user-56=putterfc user-57=steakbridieme user-58=donnychicago user-59=firstre5 user-60=philmcph user-61=ctedorgu user-62=lkpier user-63=hirefootballgame user-64=courseme user-65=eugincou user-66=reliable user-67=ninejimm user-68=cambria1 user-69=cathski user-70=cwsocial user-71=pugwash user-72=paulmca1 user-73=howardon user-74=costestimatorco user-75=clarkass user-76=firstrel user-77=highlegh user-78=southlon user-79=firstred user-80=firstres user-81=ultbcrra user-82=jonhartl user-83=seftvta user-84=opaiscyx user-85=coursemc user-86=ianrayne user-87=accooper user-88=thqkgnbz user-89=connectedshoppin user-90=elecleis user-91=gilpin user-92=milloyco user-93=fetch user-94=carsinyo user-95=hubmaster user-96=putterfi user-97=bedfords user-98=bemadonn user-99=newstoda user-100=belle user-101=ggaaorgu user-102=nstriton
Sep  4 19:09:28 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=brighto1 user-104=oneoarco user-105=battlere user-106=vivienn1 user-107=firstre2 user-108=askhform user-109=stuartge user-110=innovat1 user-111=nativene user-112=skyfirec user-113=alexadmin user-114=ulsukarm user-115=booff user-116=foundation user-117=markward user-118=lbscrmod user-119=maflemin user-120=vantagep user-121=connect9 user-122=athenare user-123=agproduc user-124=still user-125=leereyn1 user-126=stephani user-127=jarvisin user-128=hodgesonweb user-129=theblack user-130=spectrum user-131=wilsonsw user-132=megacards user-133=musorguk user-134=brmrjxl user-135=lakesan1 user-136=atestord user-137=sarafoundation user-138=strathar user-139=hhdugcor user-140=lbhyisi user-141=magichat user-142=martsblo user-143=ptkxhsbt user-144=dickemery123 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 19:09:28 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 19:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:29 nativespace-cdp sudo[2264492]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 19:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:29 nativespace-cdp sudo[2264498]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vpSliC4x5WzvqjvS.~
Sep  4 19:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:29 nativespace-cdp sudo[2264503]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vpSliC4x5WzvqjvS.~'
Sep  4 19:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:29 nativespace-cdp sudo[2264507]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vpSliC4x5WzvqjvS.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 19:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:29 nativespace-cdp sudo[2264513]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 19:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:29 nativespace-cdp sudo[2264519]: pam_unix(sudo:session): session closed for user root
Sep  4 19:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 19:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 19:09:30 nativespace-cdp sudo[2264548]: pam_unix(sudo:session): session closed for user root
Sep  4 19:11:33 nativespace-cdp sshd[2265520]: Connection closed by 159.100.136.21 port 58126 [preauth]
Sep  4 19:16:33 nativespace-cdp sshd[2266660]: Connection closed by 159.100.136.21 port 40092 [preauth]
Sep  4 19:21:34 nativespace-cdp sshd[2267760]: Connection closed by 159.100.136.21 port 50110 [preauth]
Sep  4 19:26:33 nativespace-cdp sshd[2268932]: Connection closed by 159.100.136.21 port 60380 [preauth]
Sep  4 19:31:33 nativespace-cdp sshd[2270289]: Connection closed by 159.100.136.21 port 42222 [preauth]
Sep  4 19:36:33 nativespace-cdp sshd[2271379]: Connection closed by 159.100.136.21 port 52538 [preauth]
Sep  4 19:41:33 nativespace-cdp sshd[2272632]: Connection closed by 159.100.136.21 port 34302 [preauth]
Sep  4 19:46:33 nativespace-cdp sshd[2273900]: Connection closed by 159.100.136.21 port 44510 [preauth]
Sep  4 19:51:33 nativespace-cdp sshd[2275053]: Connection closed by 159.100.136.21 port 54546 [preauth]
Sep  4 19:56:33 nativespace-cdp sshd[2276394]: Connection closed by 159.100.136.21 port 36594 [preauth]
Sep  4 20:01:33 nativespace-cdp sshd[2277509]: Connection closed by 159.100.136.21 port 46610 [preauth]
Sep  4 20:06:33 nativespace-cdp sshd[2278720]: Connection closed by 159.100.136.21 port 56924 [preauth]
Sep  4 20:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 20:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:23 nativespace-cdp sudo[2279365]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 20:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:23 nativespace-cdp sudo[2279370]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 20:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:24 nativespace-cdp sudo[2279375]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 20:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:24 nativespace-cdp sudo[2279382]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 20:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:25 nativespace-cdp sudo[2279388]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 20:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:25 nativespace-cdp sudo[2279399]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 20:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:25 nativespace-cdp sudo[2279404]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 20:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:25 nativespace-cdp sudo[2279408]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 20:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:25 nativespace-cdp sudo[2279413]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 20:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:25 nativespace-cdp sudo[2279418]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 20:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:25 nativespace-cdp sudo[2279424]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 20:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:27 nativespace-cdp sudo[2279439]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 20:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:27 nativespace-cdp sudo[2279447]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bedfords user-2=bemadonn user-3=newstoda user-4=ggaaorgu user-5=belle user-6=nstriton user-7=brighto1 user-8=oneoarco user-9=battlere user-10=vivienn1 user-11=firstre2 user-12=stuartge user-13=askhform user-14=innovat1 user-15=nativene user-16=skyfirec user-17=alexadmin user-18=costestimatorco user-19=firstrel user-20=clarkass user-21=highlegh user-22=southlon user-23=firstred user-24=firstres user-25=ultbcrra user-26=seftvta user-27=jonhartl user-28=coursemc user-29=opaiscyx user-30=ianrayne user-31=accooper user-32=thqkgnbz user-33=connectedshoppin user-34=elecleis user-35=gilpin user-36=milloyco user-37=fetch user-38=carsinyo user-39=hubmaster user-40=putterfi user-41=wilsonsw user-42=megacards user-43=musorguk user-44=brmrjxl user-45=lakesan1 user-46=atestord user-47=sarafoundation
Sep  4 20:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=strathar user-49=hhdugcor user-50=lbhyisi user-51=magichat user-52=martsblo user-53=ptkxhsbt user-54=dickemery123 user-55=ulsukarm user-56=foundation user-57=booff user-58=markward user-59=lbscrmod user-60=maflemin user-61=vantagep user-62=athenare user-63=connect9 user-64=agproduc user-65=still user-66=leereyn1 user-67=stephani user-68=jarvisin user-69=theblack user-70=hodgesonweb user-71=spectrum user-72=crrtipdl user-73=sosevalu user-74=bakery user-75=nove user-76=boldover user-77=kategilpin user-78=dancinggardener user-79=stagingerris user-80=ladburyp user-81=design user-82=what user-83=tstardom user-84=oubpgvbx user-85=nvihkvu user-86=havantho user-87=cath user-88=sketchy user-89=mcdermos user-90=chrisdal user-91=david user-92=nbhavers user-93=careers user-94=tomandle user-95=jennimil user-96=branko user-97=ranxterc user-98=hodgsonmail user-99=outdoorc user-100=romaldki user-101=lucy
Sep  4 20:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=attlebor user-103=onlycont user-104=smrszyqg user-105=isleofwi user-106=tigerlet user-107=barbersh user-108=nomistakes user-109=hidden user-110=foods user-111=leftie user-112=fortunaz user-113=health2045 user-114=nscdp user-115=putterfc user-116=steakbridieme user-117=donnychicago user-118=firstre5 user-119=philmcph user-120=ctedorgu user-121=lkpier user-122=hirefootballgame user-123=courseme user-124=eugincou user-125=reliable user-126=ninejimm user-127=cathski user-128=cambria1 user-129=cwsocial user-130=pugwash user-131=paulmca1 user-132=howardon user-133=zebrapho user-134=bwppodcast user-135=steve user-136=sibtoncc user-137=asandcoc user-138=darkstar user-139=eatspam user-140=beauty user-141=dhyana user-142=fawcettd user-143=burydropin user-144=nsceres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  4 20:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 20:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:27 nativespace-cdp sudo[2279454]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 20:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:28 nativespace-cdp sudo[2279460]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AbPToGee200pW2Ky.~
Sep  4 20:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:28 nativespace-cdp sudo[2279465]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AbPToGee200pW2Ky.~'
Sep  4 20:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:28 nativespace-cdp sudo[2279469]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AbPToGee200pW2Ky.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 20:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:28 nativespace-cdp sudo[2279474]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 20:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:28 nativespace-cdp sudo[2279481]: pam_unix(sudo:session): session closed for user root
Sep  4 20:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 20:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 20:09:34 nativespace-cdp sudo[2279521]: pam_unix(sudo:session): session closed for user root
Sep  4 20:11:34 nativespace-cdp sshd[2280485]: Connection closed by 159.100.136.21 port 38678 [preauth]
Sep  4 20:16:33 nativespace-cdp sshd[2281587]: Connection closed by 159.100.136.21 port 48896 [preauth]
Sep  4 20:21:33 nativespace-cdp sshd[2282695]: Connection closed by 159.100.136.21 port 58872 [preauth]
Sep  4 20:26:33 nativespace-cdp sshd[2283742]: Connection closed by 159.100.136.21 port 40910 [preauth]
Sep  4 20:31:33 nativespace-cdp sshd[2285092]: Connection closed by 159.100.136.21 port 50910 [preauth]
Sep  4 20:36:33 nativespace-cdp sshd[2286992]: Connection closed by 159.100.136.21 port 32974 [preauth]
Sep  4 20:41:33 nativespace-cdp sshd[2288159]: Connection closed by 159.100.136.21 port 42956 [preauth]
Sep  4 20:46:33 nativespace-cdp sshd[2289274]: Connection closed by 159.100.136.21 port 53150 [preauth]
Sep  4 20:51:33 nativespace-cdp sshd[2290522]: Connection closed by 159.100.136.21 port 34928 [preauth]
Sep  4 20:56:33 nativespace-cdp sshd[2291543]: Connection closed by 159.100.136.21 port 45202 [preauth]
Sep  4 21:01:33 nativespace-cdp sshd[2292991]: Connection closed by 159.100.136.21 port 55140 [preauth]
Sep  4 21:06:33 nativespace-cdp sshd[2293970]: Connection closed by 159.100.136.21 port 37244 [preauth]
Sep  4 21:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 21:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:25 nativespace-cdp sudo[2294484]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 21:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:25 nativespace-cdp sudo[2294488]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 21:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:27 nativespace-cdp sudo[2294493]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 21:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:27 nativespace-cdp sudo[2294501]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 21:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:30 nativespace-cdp sudo[2294508]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 21:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:30 nativespace-cdp sudo[2294530]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 21:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:30 nativespace-cdp sudo[2294536]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 21:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:30 nativespace-cdp sudo[2294540]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 21:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:30 nativespace-cdp sudo[2294545]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 21:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:30 nativespace-cdp sudo[2294550]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 21:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:30 nativespace-cdp sudo[2294556]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 21:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:32 nativespace-cdp sudo[2294569]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 21:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:32 nativespace-cdp sudo[2294576]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=asandcoc user-2=sibtoncc user-3=zebrapho user-4=bwppodcast user-5=steve user-6=burydropin user-7=fawcettd user-8=nsceres user-9=eatspam user-10=darkstar user-11=beauty user-12=dhyana user-13=health2045 user-14=fortunaz user-15=leftie user-16=foods user-17=putterfc user-18=nscdp user-19=ctedorgu user-20=philmcph user-21=donnychicago user-22=firstre5 user-23=steakbridieme user-24=lkpier user-25=isleofwi user-26=smrszyqg user-27=barbersh user-28=tigerlet user-29=hidden user-30=nomistakes user-31=reliable user-32=ninejimm user-33=cambria1 user-34=cathski user-35=paulmca1 user-36=pugwash user-37=howardon user-38=cwsocial user-39=hirefootballgame user-40=courseme user-41=eugincou user-42=tomandle user-43=jennimil user-44=mcdermos user-45=chrisdal user-46=nbhavers user-47=careers user-48=david
Sep  4 21:09:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=attlebor user-50=lucy user-51=onlycont user-52=branko user-53=hodgsonmail user-54=outdoorc user-55=ranxterc user-56=romaldki user-57=nove user-58=boldover user-59=sosevalu user-60=crrtipdl user-61=bakery user-62=what user-63=tstardom user-64=oubpgvbx user-65=nvihkvu user-66=cath user-67=sketchy user-68=havantho user-69=kategilpin user-70=ladburyp user-71=stagingerris user-72=dancinggardener user-73=design user-74=booff user-75=markward user-76=foundation user-77=maflemin user-78=lbscrmod user-79=athenare user-80=connect9 user-81=vantagep user-82=ulsukarm user-83=jarvisin user-84=theblack user-85=hodgesonweb user-86=spectrum user-87=still user-88=agproduc user-89=leereyn1 user-90=stephani user-91=lakesan1 user-92=brmrjxl user-93=sarafoundation user-94=atestord user-95=strathar user-96=wilsonsw user-97=musorguk user-98=megacards user-99=martsblo user-100=ptkxhsbt user-101=dickemery123 user-102=lbhyisi
Sep  4 21:09:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=hhdugcor user-104=magichat user-105=firstres user-106=jonhartl user-107=seftvta user-108=ultbcrra user-109=coursemc user-110=opaiscyx user-111=costestimatorco user-112=clarkass user-113=firstrel user-114=southlon user-115=highlegh user-116=firstred user-117=elecleis user-118=milloyco user-119=gilpin user-120=carsinyo user-121=fetch user-122=hubmaster user-123=putterfi user-124=ianrayne user-125=accooper user-126=thqkgnbz user-127=connectedshoppin user-128=brighto1 user-129=nstriton user-130=battlere user-131=oneoarco user-132=firstre2 user-133=vivienn1 user-134=bedfords user-135=bemadonn user-136=ggaaorgu user-137=belle user-138=newstoda user-139=alexadmin user-140=skyfirec user-141=askhform user-142=stuartge user-143=innovat1 user-144=nativene feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 21:09:32 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 21:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:33 nativespace-cdp sudo[2294582]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 21:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:33 nativespace-cdp sudo[2294590]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dhSXnx1ffUlod1kZ.~
Sep  4 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:34 nativespace-cdp sudo[2294595]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dhSXnx1ffUlod1kZ.~'
Sep  4 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:34 nativespace-cdp sudo[2294599]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dhSXnx1ffUlod1kZ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:34 nativespace-cdp sudo[2294605]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:34 nativespace-cdp sudo[2294610]: pam_unix(sudo:session): session closed for user root
Sep  4 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:09:41 nativespace-cdp sudo[2294656]: pam_unix(sudo:session): session closed for user root
Sep  4 21:11:33 nativespace-cdp sshd[2295263]: Connection closed by 159.100.136.21 port 47190 [preauth]
Sep  4 21:16:34 nativespace-cdp sshd[2296431]: Connection closed by 159.100.136.21 port 57396 [preauth]
Sep  4 21:21:33 nativespace-cdp sshd[2297721]: Connection closed by 159.100.136.21 port 39148 [preauth]
Sep  4 21:26:33 nativespace-cdp sshd[2299041]: Connection closed by 159.100.136.21 port 49412 [preauth]
Sep  4 21:31:33 nativespace-cdp sshd[2300272]: Connection closed by 159.100.136.21 port 59454 [preauth]
Sep  4 21:36:33 nativespace-cdp sshd[2301234]: Connection closed by 159.100.136.21 port 41482 [preauth]
Sep  4 21:41:33 nativespace-cdp sshd[2302333]: Connection closed by 159.100.136.21 port 51450 [preauth]
Sep  4 21:46:33 nativespace-cdp sshd[2303692]: Connection closed by 159.100.136.21 port 33460 [preauth]
Sep  4 21:47:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 21:47:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:47:51 nativespace-cdp sudo[2304245]: pam_unix(sudo:session): session closed for user root
Sep  4 21:47:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status beauty
Sep  4 21:47:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:47:58 nativespace-cdp sudo[2304252]: pam_unix(sudo:session): session closed for user root
Sep  4 21:48:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 21:48:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:48:00 nativespace-cdp sudo[2304289]: pam_unix(sudo:session): session closed for user root
Sep  4 21:48:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status foods
Sep  4 21:48:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:48:01 nativespace-cdp sudo[2304293]: pam_unix(sudo:session): session closed for user root
Sep  4 21:48:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 21:48:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:48:02 nativespace-cdp sudo[2304314]: pam_unix(sudo:session): session closed for user root
Sep  4 21:48:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status vantagep
Sep  4 21:48:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 21:48:03 nativespace-cdp sudo[2304318]: pam_unix(sudo:session): session closed for user root
Sep  4 21:51:33 nativespace-cdp sshd[2305285]: Connection closed by 159.100.136.21 port 43420 [preauth]
Sep  4 21:56:33 nativespace-cdp sshd[2306687]: Connection closed by 159.100.136.21 port 53690 [preauth]
Sep  4 22:01:33 nativespace-cdp sshd[2307953]: Connection closed by 159.100.136.21 port 35460 [preauth]
Sep  4 22:06:33 nativespace-cdp sshd[2308919]: Connection closed by 159.100.136.21 port 45756 [preauth]
Sep  4 22:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 22:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:24 nativespace-cdp sudo[2309396]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 22:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:24 nativespace-cdp sudo[2309400]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 22:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:25 nativespace-cdp sudo[2309406]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 22:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:25 nativespace-cdp sudo[2309412]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 22:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:27 nativespace-cdp sudo[2309418]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 22:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:27 nativespace-cdp sudo[2309431]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 22:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:27 nativespace-cdp sudo[2309436]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 22:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:27 nativespace-cdp sudo[2309441]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 22:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:27 nativespace-cdp sudo[2309446]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 22:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:27 nativespace-cdp sudo[2309451]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 22:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:27 nativespace-cdp sudo[2309457]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 22:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:29 nativespace-cdp sudo[2309468]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 22:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:29 nativespace-cdp sudo[2309474]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=david user-2=nbhavers user-3=careers user-4=chrisdal user-5=mcdermos user-6=jennimil user-7=tomandle user-8=romaldki user-9=outdoorc user-10=ranxterc user-11=hodgsonmail user-12=branko user-13=onlycont user-14=lucy user-15=attlebor user-16=bakery user-17=crrtipdl user-18=sosevalu user-19=boldover user-20=nove user-21=design user-22=dancinggardener user-23=stagingerris user-24=ladburyp user-25=kategilpin user-26=havantho user-27=cath user-28=sketchy user-29=nvihkvu user-30=oubpgvbx user-31=tstardom user-32=what user-33=steve user-34=bwppodcast user-35=zebrapho user-36=sibtoncc user-37=asandcoc user-38=dhyana user-39=beauty user-40=darkstar user-41=eatspam user-42=nsceres user-43=fawcettd user-44=burydropin user-45=nomistakes user-46=hidden user-47=barbersh user-48=tigerlet user-49=smrszyqg
Sep  4 22:09:29 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=isleofwi user-51=lkpier user-52=donnychicago user-53=steakbridieme user-54=firstre5 user-55=ctedorgu user-56=philmcph user-57=nscdp user-58=putterfc user-59=leftie user-60=foods user-61=health2045 user-62=fortunaz user-63=eugincou user-64=courseme user-65=hirefootballgame user-66=cwsocial user-67=pugwash user-68=paulmca1 user-69=howardon user-70=cambria1 user-71=cathski user-72=ninejimm user-73=reliable user-74=firstred user-75=highlegh user-76=southlon user-77=firstrel user-78=clarkass user-79=costestimatorco user-80=coursemc user-81=opaiscyx user-82=ultbcrra user-83=seftvta user-84=jonhartl user-85=firstres user-86=connectedshoppin user-87=thqkgnbz user-88=accooper user-89=ianrayne user-90=hubmaster user-91=putterfi user-92=fetch user-93=carsinyo user-94=milloyco user-95=gilpin user-96=elecleis user-97=newstoda user-98=belle user-99=ggaaorgu user-100=bemadonn user-101=bedfords user-102=vivienn1
Sep  4 22:09:29 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=firstre2 user-104=oneoarco user-105=battlere user-106=nstriton user-107=brighto1 user-108=nativene user-109=innovat1 user-110=stuartge user-111=askhform user-112=alexadmin user-113=skyfirec user-114=ulsukarm user-115=vantagep user-116=connect9 user-117=athenare user-118=lbscrmod user-119=maflemin user-120=foundation user-121=booff user-122=markward user-123=stephani user-124=leereyn1 user-125=agproduc user-126=still user-127=spectrum user-128=theblack user-129=hodgesonweb user-130=jarvisin user-131=megacards user-132=musorguk user-133=wilsonsw user-134=strathar user-135=atestord user-136=sarafoundation user-137=brmrjxl user-138=lakesan1 user-139=magichat user-140=hhdugcor user-141=lbhyisi user-142=dickemery123 user-143=ptkxhsbt user-144=martsblo feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 22:09:29 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 22:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:30 nativespace-cdp sudo[2309481]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 22:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:30 nativespace-cdp sudo[2309492]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mBWkCAkf731j4qqp.~
Sep  4 22:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:30 nativespace-cdp sudo[2309497]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mBWkCAkf731j4qqp.~'
Sep  4 22:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:30 nativespace-cdp sudo[2309501]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mBWkCAkf731j4qqp.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 22:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:30 nativespace-cdp sudo[2309507]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 22:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:30 nativespace-cdp sudo[2309512]: pam_unix(sudo:session): session closed for user root
Sep  4 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 22:09:43 nativespace-cdp sudo[2309582]: pam_unix(sudo:session): session closed for user root
Sep  4 22:11:33 nativespace-cdp sshd[2310185]: Connection closed by 159.100.136.21 port 55744 [preauth]
Sep  4 22:16:33 nativespace-cdp sshd[2311507]: Connection closed by 159.100.136.21 port 37702 [preauth]
Sep  4 22:21:33 nativespace-cdp sshd[2312608]: Connection closed by 159.100.136.21 port 47700 [preauth]
Sep  4 22:26:33 nativespace-cdp sshd[2313720]: Connection closed by 159.100.136.21 port 57940 [preauth]
Sep  4 22:31:33 nativespace-cdp sshd[2314820]: Connection closed by 159.100.136.21 port 39752 [preauth]
Sep  4 22:36:33 nativespace-cdp sshd[2316145]: Connection closed by 159.100.136.21 port 50052 [preauth]
Sep  4 22:41:33 nativespace-cdp sshd[2317290]: Connection closed by 159.100.136.21 port 59994 [preauth]
Sep  4 22:46:33 nativespace-cdp sshd[2318477]: Connection closed by 159.100.136.21 port 41986 [preauth]
Sep  4 22:51:33 nativespace-cdp sshd[2319500]: Connection closed by 159.100.136.21 port 51988 [preauth]
Sep  4 22:56:33 nativespace-cdp sshd[2320642]: Connection closed by 159.100.136.21 port 33982 [preauth]
Sep  4 23:01:33 nativespace-cdp sshd[2321949]: Connection closed by 159.100.136.21 port 43962 [preauth]
Sep  4 23:06:33 nativespace-cdp sshd[2322949]: Connection closed by 159.100.136.21 port 54276 [preauth]
Sep  4 23:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  4 23:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:30 nativespace-cdp sudo[2323458]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  4 23:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:30 nativespace-cdp sudo[2323463]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  4 23:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:31 nativespace-cdp sudo[2323468]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  4 23:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:31 nativespace-cdp sudo[2323475]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  4 23:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:42 nativespace-cdp sudo[2323481]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  4 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:42 nativespace-cdp sudo[2323530]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  4 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:42 nativespace-cdp sudo[2323535]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  4 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:42 nativespace-cdp sudo[2323539]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  4 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:42 nativespace-cdp sudo[2323544]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  4 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:42 nativespace-cdp sudo[2323550]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  4 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:42 nativespace-cdp sudo[2323556]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  4 23:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:49 nativespace-cdp sudo[2323583]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  4 23:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:49 nativespace-cdp sudo[2323590]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=pugwash user-2=paulmca1 user-3=howardon user-4=cwsocial user-5=cathski user-6=cambria1 user-7=reliable user-8=ninejimm user-9=eugincou user-10=courseme user-11=hirefootballgame user-12=lkpier user-13=philmcph user-14=ctedorgu user-15=donnychicago user-16=steakbridieme user-17=firstre5 user-18=putterfc user-19=nscdp user-20=health2045 user-21=fortunaz user-22=foods user-23=leftie user-24=hidden user-25=nomistakes user-26=tigerlet user-27=barbersh user-28=smrszyqg user-29=isleofwi user-30=nsceres user-31=burydropin user-32=fawcettd user-33=dhyana user-34=beauty user-35=eatspam user-36=darkstar user-37=sibtoncc user-38=asandcoc user-39=steve user-40=bwppodcast user-41=zebrapho user-42=sketchy user-43=cath user-44=havantho user-45=nvihkvu user-46=tstardom user-47=oubpgvbx user-48=what user-49=design
Sep  4 23:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=ladburyp user-51=dancinggardener user-52=stagingerris user-53=kategilpin user-54=boldover user-55=nove user-56=bakery user-57=sosevalu user-58=crrtipdl user-59=onlycont user-60=attlebor user-61=lucy user-62=romaldki user-63=hodgsonmail user-64=outdoorc user-65=ranxterc user-66=branko user-67=jennimil user-68=tomandle user-69=careers user-70=nbhavers user-71=david user-72=chrisdal user-73=mcdermos user-74=dickemery123 user-75=ptkxhsbt user-76=martsblo user-77=magichat user-78=lbhyisi user-79=hhdugcor user-80=strathar user-81=sarafoundation user-82=atestord user-83=lakesan1 user-84=brmrjxl user-85=musorguk user-86=megacards user-87=wilsonsw user-88=spectrum user-89=theblack user-90=hodgesonweb user-91=jarvisin user-92=stephani user-93=leereyn1 user-94=still user-95=agproduc user-96=athenare user-97=connect9 user-98=vantagep user-99=maflemin user-100=lbscrmod user-101=booff user-102=foundation
Sep  4 23:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=markward user-104=ulsukarm user-105=alexadmin user-106=skyfirec user-107=nativene user-108=innovat1 user-109=stuartge user-110=askhform user-111=firstre2 user-112=vivienn1 user-113=battlere user-114=oneoarco user-115=brighto1 user-116=nstriton user-117=ggaaorgu user-118=belle user-119=newstoda user-120=bemadonn user-121=bedfords user-122=hubmaster user-123=putterfi user-124=carsinyo user-125=fetch user-126=milloyco user-127=gilpin user-128=elecleis user-129=connectedshoppin user-130=thqkgnbz user-131=accooper user-132=ianrayne user-133=coursemc user-134=opaiscyx user-135=jonhartl user-136=seftvta user-137=ultbcrra user-138=firstres user-139=firstred user-140=southlon user-141=highlegh user-142=firstrel user-143=clarkass user-144=costestimatorco feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  4 23:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  4 23:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:50 nativespace-cdp sudo[2323597]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:51 nativespace-cdp sudo[2323605]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-a19VR0ChFHkJXRmN.~
Sep  4 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:51 nativespace-cdp sudo[2323610]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-a19VR0ChFHkJXRmN.~'
Sep  4 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:51 nativespace-cdp sudo[2323614]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-a19VR0ChFHkJXRmN.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  4 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:51 nativespace-cdp sudo[2323621]: pam_unix(sudo:session): session closed for user root
Sep  4 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  4 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:09:51 nativespace-cdp sudo[2323626]: pam_unix(sudo:session): session closed for user root
Sep  4 23:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  4 23:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  4 23:10:17 nativespace-cdp sudo[2324159]: pam_unix(sudo:session): session closed for user root
Sep  4 23:11:33 nativespace-cdp sshd[2324580]: Connection closed by 159.100.136.21 port 36026 [preauth]
Sep  4 23:16:33 nativespace-cdp sshd[2325842]: Connection closed by 159.100.136.21 port 46204 [preauth]
Sep  4 23:21:33 nativespace-cdp sshd[2326863]: Connection closed by 159.100.136.21 port 56172 [preauth]
Sep  4 23:26:33 nativespace-cdp sshd[2328065]: Connection closed by 159.100.136.21 port 38224 [preauth]
Sep  4 23:31:46 nativespace-cdp sshd[2329432]: Did not receive identification string from 159.100.136.21 port 48260
Sep  4 23:36:33 nativespace-cdp sshd[2330729]: Connection closed by 159.100.136.21 port 58496 [preauth]
Sep  4 23:41:33 nativespace-cdp sshd[2332338]: Connection closed by 159.100.136.21 port 40230 [preauth]
Sep  4 23:46:33 nativespace-cdp sshd[2333429]: Connection closed by 159.100.136.21 port 50442 [preauth]
Sep  4 23:51:33 nativespace-cdp sshd[2334352]: Connection closed by 159.100.136.21 port 60456 [preauth]
Sep  4 23:56:33 nativespace-cdp sshd[2335352]: Connection closed by 159.100.136.21 port 42466 [preauth]
Sep  5 00:01:33 nativespace-cdp sshd[2336749]: Connection closed by 159.100.136.21 port 52452 [preauth]
Sep  5 00:06:33 nativespace-cdp sshd[2337738]: Connection closed by 159.100.136.21 port 34550 [preauth]
Sep  5 00:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 00:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:09:59 nativespace-cdp sudo[2338416]: pam_unix(sudo:session): session closed for user root
Sep  5 00:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 00:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:09:59 nativespace-cdp sudo[2338420]: pam_unix(sudo:session): session closed for user root
Sep  5 00:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 00:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:01 nativespace-cdp sudo[2338425]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 00:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:01 nativespace-cdp sudo[2338432]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 00:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:03 nativespace-cdp sudo[2338438]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:03 nativespace-cdp sudo[2338557]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:03 nativespace-cdp sudo[2338560]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:03 nativespace-cdp sudo[2338563]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:03 nativespace-cdp sudo[2338567]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:03 nativespace-cdp sudo[2338572]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:03 nativespace-cdp sudo[2338575]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 00:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:05 nativespace-cdp sudo[2338585]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 00:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:06 nativespace-cdp sudo[2338601]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jennimil user-2=tomandle user-3=nbhavers user-4=careers user-5=david user-6=chrisdal user-7=mcdermos user-8=onlycont user-9=attlebor user-10=lucy user-11=romaldki user-12=hodgsonmail user-13=ranxterc user-14=outdoorc user-15=branko user-16=boldover user-17=nove user-18=bakery user-19=sosevalu user-20=crrtipdl user-21=cath user-22=sketchy user-23=havantho user-24=nvihkvu user-25=oubpgvbx user-26=tstardom user-27=what user-28=design user-29=ladburyp user-30=stagingerris user-31=dancinggardener user-32=kategilpin user-33=asandcoc user-34=sibtoncc user-35=steve user-36=bwppodcast user-37=zebrapho user-38=nsceres user-39=burydropin user-40=fawcettd user-41=dhyana user-42=beauty user-43=eatspam user-44=darkstar user-45=lkpier user-46=philmcph user-47=ctedorgu user-48=donnychicago user-49=steakbridieme
Sep  5 00:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=firstre5 user-51=putterfc user-52=nscdp user-53=health2045 user-54=fortunaz user-55=leftie user-56=foods user-57=hidden user-58=nomistakes user-59=tigerlet user-60=barbersh user-61=smrszyqg user-62=isleofwi user-63=howardon user-64=pugwash user-65=paulmca1 user-66=cwsocial user-67=cambria1 user-68=cathski user-69=reliable user-70=ninejimm user-71=eugincou user-72=courseme user-73=hirefootballgame user-74=coursemc user-75=opaiscyx user-76=jonhartl user-77=seftvta user-78=ultbcrra user-79=firstres user-80=firstred user-81=southlon user-82=highlegh user-83=clarkass user-84=firstrel user-85=costestimatorco user-86=hubmaster user-87=putterfi user-88=carsinyo user-89=fetch user-90=gilpin user-91=milloyco user-92=elecleis user-93=connectedshoppin user-94=thqkgnbz user-95=accooper user-96=ianrayne user-97=firstre2 user-98=vivienn1 user-99=battlere user-100=oneoarco user-101=brighto1 user-102=nstriton
Sep  5 00:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=belle user-104=ggaaorgu user-105=newstoda user-106=bemadonn user-107=bedfords user-108=alexadmin user-109=skyfirec user-110=nativene user-111=innovat1 user-112=askhform user-113=stuartge user-114=athenare user-115=connect9 user-116=vantagep user-117=maflemin user-118=lbscrmod user-119=booff user-120=foundation user-121=markward user-122=ulsukarm user-123=spectrum user-124=hodgesonweb user-125=theblack user-126=jarvisin user-127=stephani user-128=leereyn1 user-129=still user-130=agproduc user-131=strathar user-132=sarafoundation user-133=atestord user-134=brmrjxl user-135=lakesan1 user-136=musorguk user-137=megacards user-138=wilsonsw user-139=dickemery123 user-140=ptkxhsbt user-141=martsblo user-142=magichat user-143=lbhyisi user-144=hhdugcor feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 00:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 00:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:07 nativespace-cdp sudo[2338606]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 00:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:07 nativespace-cdp sudo[2338611]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YRJljI1CPR50PaU5.~
Sep  5 00:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:07 nativespace-cdp sudo[2338614]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YRJljI1CPR50PaU5.~'
Sep  5 00:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:07 nativespace-cdp sudo[2338617]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YRJljI1CPR50PaU5.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 00:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:07 nativespace-cdp sudo[2338621]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 00:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:07 nativespace-cdp sudo[2338625]: pam_unix(sudo:session): session closed for user root
Sep  5 00:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 00:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 00:10:08 nativespace-cdp sudo[2338643]: pam_unix(sudo:session): session closed for user root
Sep  5 00:11:33 nativespace-cdp sshd[2338881]: Connection closed by 159.100.136.21 port 44528 [preauth]
Sep  5 00:16:33 nativespace-cdp sshd[2340215]: Connection closed by 159.100.136.21 port 54732 [preauth]
Sep  5 00:21:33 nativespace-cdp sshd[2341224]: Connection closed by 159.100.136.21 port 36478 [preauth]
Sep  5 00:26:33 nativespace-cdp sshd[2342253]: Connection closed by 159.100.136.21 port 46732 [preauth]
Sep  5 00:31:33 nativespace-cdp sshd[2343609]: Connection closed by 159.100.136.21 port 56774 [preauth]
Sep  5 00:36:33 nativespace-cdp sshd[2344557]: Connection closed by 159.100.136.21 port 38802 [preauth]
Sep  5 00:41:33 nativespace-cdp sshd[2345666]: Connection closed by 159.100.136.21 port 48784 [preauth]
Sep  5 00:46:33 nativespace-cdp sshd[2346856]: Connection closed by 159.100.136.21 port 58984 [preauth]
Sep  5 00:51:33 nativespace-cdp sshd[2347846]: Connection closed by 159.100.136.21 port 40750 [preauth]
Sep  5 00:56:33 nativespace-cdp sshd[2348827]: Connection closed by 159.100.136.21 port 51020 [preauth]
Sep  5 01:01:33 nativespace-cdp sshd[2350452]: Connection closed by 159.100.136.21 port 60992 [preauth]
Sep  5 01:06:33 nativespace-cdp sshd[2351388]: Connection closed by 159.100.136.21 port 43068 [preauth]
Sep  5 01:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 01:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:09:59 nativespace-cdp sudo[2352136]: pam_unix(sudo:session): session closed for user root
Sep  5 01:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 01:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:09:59 nativespace-cdp sudo[2352139]: pam_unix(sudo:session): session closed for user root
Sep  5 01:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 01:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:00 nativespace-cdp sudo[2352142]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 01:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:01 nativespace-cdp sudo[2352146]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 01:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:03 nativespace-cdp sudo[2352149]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 01:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:03 nativespace-cdp sudo[2352268]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 01:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:03 nativespace-cdp sudo[2352271]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 01:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:03 nativespace-cdp sudo[2352274]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 01:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:03 nativespace-cdp sudo[2352277]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 01:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:03 nativespace-cdp sudo[2352280]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 01:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:03 nativespace-cdp sudo[2352285]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 01:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:05 nativespace-cdp sudo[2352296]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 01:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:06 nativespace-cdp sudo[2352300]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=dickemery123 user-3=ptkxhsbt user-4=hhdugcor user-5=lbhyisi user-6=magichat user-7=brmrjxl user-8=lakesan1 user-9=strathar user-10=atestord user-11=sarafoundation user-12=wilsonsw user-13=megacards user-14=musorguk user-15=jarvisin user-16=spectrum user-17=hodgesonweb user-18=theblack user-19=agproduc user-20=still user-21=stephani user-22=leereyn1 user-23=markward user-24=booff user-25=foundation user-26=vantagep user-27=connect9 user-28=athenare user-29=lbscrmod user-30=maflemin user-31=ulsukarm user-32=alexadmin user-33=skyfirec user-34=innovat1 user-35=stuartge user-36=askhform user-37=nativene user-38=nstriton user-39=brighto1 user-40=vivienn1 user-41=firstre2 user-42=oneoarco user-43=battlere user-44=bedfords user-45=newstoda user-46=ggaaorgu user-47=belle user-48=bemadonn
Sep  5 01:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=gilpin user-50=milloyco user-51=elecleis user-52=putterfi user-53=hubmaster user-54=fetch user-55=carsinyo user-56=accooper user-57=ianrayne user-58=connectedshoppin user-59=thqkgnbz user-60=ultbcrra user-61=seftvta user-62=jonhartl user-63=firstres user-64=coursemc user-65=opaiscyx user-66=firstrel user-67=clarkass user-68=costestimatorco user-69=firstred user-70=highlegh user-71=southlon user-72=cathski user-73=cambria1 user-74=ninejimm user-75=reliable user-76=cwsocial user-77=paulmca1 user-78=pugwash user-79=howardon user-80=hirefootballgame user-81=eugincou user-82=courseme user-83=nscdp user-84=putterfc user-85=foods user-86=leftie user-87=health2045 user-88=fortunaz user-89=lkpier user-90=firstre5 user-91=donnychicago user-92=steakbridieme user-93=philmcph user-94=ctedorgu user-95=isleofwi user-96=smrszyqg user-97=nomistakes user-98=hidden user-99=barbersh user-100=tigerlet user-101=fawcettd
Sep  5 01:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=burydropin user-103=nsceres user-104=beauty user-105=darkstar user-106=eatspam user-107=dhyana user-108=asandcoc user-109=sibtoncc user-110=bwppodcast user-111=zebrapho user-112=steve user-113=oubpgvbx user-114=tstardom user-115=what user-116=havantho user-117=sketchy user-118=cath user-119=nvihkvu user-120=stagingerris user-121=dancinggardener user-122=ladburyp user-123=kategilpin user-124=design user-125=nove user-126=boldover user-127=bakery user-128=crrtipdl user-129=sosevalu user-130=lucy user-131=attlebor user-132=onlycont user-133=hodgsonmail user-134=ranxterc user-135=outdoorc user-136=branko user-137=romaldki user-138=tomandle user-139=jennimil user-140=chrisdal user-141=mcdermos user-142=david user-143=nbhavers user-144=careers feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 01:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 01:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:06 nativespace-cdp sudo[2352305]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:07 nativespace-cdp sudo[2352317]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5qDi8NZbvmXpdAGm.~
Sep  5 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:07 nativespace-cdp sudo[2352320]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5qDi8NZbvmXpdAGm.~'
Sep  5 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:07 nativespace-cdp sudo[2352323]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5qDi8NZbvmXpdAGm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:07 nativespace-cdp sudo[2352327]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:07 nativespace-cdp sudo[2352330]: pam_unix(sudo:session): session closed for user root
Sep  5 01:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 01:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 01:10:09 nativespace-cdp sudo[2352349]: pam_unix(sudo:session): session closed for user root
Sep  5 01:11:33 nativespace-cdp sshd[2352607]: Connection closed by 159.100.136.21 port 53056 [preauth]
Sep  5 01:16:33 nativespace-cdp sshd[2353833]: Connection closed by 159.100.136.21 port 35046 [preauth]
Sep  5 01:21:33 nativespace-cdp sshd[2354747]: Connection closed by 159.100.136.21 port 45018 [preauth]
Sep  5 01:26:33 nativespace-cdp sshd[2355721]: Connection closed by 159.100.136.21 port 55246 [preauth]
Sep  5 01:31:33 nativespace-cdp sshd[2356974]: Connection closed by 159.100.136.21 port 37060 [preauth]
Sep  5 01:36:33 nativespace-cdp sshd[2357893]: Connection closed by 159.100.136.21 port 47352 [preauth]
Sep  5 01:41:33 nativespace-cdp sshd[2359212]: Connection closed by 159.100.136.21 port 57326 [preauth]
Sep  5 01:46:33 nativespace-cdp sshd[2360214]: Connection closed by 159.100.136.21 port 39280 [preauth]
Sep  5 01:51:33 nativespace-cdp sshd[2361292]: Connection closed by 159.100.136.21 port 49294 [preauth]
Sep  5 01:56:33 nativespace-cdp sshd[2362214]: Connection closed by 159.100.136.21 port 59540 [preauth]
Sep  5 02:01:33 nativespace-cdp sshd[2363386]: Connection closed by 159.100.136.21 port 41292 [preauth]
Sep  5 02:06:33 nativespace-cdp sshd[2364465]: Connection closed by 159.100.136.21 port 51610 [preauth]
Sep  5 02:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 02:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:53 nativespace-cdp sudo[2365100]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 02:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:53 nativespace-cdp sudo[2365103]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 02:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:54 nativespace-cdp sudo[2365107]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 02:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:54 nativespace-cdp sudo[2365111]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 02:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:55 nativespace-cdp sudo[2365114]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:55 nativespace-cdp sudo[2365121]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:55 nativespace-cdp sudo[2365124]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:55 nativespace-cdp sudo[2365127]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:55 nativespace-cdp sudo[2365131]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:55 nativespace-cdp sudo[2365135]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:55 nativespace-cdp sudo[2365138]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:57 nativespace-cdp sudo[2365182]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:57 nativespace-cdp sudo[2365188]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bedfords user-2=bemadonn user-3=newstoda user-4=belle user-5=ggaaorgu user-6=nstriton user-7=brighto1 user-8=oneoarco user-9=battlere user-10=vivienn1 user-11=firstre2 user-12=stuartge user-13=askhform user-14=innovat1 user-15=nativene user-16=alexadmin user-17=skyfirec user-18=costestimatorco user-19=clarkass user-20=firstrel user-21=highlegh user-22=southlon user-23=firstred user-24=firstres user-25=ultbcrra user-26=jonhartl user-27=seftvta user-28=coursemc user-29=opaiscyx user-30=ianrayne user-31=accooper user-32=thqkgnbz user-33=connectedshoppin user-34=elecleis user-35=gilpin user-36=milloyco user-37=fetch user-38=carsinyo user-39=hubmaster user-40=putterfi user-41=wilsonsw user-42=megacards user-43=musorguk user-44=lakesan1 user-45=brmrjxl user-46=atestord user-47=sarafoundation
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=strathar user-49=hhdugcor user-50=lbhyisi user-51=magichat user-52=martsblo user-53=ptkxhsbt user-54=dickemery123 user-55=ulsukarm user-56=markward user-57=booff user-58=foundation user-59=lbscrmod user-60=maflemin user-61=vantagep user-62=connect9 user-63=athenare user-64=agproduc user-65=still user-66=leereyn1 user-67=stephani user-68=jarvisin user-69=hodgesonweb user-70=theblack user-71=spectrum user-72=crrtipdl user-73=sosevalu user-74=bakery user-75=nove user-76=boldover user-77=kategilpin user-78=stagingerris user-79=dancinggardener user-80=ladburyp user-81=design user-82=what user-83=oubpgvbx user-84=tstardom user-85=nvihkvu user-86=havantho user-87=sketchy user-88=cath user-89=mcdermos user-90=chrisdal user-91=david user-92=careers user-93=nbhavers user-94=tomandle user-95=jennimil user-96=branko user-97=ranxterc user-98=hodgsonmail user-99=outdoorc user-100=romaldki user-101=lucy
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=attlebor user-103=onlycont user-104=smrszyqg user-105=isleofwi user-106=tigerlet user-107=barbersh user-108=nomistakes user-109=hidden user-110=leftie user-111=foods user-112=fortunaz user-113=health2045 user-114=nscdp user-115=putterfc user-116=steakbridieme user-117=firstre5 user-118=donnychicago user-119=philmcph user-120=ctedorgu user-121=lkpier user-122=hirefootballgame user-123=courseme user-124=eugincou user-125=reliable user-126=ninejimm user-127=cathski user-128=cambria1 user-129=cwsocial user-130=pugwash user-131=paulmca1 user-132=howardon user-133=zebrapho user-134=bwppodcast user-135=steve user-136=asandcoc user-137=sibtoncc user-138=darkstar user-139=eatspam user-140=beauty user-141=dhyana user-142=fawcettd user-143=burydropin user-144=nsceres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:57 nativespace-cdp sudo[2365193]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:57 nativespace-cdp sudo[2365199]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9AcEQpUP5FwQIIpl.~
Sep  5 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:57 nativespace-cdp sudo[2365202]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9AcEQpUP5FwQIIpl.~'
Sep  5 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:57 nativespace-cdp sudo[2365205]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9AcEQpUP5FwQIIpl.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:57 nativespace-cdp sudo[2365209]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:57 nativespace-cdp sudo[2365212]: pam_unix(sudo:session): session closed for user root
Sep  5 02:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 02:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 02:09:58 nativespace-cdp sudo[2365229]: pam_unix(sudo:session): session closed for user root
Sep  5 02:11:33 nativespace-cdp sshd[2365601]: Connection closed by 159.100.136.21 port 33348 [preauth]
Sep  5 02:16:33 nativespace-cdp sshd[2367058]: Connection closed by 159.100.136.21 port 43550 [preauth]
Sep  5 02:21:33 nativespace-cdp sshd[2368124]: Connection closed by 159.100.136.21 port 53518 [preauth]
Sep  5 02:26:33 nativespace-cdp sshd[2369370]: Connection closed by 159.100.136.21 port 35488 [preauth]
Sep  5 02:31:33 nativespace-cdp sshd[2370358]: Connection closed by 159.100.136.21 port 45518 [preauth]
Sep  5 02:33:20 nativespace-cdp sshd[2370688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.102.42.5  user=root
Sep  5 02:33:20 nativespace-cdp sshd[2370688]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 02:33:22 nativespace-cdp sshd[2370688]: Failed password for root from 61.102.42.5 port 54056 ssh2
Sep  5 02:33:22 nativespace-cdp sshd[2370688]: Received disconnect from 61.102.42.5 port 54056:11: Bye Bye [preauth]
Sep  5 02:33:22 nativespace-cdp sshd[2370688]: Disconnected from 61.102.42.5 port 54056 [preauth]
Sep  5 02:35:43 nativespace-cdp sshd[2371143]: Invalid user xander from 61.102.42.5 port 33814
Sep  5 02:35:43 nativespace-cdp sshd[2371143]: input_userauth_request: invalid user xander [preauth]
Sep  5 02:35:43 nativespace-cdp sshd[2371143]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 02:35:43 nativespace-cdp sshd[2371143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.102.42.5
Sep  5 02:35:46 nativespace-cdp sshd[2371143]: Failed password for invalid user xander from 61.102.42.5 port 33814 ssh2
Sep  5 02:35:46 nativespace-cdp sshd[2371143]: Received disconnect from 61.102.42.5 port 33814:11: Bye Bye [preauth]
Sep  5 02:35:46 nativespace-cdp sshd[2371143]: Disconnected from 61.102.42.5 port 33814 [preauth]
Sep  5 02:36:33 nativespace-cdp sshd[2371310]: Connection closed by 159.100.136.21 port 55812 [preauth]
Sep  5 02:36:38 nativespace-cdp sshd[2371321]: Invalid user aitor from 61.102.42.5 port 39416
Sep  5 02:36:38 nativespace-cdp sshd[2371321]: input_userauth_request: invalid user aitor [preauth]
Sep  5 02:36:38 nativespace-cdp sshd[2371321]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 02:36:38 nativespace-cdp sshd[2371321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.102.42.5
Sep  5 02:36:40 nativespace-cdp sshd[2371321]: Failed password for invalid user aitor from 61.102.42.5 port 39416 ssh2
Sep  5 02:41:33 nativespace-cdp sshd[2372624]: Connection closed by 159.100.136.21 port 37552 [preauth]
Sep  5 02:46:33 nativespace-cdp sshd[2373590]: Connection closed by 159.100.136.21 port 47760 [preauth]
Sep  5 02:51:33 nativespace-cdp sshd[2374535]: Connection closed by 159.100.136.21 port 57770 [preauth]
Sep  5 02:56:33 nativespace-cdp sshd[2375558]: Connection closed by 159.100.136.21 port 39800 [preauth]
Sep  5 03:01:33 nativespace-cdp sshd[2376837]: Connection closed by 159.100.136.21 port 49776 [preauth]
Sep  5 03:06:33 nativespace-cdp sshd[2377759]: Connection closed by 159.100.136.21 port 60104 [preauth]
Sep  5 03:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 03:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:53 nativespace-cdp sudo[2378370]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 03:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:53 nativespace-cdp sudo[2378373]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 03:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:54 nativespace-cdp sudo[2378376]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 03:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:54 nativespace-cdp sudo[2378380]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 03:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:55 nativespace-cdp sudo[2378383]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 03:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:55 nativespace-cdp sudo[2378392]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 03:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:55 nativespace-cdp sudo[2378395]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 03:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:55 nativespace-cdp sudo[2378398]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 03:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:55 nativespace-cdp sudo[2378401]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 03:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:55 nativespace-cdp sudo[2378404]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 03:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:55 nativespace-cdp sudo[2378407]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:57 nativespace-cdp sudo[2378505]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:57 nativespace-cdp sudo[2378515]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=chrisdal user-4=mcdermos user-5=david user-6=nbhavers user-7=careers user-8=lucy user-9=attlebor user-10=onlycont user-11=hodgsonmail user-12=outdoorc user-13=ranxterc user-14=branko user-15=romaldki user-16=nove user-17=boldover user-18=bakery user-19=crrtipdl user-20=sosevalu user-21=oubpgvbx user-22=tstardom user-23=what user-24=havantho user-25=cath user-26=sketchy user-27=nvihkvu user-28=stagingerris user-29=dancinggardener user-30=ladburyp user-31=kategilpin user-32=design user-33=sibtoncc user-34=asandcoc user-35=bwppodcast user-36=zebrapho user-37=steve user-38=fawcettd user-39=burydropin user-40=nsceres user-41=beauty user-42=darkstar user-43=eatspam user-44=dhyana user-45=nscdp user-46=putterfc user-47=leftie user-48=foods user-49=fortunaz
Sep  5 03:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=health2045 user-51=lkpier user-52=steakbridieme user-53=firstre5 user-54=donnychicago user-55=ctedorgu user-56=philmcph user-57=smrszyqg user-58=isleofwi user-59=nomistakes user-60=hidden user-61=tigerlet user-62=barbersh user-63=cambria1 user-64=cathski user-65=ninejimm user-66=reliable user-67=cwsocial user-68=paulmca1 user-69=howardon user-70=pugwash user-71=hirefootballgame user-72=eugincou user-73=courseme user-74=ultbcrra user-75=seftvta user-76=jonhartl user-77=firstres user-78=coursemc user-79=opaiscyx user-80=clarkass user-81=firstrel user-82=costestimatorco user-83=firstred user-84=highlegh user-85=southlon user-86=gilpin user-87=milloyco user-88=elecleis user-89=hubmaster user-90=putterfi user-91=fetch user-92=carsinyo user-93=accooper user-94=ianrayne user-95=connectedshoppin user-96=thqkgnbz user-97=nstriton user-98=brighto1 user-99=vivienn1 user-100=firstre2 user-101=oneoarco
Sep  5 03:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=battlere user-103=bedfords user-104=newstoda user-105=ggaaorgu user-106=belle user-107=bemadonn user-108=skyfirec user-109=alexadmin user-110=innovat1 user-111=stuartge user-112=askhform user-113=nativene user-114=booff user-115=markward user-116=foundation user-117=vantagep user-118=connect9 user-119=athenare user-120=lbscrmod user-121=maflemin user-122=ulsukarm user-123=jarvisin user-124=spectrum user-125=hodgesonweb user-126=theblack user-127=agproduc user-128=still user-129=stephani user-130=leereyn1 user-131=lakesan1 user-132=brmrjxl user-133=strathar user-134=atestord user-135=sarafoundation user-136=wilsonsw user-137=megacards user-138=musorguk user-139=martsblo user-140=dickemery123 user-141=ptkxhsbt user-142=hhdugcor user-143=lbhyisi user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  5 03:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:58 nativespace-cdp sudo[2378531]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:58 nativespace-cdp sudo[2378587]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GagPsGFFMfh7wUhV.~
Sep  5 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:58 nativespace-cdp sudo[2378590]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GagPsGFFMfh7wUhV.~'
Sep  5 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:58 nativespace-cdp sudo[2378598]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GagPsGFFMfh7wUhV.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:58 nativespace-cdp sudo[2378603]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:58 nativespace-cdp sudo[2378606]: pam_unix(sudo:session): session closed for user root
Sep  5 03:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 03:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:09:59 nativespace-cdp sudo[2378706]: pam_unix(sudo:session): session closed for user root
Sep  5 03:11:33 nativespace-cdp sshd[2379173]: Connection closed by 159.100.136.21 port 41818 [preauth]
Sep  5 03:16:33 nativespace-cdp sshd[2380143]: Connection closed by 159.100.136.21 port 52036 [preauth]
Sep  5 03:20:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 03:20:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 03:20:03 nativespace-cdp sudo[2380863]: pam_unix(sudo:session): session closed for user root
Sep  5 03:21:33 nativespace-cdp sshd[2381170]: Connection closed by 159.100.136.21 port 33782 [preauth]
Sep  5 03:26:33 nativespace-cdp sshd[2382174]: Connection closed by 159.100.136.21 port 44020 [preauth]
Sep  5 03:31:33 nativespace-cdp sshd[2383452]: Connection closed by 159.100.136.21 port 54060 [preauth]
Sep  5 03:36:33 nativespace-cdp sshd[2384396]: Connection closed by 159.100.136.21 port 36130 [preauth]
Sep  5 03:41:33 nativespace-cdp sshd[2385818]: Connection closed by 159.100.136.21 port 46064 [preauth]
Sep  5 03:46:33 nativespace-cdp sshd[2386831]: Connection closed by 159.100.136.21 port 56302 [preauth]
Sep  5 03:50:07 nativespace-cdp sshd[2387806]: Did not receive identification string from 199.45.155.103 port 38902
Sep  5 03:50:26 nativespace-cdp sshd[2387823]: Connection closed by 199.45.155.103 port 52298 [preauth]
Sep  5 03:51:33 nativespace-cdp sshd[2388085]: Connection closed by 159.100.136.21 port 38058 [preauth]
Sep  5 03:56:33 nativespace-cdp sshd[2389471]: Connection closed by 159.100.136.21 port 48332 [preauth]
Sep  5 04:01:33 nativespace-cdp sshd[2390508]: Connection closed by 159.100.136.21 port 58294 [preauth]
Sep  5 04:06:33 nativespace-cdp sshd[2391428]: Connection closed by 159.100.136.21 port 40382 [preauth]
Sep  5 04:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 04:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:53 nativespace-cdp sudo[2392094]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 04:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:53 nativespace-cdp sudo[2392097]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 04:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:54 nativespace-cdp sudo[2392100]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 04:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:54 nativespace-cdp sudo[2392105]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 04:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:55 nativespace-cdp sudo[2392110]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 04:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:55 nativespace-cdp sudo[2392120]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 04:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:55 nativespace-cdp sudo[2392123]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 04:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:55 nativespace-cdp sudo[2392126]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 04:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:55 nativespace-cdp sudo[2392129]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 04:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:55 nativespace-cdp sudo[2392132]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 04:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:55 nativespace-cdp sudo[2392135]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 04:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:57 nativespace-cdp sudo[2392204]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 04:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:57 nativespace-cdp sudo[2392226]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=dickemery123 user-3=ptkxhsbt user-4=hhdugcor user-5=lbhyisi user-6=magichat user-7=brmrjxl user-8=lakesan1 user-9=strathar user-10=atestord user-11=sarafoundation user-12=wilsonsw user-13=megacards user-14=musorguk user-15=jarvisin user-16=spectrum user-17=hodgesonweb user-18=theblack user-19=agproduc user-20=still user-21=stephani user-22=leereyn1 user-23=foundation user-24=booff user-25=markward user-26=vantagep user-27=connect9 user-28=athenare user-29=lbscrmod user-30=maflemin user-31=ulsukarm user-32=skyfirec user-33=alexadmin user-34=innovat1 user-35=stuartge user-36=askhform user-37=nativene user-38=nstriton user-39=brighto1 user-40=vivienn1 user-41=firstre2 user-42=oneoarco user-43=battlere user-44=bedfords user-45=newstoda user-46=ggaaorgu user-47=belle user-48=bemadonn
Sep  5 04:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=milloyco user-50=gilpin user-51=elecleis user-52=hubmaster user-53=putterfi user-54=fetch user-55=carsinyo user-56=accooper user-57=ianrayne user-58=connectedshoppin user-59=thqkgnbz user-60=ultbcrra user-61=seftvta user-62=jonhartl user-63=firstres user-64=opaiscyx user-65=coursemc user-66=firstrel user-67=clarkass user-68=costestimatorco user-69=firstred user-70=highlegh user-71=southlon user-72=cathski user-73=cambria1 user-74=ninejimm user-75=reliable user-76=cwsocial user-77=howardon user-78=paulmca1 user-79=pugwash user-80=hirefootballgame user-81=eugincou user-82=courseme user-83=nscdp user-84=putterfc user-85=foods user-86=leftie user-87=health2045 user-88=fortunaz user-89=lkpier user-90=donnychicago user-91=steakbridieme user-92=firstre5 user-93=ctedorgu user-94=philmcph user-95=isleofwi user-96=smrszyqg user-97=nomistakes user-98=hidden user-99=tigerlet user-100=barbersh user-101=fawcettd
Sep  5 04:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=burydropin user-103=nsceres user-104=beauty user-105=darkstar user-106=eatspam user-107=dhyana user-108=asandcoc user-109=sibtoncc user-110=bwppodcast user-111=zebrapho user-112=steve user-113=oubpgvbx user-114=tstardom user-115=what user-116=havantho user-117=cath user-118=sketchy user-119=nvihkvu user-120=dancinggardener user-121=stagingerris user-122=ladburyp user-123=kategilpin user-124=design user-125=nove user-126=boldover user-127=bakery user-128=crrtipdl user-129=sosevalu user-130=lucy user-131=attlebor user-132=onlycont user-133=outdoorc user-134=hodgsonmail user-135=ranxterc user-136=branko user-137=romaldki user-138=tomandle user-139=jennimil user-140=chrisdal user-141=mcdermos user-142=david user-143=careers user-144=nbhavers feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 04:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 04:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:58 nativespace-cdp sudo[2392231]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:58 nativespace-cdp sudo[2392237]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FTOkuXBXEUvPWTiB.~
Sep  5 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:58 nativespace-cdp sudo[2392240]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FTOkuXBXEUvPWTiB.~'
Sep  5 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:58 nativespace-cdp sudo[2392243]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FTOkuXBXEUvPWTiB.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:58 nativespace-cdp sudo[2392248]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:58 nativespace-cdp sudo[2392251]: pam_unix(sudo:session): session closed for user root
Sep  5 04:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 04:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:09:59 nativespace-cdp sudo[2392272]: pam_unix(sudo:session): session closed for user root
Sep  5 04:11:33 nativespace-cdp sshd[2392692]: Connection closed by 159.100.136.21 port 50374 [preauth]
Sep  5 04:16:33 nativespace-cdp sshd[2393930]: Connection closed by 159.100.136.21 port 60554 [preauth]
Sep  5 04:21:33 nativespace-cdp sshd[2395108]: Connection closed by 159.100.136.21 port 42302 [preauth]
Sep  5 04:23:15 nativespace-cdp sshd[2395339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.100.255.30  user=root
Sep  5 04:23:15 nativespace-cdp sshd[2395339]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 04:23:18 nativespace-cdp sshd[2395339]: Failed password for root from 200.100.255.30 port 50574 ssh2
Sep  5 04:23:18 nativespace-cdp sshd[2395339]: Received disconnect from 200.100.255.30 port 50574:11: Bye Bye [preauth]
Sep  5 04:23:18 nativespace-cdp sshd[2395339]: Disconnected from 200.100.255.30 port 50574 [preauth]
Sep  5 04:26:13 nativespace-cdp sshd[2396336]: Invalid user kashan from 152.32.190.221 port 16898
Sep  5 04:26:13 nativespace-cdp sshd[2396336]: input_userauth_request: invalid user kashan [preauth]
Sep  5 04:26:13 nativespace-cdp sshd[2396336]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 04:26:13 nativespace-cdp sshd[2396336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.190.221
Sep  5 04:26:15 nativespace-cdp sshd[2396336]: Failed password for invalid user kashan from 152.32.190.221 port 16898 ssh2
Sep  5 04:26:15 nativespace-cdp sshd[2396336]: Received disconnect from 152.32.190.221 port 16898:11: Bye Bye [preauth]
Sep  5 04:26:15 nativespace-cdp sshd[2396336]: Disconnected from 152.32.190.221 port 16898 [preauth]
Sep  5 04:26:33 nativespace-cdp sshd[2396383]: Connection closed by 159.100.136.21 port 52580 [preauth]
Sep  5 04:29:07 nativespace-cdp sshd[2396845]: Invalid user kamil from 138.197.108.161 port 53590
Sep  5 04:29:07 nativespace-cdp sshd[2396845]: input_userauth_request: invalid user kamil [preauth]
Sep  5 04:29:07 nativespace-cdp sshd[2396845]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 04:29:07 nativespace-cdp sshd[2396845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.108.161
Sep  5 04:29:08 nativespace-cdp sshd[2396845]: Failed password for invalid user kamil from 138.197.108.161 port 53590 ssh2
Sep  5 04:29:09 nativespace-cdp sshd[2396845]: Received disconnect from 138.197.108.161 port 53590:11: Bye Bye [preauth]
Sep  5 04:29:09 nativespace-cdp sshd[2396845]: Disconnected from 138.197.108.161 port 53590 [preauth]
Sep  5 04:31:22 nativespace-cdp sshd[2397450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.190.221  user=root
Sep  5 04:31:22 nativespace-cdp sshd[2397450]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 04:31:24 nativespace-cdp sshd[2397450]: Failed password for root from 152.32.190.221 port 57106 ssh2
Sep  5 04:31:25 nativespace-cdp sshd[2397450]: Received disconnect from 152.32.190.221 port 57106:11: Bye Bye [preauth]
Sep  5 04:31:25 nativespace-cdp sshd[2397450]: Disconnected from 152.32.190.221 port 57106 [preauth]
Sep  5 04:31:32 nativespace-cdp sshd[2397482]: Connection closed by 159.100.136.21 port 34352 [preauth]
Sep  5 04:31:50 nativespace-cdp sshd[2397533]: Invalid user boy from 138.197.108.161 port 60800
Sep  5 04:31:50 nativespace-cdp sshd[2397533]: input_userauth_request: invalid user boy [preauth]
Sep  5 04:31:50 nativespace-cdp sshd[2397533]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 04:31:50 nativespace-cdp sshd[2397533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.108.161
Sep  5 04:31:52 nativespace-cdp sshd[2397533]: Failed password for invalid user boy from 138.197.108.161 port 60800 ssh2
Sep  5 04:31:52 nativespace-cdp sshd[2397533]: Received disconnect from 138.197.108.161 port 60800:11: Bye Bye [preauth]
Sep  5 04:31:52 nativespace-cdp sshd[2397533]: Disconnected from 138.197.108.161 port 60800 [preauth]
Sep  5 04:32:01 nativespace-cdp sshd[2397580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.188.177.46  user=root
Sep  5 04:32:01 nativespace-cdp sshd[2397580]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 04:32:03 nativespace-cdp sshd[2397580]: Failed password for root from 103.188.177.46 port 48252 ssh2
Sep  5 04:32:03 nativespace-cdp sshd[2397580]: Received disconnect from 103.188.177.46 port 48252:11: Bye Bye [preauth]
Sep  5 04:32:03 nativespace-cdp sshd[2397580]: Disconnected from 103.188.177.46 port 48252 [preauth]
Sep  5 04:32:08 nativespace-cdp sshd[2397682]: Invalid user zwj from 152.32.190.221 port 15238
Sep  5 04:32:08 nativespace-cdp sshd[2397682]: input_userauth_request: invalid user zwj [preauth]
Sep  5 04:32:08 nativespace-cdp sshd[2397682]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 04:32:08 nativespace-cdp sshd[2397682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.190.221
Sep  5 04:32:09 nativespace-cdp sshd[2397682]: Failed password for invalid user zwj from 152.32.190.221 port 15238 ssh2
Sep  5 04:32:10 nativespace-cdp sshd[2397682]: Received disconnect from 152.32.190.221 port 15238:11: Bye Bye [preauth]
Sep  5 04:32:10 nativespace-cdp sshd[2397682]: Disconnected from 152.32.190.221 port 15238 [preauth]
Sep  5 04:32:32 nativespace-cdp sshd[2397841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.108.161  user=root
Sep  5 04:32:32 nativespace-cdp sshd[2397841]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 04:32:34 nativespace-cdp sshd[2397841]: Failed password for root from 138.197.108.161 port 44518 ssh2
Sep  5 04:32:34 nativespace-cdp sshd[2397841]: Received disconnect from 138.197.108.161 port 44518:11: Bye Bye [preauth]
Sep  5 04:32:34 nativespace-cdp sshd[2397841]: Disconnected from 138.197.108.161 port 44518 [preauth]
Sep  5 04:33:07 nativespace-cdp sshd[2398023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.188.177.46  user=root
Sep  5 04:33:07 nativespace-cdp sshd[2398023]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 04:33:09 nativespace-cdp sshd[2398023]: Failed password for root from 103.188.177.46 port 45692 ssh2
Sep  5 04:33:09 nativespace-cdp sshd[2398023]: Received disconnect from 103.188.177.46 port 45692:11: Bye Bye [preauth]
Sep  5 04:33:09 nativespace-cdp sshd[2398023]: Disconnected from 103.188.177.46 port 45692 [preauth]
Sep  5 04:34:25 nativespace-cdp sshd[2398785]: Invalid user ekp from 103.188.177.46 port 59518
Sep  5 04:34:25 nativespace-cdp sshd[2398785]: input_userauth_request: invalid user ekp [preauth]
Sep  5 04:34:25 nativespace-cdp sshd[2398785]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 04:34:25 nativespace-cdp sshd[2398785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.188.177.46
Sep  5 04:34:26 nativespace-cdp sshd[2398785]: Failed password for invalid user ekp from 103.188.177.46 port 59518 ssh2
Sep  5 04:34:27 nativespace-cdp sshd[2398785]: Received disconnect from 103.188.177.46 port 59518:11: Bye Bye [preauth]
Sep  5 04:34:27 nativespace-cdp sshd[2398785]: Disconnected from 103.188.177.46 port 59518 [preauth]
Sep  5 04:36:33 nativespace-cdp sshd[2400109]: Connection closed by 159.100.136.21 port 44356 [preauth]
Sep  5 04:37:12 nativespace-cdp sshd[2400483]: Invalid user spider from 200.100.255.30 port 36583
Sep  5 04:37:12 nativespace-cdp sshd[2400483]: input_userauth_request: invalid user spider [preauth]
Sep  5 04:37:12 nativespace-cdp sshd[2400483]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 04:37:12 nativespace-cdp sshd[2400483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.100.255.30
Sep  5 04:37:14 nativespace-cdp sshd[2400483]: Failed password for invalid user spider from 200.100.255.30 port 36583 ssh2
Sep  5 04:37:14 nativespace-cdp sshd[2400483]: Received disconnect from 200.100.255.30 port 36583:11: Bye Bye [preauth]
Sep  5 04:37:14 nativespace-cdp sshd[2400483]: Disconnected from 200.100.255.30 port 36583 [preauth]
Sep  5 04:38:32 nativespace-cdp sshd[2400695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.100.255.30  user=root
Sep  5 04:38:32 nativespace-cdp sshd[2400695]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 04:38:34 nativespace-cdp sshd[2400695]: Failed password for root from 200.100.255.30 port 49880 ssh2
Sep  5 04:38:34 nativespace-cdp sshd[2400695]: Received disconnect from 200.100.255.30 port 49880:11: Bye Bye [preauth]
Sep  5 04:38:34 nativespace-cdp sshd[2400695]: Disconnected from 200.100.255.30 port 49880 [preauth]
Sep  5 04:41:33 nativespace-cdp sshd[2401678]: Connection closed by 159.100.136.21 port 54316 [preauth]
Sep  5 04:46:33 nativespace-cdp sshd[2402770]: Connection closed by 159.100.136.21 port 36296 [preauth]
Sep  5 04:51:33 nativespace-cdp sshd[2403875]: Connection closed by 159.100.136.21 port 46298 [preauth]
Sep  5 04:56:33 nativespace-cdp sshd[2404903]: Connection closed by 159.100.136.21 port 56370 [preauth]
Sep  5 04:56:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 04:56:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:56:58 nativespace-cdp sudo[2404958]: pam_unix(sudo:session): session closed for user root
Sep  5 04:56:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 04:56:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:56:58 nativespace-cdp sudo[2404968]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 04:57:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:03 nativespace-cdp sudo[2404988]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=steve user-2=zebrapho user-3=bwppodcast user-4=asandcoc user-5=sibtoncc user-6=dhyana user-7=darkstar user-8=eatspam user-9=beauty user-10=nsceres user-11=fawcettd user-12=burydropin user-13=barbersh user-14=tigerlet user-15=nomistakes user-16=hidden user-17=smrszyqg user-18=isleofwi user-19=steakbridieme user-20=firstre5 user-21=donnychicago user-22=philmcph user-23=ctedorgu user-24=lkpier user-25=leftie user-26=foods user-27=fortunaz user-28=health2045 user-29=nscdp user-30=putterfc user-31=courseme user-32=eugincou user-33=hirefootballgame user-34=cwsocial user-35=howardon user-36=pugwash user-37=paulmca1 user-38=ninejimm user-39=reliable user-40=cathski user-41=cambria1 user-42=david user-43=nbhavers user-44=careers user-45=mcdermos user-46=chrisdal user-47=jennimil user-48=tomandle
Sep  5 04:57:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=branko user-51=ranxterc user-52=outdoorc user-53=hodgsonmail user-54=onlycont user-55=lucy user-56=attlebor user-57=crrtipdl user-58=sosevalu user-59=bakery user-60=boldover user-61=nove user-62=design user-63=kategilpin user-64=dancinggardener user-65=stagingerris user-66=ladburyp user-67=nvihkvu user-68=havantho user-69=sketchy user-70=cath user-71=what user-72=tstardom user-73=oubpgvbx user-74=ulsukarm user-75=lbscrmod user-76=maflemin user-77=vantagep user-78=connect9 user-79=athenare user-80=markward user-81=foundation user-82=booff user-83=leereyn1 user-84=stephani user-85=agproduc user-86=still user-87=theblack user-88=hodgesonweb user-89=spectrum user-90=jarvisin user-91=megacards user-92=musorguk user-93=wilsonsw user-94=atestord user-95=sarafoundation user-96=strathar user-97=lakesan1 user-98=brmrjxl user-99=magichat user-100=hhdugcor user-101=lbhyisi user-102=ptkxhsbt
Sep  5 04:57:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=dickemery123 user-104=martsblo user-105=highlegh user-106=southlon user-107=firstred user-108=costestimatorco user-109=firstrel user-110=clarkass user-111=opaiscyx user-112=coursemc user-113=firstres user-114=ultbcrra user-115=seftvta user-116=jonhartl user-117=thqkgnbz user-118=connectedshoppin user-119=ianrayne user-120=accooper user-121=fetch user-122=carsinyo user-123=hubmaster user-124=putterfi user-125=elecleis user-126=gilpin user-127=milloyco user-128=bemadonn user-129=newstoda user-130=belle user-131=ggaaorgu user-132=bedfords user-133=oneoarco user-134=battlere user-135=vivienn1 user-136=firstre2 user-137=nstriton user-138=brighto1 user-139=nativene user-140=askhform user-141=stuartge user-142=innovat1 user-143=alexadmin user-144=skyfirec feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 04:57:03 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 04:57:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:04 nativespace-cdp sudo[2404992]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  5 04:57:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:06 nativespace-cdp sudo[2405111]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep  5 04:57:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:06 nativespace-cdp sudo[2405163]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  5 04:57:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:57:28 nativespace-cdp sudo[2405265]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:57:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  5 04:57:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:29 nativespace-cdp sudo[2405272]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep  5 04:57:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:31 nativespace-cdp sudo[2405276]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep  5 04:57:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:33 nativespace-cdp sudo[2405284]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  5 04:57:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:33 nativespace-cdp sudo[2405296]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep  5 04:57:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:38 nativespace-cdp sudo[2405316]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep  5 04:57:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:42 nativespace-cdp sudo[2405328]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep  5 04:57:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:43 nativespace-cdp sudo[2405346]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep  5 04:57:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:43 nativespace-cdp sudo[2405351]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep  5 04:57:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:57:54 nativespace-cdp sudo[2405505]: pam_unix(sudo:session): session closed for user root
Sep  5 04:57:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  5 04:57:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:57:57 nativespace-cdp sudo[2405564]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:57:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  5 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  5 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  5 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:57:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:57:58 nativespace-cdp sudo[2405570]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:57:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  5 04:57:58 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  5 04:57:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  5 04:57:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:57:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:58:20 nativespace-cdp sudo[2405579]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:58:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  5 04:58:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:58:32 nativespace-cdp sudo[2405749]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:58:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  5 04:58:32 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  5 04:58:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  5 04:58:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:58:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:58:32 nativespace-cdp sudo[2405755]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:58:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  5 04:58:32 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  5 04:58:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  5 04:58:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:58:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:58:32 nativespace-cdp sudo[2405762]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:58:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  5 04:58:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:58:34 nativespace-cdp sudo[2405800]: pam_unix(sudo:session): session closed for user root
Sep  5 04:58:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep  5 04:58:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:58:34 nativespace-cdp sudo[2405804]: pam_unix(sudo:session): session closed for user root
Sep  5 04:58:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  5 04:58:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 04:58:46 nativespace-cdp sudo[2405897]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 04:58:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep  5 04:58:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:58:46 nativespace-cdp sudo[2405904]: pam_unix(sudo:session): session closed for user root
Sep  5 04:58:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep  5 04:58:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:58:47 nativespace-cdp sudo[2405910]: pam_unix(sudo:session): session closed for user root
Sep  5 04:58:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  5 04:58:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:58:47 nativespace-cdp sudo[2405914]: pam_unix(sudo:session): session closed for user root
Sep  5 04:58:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep  5 04:58:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:58:48 nativespace-cdp sudo[2405929]: pam_unix(sudo:session): session closed for user root
Sep  5 04:58:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep  5 04:58:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:58:48 nativespace-cdp sudo[2405934]: pam_unix(sudo:session): session closed for user root
Sep  5 04:58:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep  5 04:58:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:58:54 nativespace-cdp sudo[2406008]: pam_unix(sudo:session): session closed for user root
Sep  5 04:58:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  5 04:58:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 04:58:56 nativespace-cdp sudo[2406068]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 04:58:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  5 04:58:56 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  5 04:58:56 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  5 04:58:56 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:58:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 04:58:57 nativespace-cdp sudo[2406074]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 04:58:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  5 04:58:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  5 04:58:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  5 04:58:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:58:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 04:59:10 nativespace-cdp sudo[2406090]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 04:59:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  5 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  5 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  5 04:59:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:59:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 04:59:12 nativespace-cdp sudo[2406182]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  5 04:59:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 04:59:18 nativespace-cdp sudo[2406341]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:59:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 04:59:18 nativespace-cdp sudo[2406348]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:59:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 04:59:18 nativespace-cdp sudo[2406354]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  5 04:59:18 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:59:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 04:59:18 nativespace-cdp sudo[2406360]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 04:59:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  5 04:59:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:21 nativespace-cdp sudo[2406395]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep  5 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:21 nativespace-cdp sudo[2406400]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep  5 04:59:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:26 nativespace-cdp sudo[2406428]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep  5 04:59:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:27 nativespace-cdp sudo[2406434]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  5 04:59:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  5 04:59:27 nativespace-cdp sudo[2406445]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  5 04:59:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep  5 04:59:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:28 nativespace-cdp sudo[2406452]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep  5 04:59:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:28 nativespace-cdp sudo[2406457]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep  5 04:59:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:29 nativespace-cdp sudo[2406461]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  5 04:59:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:29 nativespace-cdp sudo[2406468]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  5 04:59:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:59:37 nativespace-cdp sudo[2406527]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:59:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  5 04:59:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:38 nativespace-cdp sudo[2406534]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  5 04:59:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:38 nativespace-cdp sudo[2406540]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep  5 04:59:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:39 nativespace-cdp sudo[2406553]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep  5 04:59:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 04:59:44 nativespace-cdp sudo[2406625]: pam_unix(sudo:session): session closed for user root
Sep  5 04:59:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  5 04:59:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:59:46 nativespace-cdp sudo[2406681]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:59:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  5 04:59:46 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  5 04:59:46 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  5 04:59:46 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:59:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 04:59:47 nativespace-cdp sudo[2406687]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 04:59:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  5 04:59:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  5 04:59:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  5 04:59:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 04:59:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 05:00:01 nativespace-cdp sudo[2406697]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 05:00:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  5 05:00:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 05:00:07 nativespace-cdp sudo[2407022]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 05:00:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  5 05:00:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  5 05:00:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  5 05:00:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 05:00:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 05:00:07 nativespace-cdp sudo[2407028]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 05:00:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  5 05:00:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  5 05:00:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  5 05:00:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  5 05:00:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 05:00:07 nativespace-cdp sudo[2407034]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 05:00:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  5 05:00:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:10 nativespace-cdp sudo[2407072]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep  5 05:00:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:10 nativespace-cdp sudo[2407076]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  5 05:00:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  5 05:00:19 nativespace-cdp sudo[2407138]: pam_unix(sudo:session): session closed for user fortunaz
Sep  5 05:00:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep  5 05:00:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:19 nativespace-cdp sudo[2407144]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep  5 05:00:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:19 nativespace-cdp sudo[2407148]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  5 05:00:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:19 nativespace-cdp sudo[2407152]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep  5 05:00:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:22 nativespace-cdp sudo[2407167]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  5 05:00:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:23 nativespace-cdp sudo[2407185]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep  5 05:00:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:29 nativespace-cdp sudo[2407255]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=steve WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "Category Order and Taxonomy Terms Order" on ONE | OAR (https://oneoar.co.uk). Installed version: 1.7.9. Available version: 1.8.4.<br/><br/>2. Plugin "Jetpack" on Limekilns Heritage Trust (https://limekilnspier.org.uk). Installed version: 13.1.1. Available version: 13.8.<br/><br/>3. Plugin "Category Order and Taxonomy Terms Order" on Pinstripe Inventories (https://pinstripe.services). Installed version: 1.7.9. Available version: 1.8.4.<br/><br/>4. Plugin "Jetpack" on Pinstripe Inventories (https://pinstripe.services). Installed version: 12.8.1. Available version: 13.8.<br/><br/>' installed_updates_text= installed_updates_list=
Sep  5 05:00:43 nativespace-cdp sudo: wp-toolkit : (command continued) 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep  5 05:00:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:43 nativespace-cdp sudo[2407446]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep  5 05:00:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:51 nativespace-cdp sudo[2407568]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  5 05:00:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:52 nativespace-cdp sudo[2407571]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  5 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:52 nativespace-cdp sudo[2407575]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  5 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:52 nativespace-cdp sudo[2407578]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  5 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:52 nativespace-cdp sudo[2407581]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  5 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:52 nativespace-cdp sudo[2407584]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  5 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:52 nativespace-cdp sudo[2407587]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  5 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:52 nativespace-cdp sudo[2407591]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407596]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407599]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407602]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407605]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407608]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407611]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407614]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407617]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407620]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407623]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407626]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407629]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407632]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407635]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407638]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407641]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407644]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407647]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407650]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407653]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407656]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407659]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407662]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407665]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407668]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407671]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407674]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407677]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407680]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407683]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407687]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407690]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:53 nativespace-cdp sudo[2407693]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407696]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407699]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407702]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407705]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407708]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407712]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407715]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407718]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407721]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407724]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407727]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407730]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407733]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407737]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407740]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407743]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407746]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407749]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407752]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407755]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407758]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407761]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407764]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407768]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407771]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407774]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407777]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407780]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407783]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407786]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407790]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407793]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:54 nativespace-cdp sudo[2407796]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407799]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407802]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407805]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407808]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407811]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407814]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407817]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407820]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407823]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407826]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407829]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407833]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407836]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407839]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407842]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407845]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407848]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407851]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407855]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407858]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407861]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407864]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407867]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407870]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407873]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407876]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407879]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407882]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407886]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:55 nativespace-cdp sudo[2407889]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407892]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407895]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407898]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407901]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407904]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407907]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407910]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407913]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407916]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407919]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407922]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407925]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407928]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407931]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407935]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407938]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407941]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407944]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407947]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407950]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407953]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407956]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407959]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407962]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407965]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407968]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407972]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407975]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407978]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407982]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407985]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407988]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407991]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407995]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:56 nativespace-cdp sudo[2407999]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408002]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408005]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408008]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408011]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408014]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408017]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408020]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408023]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408026]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408029]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408032]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408035]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408038]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408041]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408044]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408047]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408050]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408053]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408056]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408059]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408063]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408066]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408069]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408072]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408075]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408078]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408081]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408084]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408088]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408091]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408094]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408097]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408100]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408104]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  5 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:57 nativespace-cdp sudo[2408107]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408110]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408114]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408117]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408120]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408123]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408126]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408129]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408132]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408136]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408139]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408142]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408145]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408148]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408151]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408154]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408157]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408160]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408163]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408166]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408169]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408172]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408175]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408178]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408181]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408184]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408187]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408190]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408193]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408196]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408199]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408202]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408205]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408208]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408211]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408215]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:58 nativespace-cdp sudo[2408218]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408221]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408224]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408227]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408230]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408233]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408236]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408239]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408242]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408245]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408248]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408251]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408254]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408257]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408260]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408263]: pam_unix(sudo:session): session closed for user root
Sep  5 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  5 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:00:59 nativespace-cdp sudo[2408266]: pam_unix(sudo:session): session closed for user root
Sep  5 05:01:33 nativespace-cdp sshd[2408410]: Connection closed by 159.100.136.21 port 38124 [preauth]
Sep  5 05:06:33 nativespace-cdp sshd[2409461]: Connection closed by 159.100.136.21 port 48416 [preauth]
Sep  5 05:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 05:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:09:59 nativespace-cdp sudo[2410299]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:00 nativespace-cdp sudo[2410308]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:00 nativespace-cdp sudo[2410311]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:00 nativespace-cdp sudo[2410350]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:03 nativespace-cdp sudo[2410356]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:03 nativespace-cdp sudo[2410535]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:03 nativespace-cdp sudo[2410539]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:03 nativespace-cdp sudo[2410543]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:03 nativespace-cdp sudo[2410546]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:03 nativespace-cdp sudo[2410549]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:03 nativespace-cdp sudo[2410552]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 05:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:05 nativespace-cdp sudo[2410563]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 05:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:06 nativespace-cdp sudo[2410567]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=design user-2=kategilpin user-3=ladburyp user-4=stagingerris user-5=dancinggardener user-6=nvihkvu user-7=cath user-8=sketchy user-9=havantho user-10=what user-11=tstardom user-12=oubpgvbx user-13=sosevalu user-14=crrtipdl user-15=bakery user-16=boldover user-17=nove user-18=romaldki user-19=branko user-20=ranxterc user-21=outdoorc user-22=hodgsonmail user-23=onlycont user-24=attlebor user-25=lucy user-26=careers user-27=nbhavers user-28=david user-29=mcdermos user-30=chrisdal user-31=jennimil user-32=tomandle user-33=courseme user-34=eugincou user-35=hirefootballgame user-36=paulmca1 user-37=howardon user-38=pugwash user-39=cwsocial user-40=reliable user-41=ninejimm user-42=cambria1 user-43=cathski user-44=tigerlet user-45=barbersh user-46=hidden user-47=nomistakes user-48=smrszyqg
Sep  5 05:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=isleofwi user-50=philmcph user-51=ctedorgu user-52=steakbridieme user-53=firstre5 user-54=donnychicago user-55=lkpier user-56=health2045 user-57=fortunaz user-58=foods user-59=leftie user-60=putterfc user-61=nscdp user-62=dhyana user-63=eatspam user-64=darkstar user-65=beauty user-66=nsceres user-67=burydropin user-68=fawcettd user-69=steve user-70=zebrapho user-71=bwppodcast user-72=sibtoncc user-73=asandcoc user-74=nativene user-75=stuartge user-76=askhform user-77=innovat1 user-78=alexadmin user-79=skyfirec user-80=bemadonn user-81=ggaaorgu user-82=belle user-83=newstoda user-84=bedfords user-85=battlere user-86=oneoarco user-87=firstre2 user-88=vivienn1 user-89=brighto1 user-90=nstriton user-91=thqkgnbz user-92=connectedshoppin user-93=ianrayne user-94=accooper user-95=carsinyo user-96=fetch user-97=putterfi user-98=hubmaster user-99=elecleis user-100=gilpin user-101=milloyco user-102=southlon
Sep  5 05:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=highlegh user-104=firstred user-105=costestimatorco user-106=firstrel user-107=clarkass user-108=coursemc user-109=opaiscyx user-110=firstres user-111=seftvta user-112=jonhartl user-113=ultbcrra user-114=magichat user-115=lbhyisi user-116=hhdugcor user-117=ptkxhsbt user-118=dickemery123 user-119=martsblo user-120=musorguk user-121=megacards user-122=wilsonsw user-123=sarafoundation user-124=atestord user-125=strathar user-126=brmrjxl user-127=lakesan1 user-128=leereyn1 user-129=stephani user-130=still user-131=agproduc user-132=hodgesonweb user-133=theblack user-134=spectrum user-135=jarvisin user-136=ulsukarm user-137=maflemin user-138=lbscrmod user-139=connect9 user-140=athenare user-141=vantagep user-142=foundation user-143=markward user-144=booff feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 05:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 05:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:06 nativespace-cdp sudo[2410572]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 05:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:07 nativespace-cdp sudo[2410577]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1fNkU6aZvQLrET5X.~
Sep  5 05:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:07 nativespace-cdp sudo[2410581]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1fNkU6aZvQLrET5X.~'
Sep  5 05:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:07 nativespace-cdp sudo[2410584]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1fNkU6aZvQLrET5X.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 05:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:07 nativespace-cdp sudo[2410588]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 05:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:07 nativespace-cdp sudo[2410591]: pam_unix(sudo:session): session closed for user root
Sep  5 05:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 05:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 05:10:18 nativespace-cdp sudo[2410637]: pam_unix(sudo:session): session closed for user root
Sep  5 05:11:33 nativespace-cdp sshd[2410875]: Connection closed by 159.100.136.21 port 58406 [preauth]
Sep  5 05:16:33 nativespace-cdp sshd[2411856]: Connection closed by 159.100.136.21 port 40366 [preauth]
Sep  5 05:21:33 nativespace-cdp sshd[2412814]: Connection closed by 159.100.136.21 port 50352 [preauth]
Sep  5 05:26:33 nativespace-cdp sshd[2413749]: Connection closed by 159.100.136.21 port 60604 [preauth]
Sep  5 05:31:33 nativespace-cdp sshd[2414928]: Connection closed by 159.100.136.21 port 42396 [preauth]
Sep  5 05:35:08 nativespace-cdp su: pam_unix(su:session): session opened for user hubmaster by (uid=0)
Sep  5 05:35:08 nativespace-cdp su[2415623]: pam_unix(su:session): session closed for user hubmaster
Sep  5 05:36:33 nativespace-cdp sshd[2416014]: Connection closed by 159.100.136.21 port 52512 [preauth]
Sep  5 05:41:33 nativespace-cdp sshd[2417384]: Connection closed by 159.100.136.21 port 34230 [preauth]
Sep  5 05:46:33 nativespace-cdp sshd[2418449]: Connection closed by 159.100.136.21 port 44444 [preauth]
Sep  5 05:51:33 nativespace-cdp sshd[2419558]: Connection closed by 159.100.136.21 port 54454 [preauth]
Sep  5 05:56:33 nativespace-cdp sshd[2420702]: Connection closed by 159.100.136.21 port 36468 [preauth]
Sep  5 06:01:33 nativespace-cdp sshd[2421820]: Connection closed by 159.100.136.21 port 46456 [preauth]
Sep  5 06:06:33 nativespace-cdp sshd[2423023]: Connection closed by 159.100.136.21 port 56760 [preauth]
Sep  5 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:53 nativespace-cdp sudo[2423615]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:53 nativespace-cdp sudo[2423620]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:54 nativespace-cdp sudo[2423625]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 06:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:54 nativespace-cdp sudo[2423632]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 06:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:55 nativespace-cdp sudo[2423638]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:55 nativespace-cdp sudo[2423647]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:55 nativespace-cdp sudo[2423652]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:55 nativespace-cdp sudo[2423658]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:55 nativespace-cdp sudo[2423666]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:55 nativespace-cdp sudo[2423671]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:56 nativespace-cdp sudo[2423689]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:57 nativespace-cdp sudo[2423728]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:58 nativespace-cdp sudo[2423741]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=asandcoc user-2=sibtoncc user-3=steve user-4=bwppodcast user-5=zebrapho user-6=nsceres user-7=burydropin user-8=fawcettd user-9=dhyana user-10=beauty user-11=eatspam user-12=darkstar user-13=lkpier user-14=philmcph user-15=ctedorgu user-16=steakbridieme user-17=firstre5 user-18=donnychicago user-19=putterfc user-20=nscdp user-21=fortunaz user-22=health2045 user-23=leftie user-24=foods user-25=hidden user-26=nomistakes user-27=barbersh user-28=tigerlet user-29=smrszyqg user-30=isleofwi user-31=paulmca1 user-32=howardon user-33=pugwash user-34=cwsocial user-35=cathski user-36=cambria1 user-37=reliable user-38=ninejimm user-39=eugincou user-40=courseme user-41=hirefootballgame user-42=jennimil user-43=tomandle user-44=nbhavers user-45=careers user-46=david user-47=chrisdal user-48=mcdermos
Sep  5 06:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=attlebor user-51=lucy user-52=romaldki user-53=outdoorc user-54=ranxterc user-55=hodgsonmail user-56=branko user-57=boldover user-58=nove user-59=bakery user-60=sosevalu user-61=crrtipdl user-62=cath user-63=sketchy user-64=havantho user-65=nvihkvu user-66=tstardom user-67=oubpgvbx user-68=what user-69=design user-70=ladburyp user-71=stagingerris user-72=dancinggardener user-73=kategilpin user-74=athenare user-75=connect9 user-76=vantagep user-77=maflemin user-78=lbscrmod user-79=booff user-80=markward user-81=foundation user-82=ulsukarm user-83=spectrum user-84=theblack user-85=hodgesonweb user-86=jarvisin user-87=stephani user-88=leereyn1 user-89=still user-90=agproduc user-91=strathar user-92=sarafoundation user-93=atestord user-94=lakesan1 user-95=brmrjxl user-96=musorguk user-97=megacards user-98=wilsonsw user-99=dickemery123 user-100=ptkxhsbt user-101=martsblo user-102=magichat
Sep  5 06:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=lbhyisi user-104=hhdugcor user-105=coursemc user-106=opaiscyx user-107=seftvta user-108=jonhartl user-109=ultbcrra user-110=firstres user-111=firstred user-112=southlon user-113=highlegh user-114=firstrel user-115=clarkass user-116=costestimatorco user-117=putterfi user-118=hubmaster user-119=carsinyo user-120=fetch user-121=gilpin user-122=milloyco user-123=elecleis user-124=connectedshoppin user-125=thqkgnbz user-126=accooper user-127=ianrayne user-128=firstre2 user-129=vivienn1 user-130=battlere user-131=oneoarco user-132=brighto1 user-133=nstriton user-134=ggaaorgu user-135=belle user-136=newstoda user-137=bemadonn user-138=bedfords user-139=alexadmin user-140=skyfirec user-141=nativene user-142=innovat1 user-143=askhform user-144=stuartge feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 06:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 06:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:58 nativespace-cdp sudo[2423770]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 06:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:58 nativespace-cdp sudo[2423807]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-J4mfrMLNTc1selUu.~
Sep  5 06:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:58 nativespace-cdp sudo[2423822]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-J4mfrMLNTc1selUu.~'
Sep  5 06:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:58 nativespace-cdp sudo[2423826]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-J4mfrMLNTc1selUu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 06:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:59 nativespace-cdp sudo[2423832]: pam_unix(sudo:session): session closed for user root
Sep  5 06:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 06:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:09:59 nativespace-cdp sudo[2423849]: pam_unix(sudo:session): session closed for user root
Sep  5 06:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 06:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 06:10:03 nativespace-cdp sudo[2424193]: pam_unix(sudo:session): session closed for user root
Sep  5 06:11:33 nativespace-cdp sshd[2424525]: Connection closed by 159.100.136.21 port 38446 [preauth]
Sep  5 06:16:33 nativespace-cdp sshd[2425716]: Connection closed by 159.100.136.21 port 48356 [preauth]
Sep  5 06:21:33 nativespace-cdp sshd[2426729]: Connection closed by 159.100.136.21 port 58340 [preauth]
Sep  5 06:26:33 nativespace-cdp sshd[2427858]: Connection closed by 159.100.136.21 port 40352 [preauth]
Sep  5 06:31:33 nativespace-cdp sshd[2429135]: Connection closed by 159.100.136.21 port 50394 [preauth]
Sep  5 06:36:33 nativespace-cdp sshd[2430261]: Connection closed by 159.100.136.21 port 60686 [preauth]
Sep  5 06:41:33 nativespace-cdp sshd[2431667]: Connection closed by 159.100.136.21 port 42432 [preauth]
Sep  5 06:46:33 nativespace-cdp sshd[2432824]: Connection closed by 159.100.136.21 port 52642 [preauth]
Sep  5 06:51:33 nativespace-cdp sshd[2433983]: Connection closed by 159.100.136.21 port 34414 [preauth]
Sep  5 06:51:52 nativespace-cdp sshd[2434025]: Invalid user nodeproxy from 142.93.241.253 port 45554
Sep  5 06:51:52 nativespace-cdp sshd[2434025]: input_userauth_request: invalid user nodeproxy [preauth]
Sep  5 06:51:52 nativespace-cdp sshd[2434025]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 06:51:52 nativespace-cdp sshd[2434025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.241.253
Sep  5 06:51:54 nativespace-cdp sshd[2434025]: Failed password for invalid user nodeproxy from 142.93.241.253 port 45554 ssh2
Sep  5 06:51:54 nativespace-cdp sshd[2434025]: Received disconnect from 142.93.241.253 port 45554:11: Bye Bye [preauth]
Sep  5 06:51:54 nativespace-cdp sshd[2434025]: Disconnected from 142.93.241.253 port 45554 [preauth]
Sep  5 06:55:12 nativespace-cdp sshd[2434704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.199.162.173  user=root
Sep  5 06:55:12 nativespace-cdp sshd[2434704]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 06:55:14 nativespace-cdp sshd[2434704]: Failed password for root from 104.199.162.173 port 58734 ssh2
Sep  5 06:55:14 nativespace-cdp sshd[2434704]: Received disconnect from 104.199.162.173 port 58734:11: Bye Bye [preauth]
Sep  5 06:55:14 nativespace-cdp sshd[2434704]: Disconnected from 104.199.162.173 port 58734 [preauth]
Sep  5 06:56:33 nativespace-cdp sshd[2435062]: Connection closed by 159.100.136.21 port 44652 [preauth]
Sep  5 06:56:55 nativespace-cdp sshd[2435144]: Invalid user jay from 104.199.162.173 port 50678
Sep  5 06:56:55 nativespace-cdp sshd[2435144]: input_userauth_request: invalid user jay [preauth]
Sep  5 06:56:55 nativespace-cdp sshd[2435144]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 06:56:55 nativespace-cdp sshd[2435144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.199.162.173
Sep  5 06:56:57 nativespace-cdp sshd[2435144]: Failed password for invalid user jay from 104.199.162.173 port 50678 ssh2
Sep  5 06:56:57 nativespace-cdp sshd[2435144]: Received disconnect from 104.199.162.173 port 50678:11: Bye Bye [preauth]
Sep  5 06:56:57 nativespace-cdp sshd[2435144]: Disconnected from 104.199.162.173 port 50678 [preauth]
Sep  5 06:57:04 nativespace-cdp sshd[2435175]: Invalid user librenms from 142.93.241.253 port 58462
Sep  5 06:57:04 nativespace-cdp sshd[2435175]: input_userauth_request: invalid user librenms [preauth]
Sep  5 06:57:04 nativespace-cdp sshd[2435175]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 06:57:04 nativespace-cdp sshd[2435175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.241.253
Sep  5 06:57:06 nativespace-cdp sshd[2435175]: Failed password for invalid user librenms from 142.93.241.253 port 58462 ssh2
Sep  5 06:57:06 nativespace-cdp sshd[2435175]: Received disconnect from 142.93.241.253 port 58462:11: Bye Bye [preauth]
Sep  5 06:57:06 nativespace-cdp sshd[2435175]: Disconnected from 142.93.241.253 port 58462 [preauth]
Sep  5 06:57:45 nativespace-cdp sshd[2435566]: Invalid user fabio from 142.93.241.253 port 43412
Sep  5 06:57:45 nativespace-cdp sshd[2435566]: input_userauth_request: invalid user fabio [preauth]
Sep  5 06:57:45 nativespace-cdp sshd[2435566]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 06:57:45 nativespace-cdp sshd[2435566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.241.253
Sep  5 06:57:47 nativespace-cdp sshd[2435566]: Failed password for invalid user fabio from 142.93.241.253 port 43412 ssh2
Sep  5 06:57:53 nativespace-cdp sshd[2435646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.199.162.173  user=root
Sep  5 06:57:53 nativespace-cdp sshd[2435646]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 06:57:55 nativespace-cdp sshd[2435646]: Failed password for root from 104.199.162.173 port 37856 ssh2
Sep  5 06:57:55 nativespace-cdp sshd[2435646]: Received disconnect from 104.199.162.173 port 37856:11: Bye Bye [preauth]
Sep  5 06:57:55 nativespace-cdp sshd[2435646]: Disconnected from 104.199.162.173 port 37856 [preauth]
Sep  5 07:01:33 nativespace-cdp sshd[2436860]: Connection closed by 159.100.136.21 port 54642 [preauth]
Sep  5 07:06:33 nativespace-cdp sshd[2437946]: Connection closed by 159.100.136.21 port 36730 [preauth]
Sep  5 07:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 07:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:00 nativespace-cdp sudo[2438611]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 07:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:00 nativespace-cdp sudo[2438616]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 07:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:02 nativespace-cdp sudo[2438621]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 07:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:02 nativespace-cdp sudo[2438713]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 07:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:06 nativespace-cdp sudo[2438716]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 07:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:06 nativespace-cdp sudo[2438759]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 07:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:06 nativespace-cdp sudo[2438762]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 07:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:06 nativespace-cdp sudo[2438766]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 07:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:06 nativespace-cdp sudo[2438770]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 07:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:06 nativespace-cdp sudo[2438773]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 07:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:06 nativespace-cdp sudo[2438776]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 07:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:08 nativespace-cdp sudo[2438784]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 07:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:09 nativespace-cdp sudo[2438789]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=havantho user-2=sketchy user-3=cath user-4=nvihkvu user-5=oubpgvbx user-6=tstardom user-7=what user-8=design user-9=dancinggardener user-10=stagingerris user-11=ladburyp user-12=kategilpin user-13=boldover user-14=nove user-15=bakery user-16=crrtipdl user-17=sosevalu user-18=onlycont user-19=lucy user-20=attlebor user-21=romaldki user-22=ranxterc user-23=outdoorc user-24=hodgsonmail user-25=branko user-26=jennimil user-27=tomandle user-28=david user-29=nbhavers user-30=careers user-31=chrisdal user-32=mcdermos user-33=cwsocial user-34=howardon user-35=paulmca1 user-36=pugwash user-37=cambria1 user-38=cathski user-39=ninejimm user-40=reliable user-41=eugincou user-42=courseme user-43=hirefootballgame user-44=lkpier user-45=donnychicago user-46=firstre5 user-47=steakbridieme user-48=philmcph
Sep  5 07:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ctedorgu user-50=nscdp user-51=putterfc user-52=leftie user-53=foods user-54=health2045 user-55=fortunaz user-56=nomistakes user-57=hidden user-58=tigerlet user-59=barbersh user-60=isleofwi user-61=smrszyqg user-62=nsceres user-63=fawcettd user-64=burydropin user-65=dhyana user-66=beauty user-67=darkstar user-68=eatspam user-69=sibtoncc user-70=asandcoc user-71=steve user-72=bwppodcast user-73=zebrapho user-74=alexadmin user-75=skyfirec user-76=nativene user-77=innovat1 user-78=askhform user-79=stuartge user-80=vivienn1 user-81=firstre2 user-82=oneoarco user-83=battlere user-84=nstriton user-85=brighto1 user-86=newstoda user-87=belle user-88=ggaaorgu user-89=bemadonn user-90=bedfords user-91=hubmaster user-92=putterfi user-93=fetch user-94=carsinyo user-95=gilpin user-96=milloyco user-97=elecleis user-98=connectedshoppin user-99=thqkgnbz user-100=accooper user-101=ianrayne user-102=opaiscyx
Sep  5 07:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=coursemc user-104=ultbcrra user-105=seftvta user-106=jonhartl user-107=firstres user-108=firstred user-109=highlegh user-110=southlon user-111=clarkass user-112=firstrel user-113=costestimatorco user-114=dickemery123 user-115=ptkxhsbt user-116=martsblo user-117=magichat user-118=hhdugcor user-119=lbhyisi user-120=strathar user-121=atestord user-122=sarafoundation user-123=lakesan1 user-124=brmrjxl user-125=megacards user-126=musorguk user-127=wilsonsw user-128=spectrum user-129=theblack user-130=hodgesonweb user-131=jarvisin user-132=stephani user-133=leereyn1 user-134=agproduc user-135=still user-136=vantagep user-137=connect9 user-138=athenare user-139=lbscrmod user-140=maflemin user-141=booff user-142=markward user-143=foundation user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 07:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 07:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:10 nativespace-cdp sudo[2438795]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 07:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:11 nativespace-cdp sudo[2438801]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-C6vazU5WYABPdcxb.~
Sep  5 07:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:11 nativespace-cdp sudo[2438804]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-C6vazU5WYABPdcxb.~'
Sep  5 07:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:11 nativespace-cdp sudo[2438807]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-C6vazU5WYABPdcxb.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 07:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:11 nativespace-cdp sudo[2438811]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 07:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:11 nativespace-cdp sudo[2438814]: pam_unix(sudo:session): session closed for user root
Sep  5 07:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 07:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 07:10:24 nativespace-cdp sudo[2438986]: pam_unix(sudo:session): session closed for user root
Sep  5 07:11:33 nativespace-cdp sshd[2439169]: Connection closed by 159.100.136.21 port 46714 [preauth]
Sep  5 07:16:33 nativespace-cdp sshd[2440279]: Connection closed by 159.100.136.21 port 56894 [preauth]
Sep  5 07:21:15 nativespace-cdp sshd[2441454]: Invalid user ceshi from 45.161.176.1 port 36582
Sep  5 07:21:15 nativespace-cdp sshd[2441454]: input_userauth_request: invalid user ceshi [preauth]
Sep  5 07:21:15 nativespace-cdp sshd[2441454]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:21:15 nativespace-cdp sshd[2441454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.161.176.1
Sep  5 07:21:17 nativespace-cdp sshd[2441454]: Failed password for invalid user ceshi from 45.161.176.1 port 36582 ssh2
Sep  5 07:21:17 nativespace-cdp sshd[2441454]: Received disconnect from 45.161.176.1 port 36582:11: Bye Bye [preauth]
Sep  5 07:21:17 nativespace-cdp sshd[2441454]: Disconnected from 45.161.176.1 port 36582 [preauth]
Sep  5 07:21:33 nativespace-cdp sshd[2441499]: Connection closed by 159.100.136.21 port 38640 [preauth]
Sep  5 07:24:35 nativespace-cdp sshd[2441989]: Invalid user test from 36.64.217.27 port 37864
Sep  5 07:24:35 nativespace-cdp sshd[2441989]: input_userauth_request: invalid user test [preauth]
Sep  5 07:24:35 nativespace-cdp sshd[2441989]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:24:35 nativespace-cdp sshd[2441989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.64.217.27
Sep  5 07:24:38 nativespace-cdp sshd[2441989]: Failed password for invalid user test from 36.64.217.27 port 37864 ssh2
Sep  5 07:24:38 nativespace-cdp sshd[2441989]: Received disconnect from 36.64.217.27 port 37864:11: Bye Bye [preauth]
Sep  5 07:24:38 nativespace-cdp sshd[2441989]: Disconnected from 36.64.217.27 port 37864 [preauth]
Sep  5 07:25:40 nativespace-cdp sshd[2442572]: Invalid user lzw from 217.76.56.8 port 38326
Sep  5 07:25:40 nativespace-cdp sshd[2442572]: input_userauth_request: invalid user lzw [preauth]
Sep  5 07:25:40 nativespace-cdp sshd[2442572]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:25:40 nativespace-cdp sshd[2442572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.76.56.8
Sep  5 07:25:42 nativespace-cdp sshd[2442572]: Failed password for invalid user lzw from 217.76.56.8 port 38326 ssh2
Sep  5 07:25:42 nativespace-cdp sshd[2442572]: Received disconnect from 217.76.56.8 port 38326:11: Bye Bye [preauth]
Sep  5 07:25:42 nativespace-cdp sshd[2442572]: Disconnected from 217.76.56.8 port 38326 [preauth]
Sep  5 07:25:54 nativespace-cdp sshd[2442599]: Invalid user cgonzalez from 45.83.122.69 port 56714
Sep  5 07:25:54 nativespace-cdp sshd[2442599]: input_userauth_request: invalid user cgonzalez [preauth]
Sep  5 07:25:54 nativespace-cdp sshd[2442599]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:25:54 nativespace-cdp sshd[2442599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.83.122.69
Sep  5 07:25:56 nativespace-cdp sshd[2442599]: Failed password for invalid user cgonzalez from 45.83.122.69 port 56714 ssh2
Sep  5 07:25:56 nativespace-cdp sshd[2442599]: Received disconnect from 45.83.122.69 port 56714:11: Bye Bye [preauth]
Sep  5 07:25:56 nativespace-cdp sshd[2442599]: Disconnected from 45.83.122.69 port 56714 [preauth]
Sep  5 07:26:33 nativespace-cdp sshd[2442757]: Connection closed by 159.100.136.21 port 48914 [preauth]
Sep  5 07:26:47 nativespace-cdp sshd[2442791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.67.70.198  user=root
Sep  5 07:26:47 nativespace-cdp sshd[2442791]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 07:26:49 nativespace-cdp sshd[2442791]: Failed password for root from 36.67.70.198 port 52588 ssh2
Sep  5 07:26:50 nativespace-cdp sshd[2442791]: Received disconnect from 36.67.70.198 port 52588:11: Bye Bye [preauth]
Sep  5 07:26:50 nativespace-cdp sshd[2442791]: Disconnected from 36.67.70.198 port 52588 [preauth]
Sep  5 07:27:26 nativespace-cdp sshd[2442885]: Invalid user ace from 45.83.122.69 port 52410
Sep  5 07:27:26 nativespace-cdp sshd[2442885]: input_userauth_request: invalid user ace [preauth]
Sep  5 07:27:26 nativespace-cdp sshd[2442885]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:27:26 nativespace-cdp sshd[2442885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.83.122.69
Sep  5 07:27:29 nativespace-cdp sshd[2442885]: Failed password for invalid user ace from 45.83.122.69 port 52410 ssh2
Sep  5 07:27:29 nativespace-cdp sshd[2442885]: Received disconnect from 45.83.122.69 port 52410:11: Bye Bye [preauth]
Sep  5 07:27:29 nativespace-cdp sshd[2442885]: Disconnected from 45.83.122.69 port 52410 [preauth]
Sep  5 07:27:47 nativespace-cdp sshd[2442998]: Invalid user ljd from 45.161.176.1 port 40346
Sep  5 07:27:47 nativespace-cdp sshd[2442998]: input_userauth_request: invalid user ljd [preauth]
Sep  5 07:27:47 nativespace-cdp sshd[2442998]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:27:47 nativespace-cdp sshd[2442998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.161.176.1
Sep  5 07:27:48 nativespace-cdp sshd[2442998]: Failed password for invalid user ljd from 45.161.176.1 port 40346 ssh2
Sep  5 07:27:49 nativespace-cdp sshd[2442998]: Received disconnect from 45.161.176.1 port 40346:11: Bye Bye [preauth]
Sep  5 07:27:49 nativespace-cdp sshd[2442998]: Disconnected from 45.161.176.1 port 40346 [preauth]
Sep  5 07:27:55 nativespace-cdp sshd[2443012]: Invalid user batman from 36.64.217.27 port 52358
Sep  5 07:27:55 nativespace-cdp sshd[2443012]: input_userauth_request: invalid user batman [preauth]
Sep  5 07:27:55 nativespace-cdp sshd[2443012]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:27:55 nativespace-cdp sshd[2443012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.64.217.27
Sep  5 07:27:56 nativespace-cdp sshd[2443012]: Failed password for invalid user batman from 36.64.217.27 port 52358 ssh2
Sep  5 07:27:57 nativespace-cdp sshd[2443012]: Received disconnect from 36.64.217.27 port 52358:11: Bye Bye [preauth]
Sep  5 07:27:57 nativespace-cdp sshd[2443012]: Disconnected from 36.64.217.27 port 52358 [preauth]
Sep  5 07:27:58 nativespace-cdp sshd[2443029]: Invalid user cgonzalez from 36.67.70.198 port 39378
Sep  5 07:27:58 nativespace-cdp sshd[2443029]: input_userauth_request: invalid user cgonzalez [preauth]
Sep  5 07:27:58 nativespace-cdp sshd[2443029]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:27:58 nativespace-cdp sshd[2443029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.67.70.198
Sep  5 07:28:00 nativespace-cdp sshd[2443029]: Failed password for invalid user cgonzalez from 36.67.70.198 port 39378 ssh2
Sep  5 07:28:00 nativespace-cdp sshd[2443029]: Received disconnect from 36.67.70.198 port 39378:11: Bye Bye [preauth]
Sep  5 07:28:00 nativespace-cdp sshd[2443029]: Disconnected from 36.67.70.198 port 39378 [preauth]
Sep  5 07:28:14 nativespace-cdp sshd[2443082]: Invalid user dev from 45.83.122.69 port 40278
Sep  5 07:28:14 nativespace-cdp sshd[2443082]: input_userauth_request: invalid user dev [preauth]
Sep  5 07:28:14 nativespace-cdp sshd[2443082]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:28:14 nativespace-cdp sshd[2443082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.83.122.69
Sep  5 07:28:16 nativespace-cdp sshd[2443082]: Failed password for invalid user dev from 45.83.122.69 port 40278 ssh2
Sep  5 07:28:16 nativespace-cdp sshd[2443082]: Received disconnect from 45.83.122.69 port 40278:11: Bye Bye [preauth]
Sep  5 07:28:16 nativespace-cdp sshd[2443082]: Disconnected from 45.83.122.69 port 40278 [preauth]
Sep  5 07:28:26 nativespace-cdp sshd[2443130]: Invalid user test from 217.76.56.8 port 58772
Sep  5 07:28:26 nativespace-cdp sshd[2443130]: input_userauth_request: invalid user test [preauth]
Sep  5 07:28:26 nativespace-cdp sshd[2443130]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:28:26 nativespace-cdp sshd[2443130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.76.56.8
Sep  5 07:28:27 nativespace-cdp sshd[2443130]: Failed password for invalid user test from 217.76.56.8 port 58772 ssh2
Sep  5 07:28:27 nativespace-cdp sshd[2443130]: Received disconnect from 217.76.56.8 port 58772:11: Bye Bye [preauth]
Sep  5 07:28:27 nativespace-cdp sshd[2443130]: Disconnected from 217.76.56.8 port 58772 [preauth]
Sep  5 07:28:41 nativespace-cdp sshd[2443182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.161.176.1  user=root
Sep  5 07:28:41 nativespace-cdp sshd[2443182]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 07:28:43 nativespace-cdp sshd[2443182]: Failed password for root from 45.161.176.1 port 54070 ssh2
Sep  5 07:28:52 nativespace-cdp sshd[2443240]: Invalid user maha from 36.64.217.27 port 59647
Sep  5 07:28:52 nativespace-cdp sshd[2443240]: input_userauth_request: invalid user maha [preauth]
Sep  5 07:28:52 nativespace-cdp sshd[2443240]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:28:52 nativespace-cdp sshd[2443240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.64.217.27
Sep  5 07:28:54 nativespace-cdp sshd[2443245]: Invalid user gameserver from 36.67.70.198 port 37262
Sep  5 07:28:54 nativespace-cdp sshd[2443245]: input_userauth_request: invalid user gameserver [preauth]
Sep  5 07:28:54 nativespace-cdp sshd[2443245]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:28:54 nativespace-cdp sshd[2443245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.67.70.198
Sep  5 07:28:54 nativespace-cdp sshd[2443240]: Failed password for invalid user maha from 36.64.217.27 port 59647 ssh2
Sep  5 07:28:55 nativespace-cdp sshd[2443240]: Received disconnect from 36.64.217.27 port 59647:11: Bye Bye [preauth]
Sep  5 07:28:55 nativespace-cdp sshd[2443240]: Disconnected from 36.64.217.27 port 59647 [preauth]
Sep  5 07:28:56 nativespace-cdp sshd[2443245]: Failed password for invalid user gameserver from 36.67.70.198 port 37262 ssh2
Sep  5 07:28:56 nativespace-cdp sshd[2443245]: Received disconnect from 36.67.70.198 port 37262:11: Bye Bye [preauth]
Sep  5 07:28:56 nativespace-cdp sshd[2443245]: Disconnected from 36.67.70.198 port 37262 [preauth]
Sep  5 07:29:25 nativespace-cdp sshd[2443396]: Invalid user aldo from 217.76.56.8 port 39982
Sep  5 07:29:25 nativespace-cdp sshd[2443396]: input_userauth_request: invalid user aldo [preauth]
Sep  5 07:29:25 nativespace-cdp sshd[2443396]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 07:29:25 nativespace-cdp sshd[2443396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.76.56.8
Sep  5 07:29:27 nativespace-cdp sshd[2443396]: Failed password for invalid user aldo from 217.76.56.8 port 39982 ssh2
Sep  5 07:29:27 nativespace-cdp sshd[2443396]: Received disconnect from 217.76.56.8 port 39982:11: Bye Bye [preauth]
Sep  5 07:29:27 nativespace-cdp sshd[2443396]: Disconnected from 217.76.56.8 port 39982 [preauth]
Sep  5 07:31:33 nativespace-cdp sshd[2444191]: Connection closed by 159.100.136.21 port 58946 [preauth]
Sep  5 07:36:33 nativespace-cdp sshd[2445183]: Connection closed by 159.100.136.21 port 40992 [preauth]
Sep  5 07:41:33 nativespace-cdp sshd[2446455]: Connection closed by 159.100.136.21 port 50944 [preauth]
Sep  5 07:46:33 nativespace-cdp sshd[2447754]: Connection closed by 159.100.136.21 port 32928 [preauth]
Sep  5 07:51:33 nativespace-cdp sshd[2448800]: Connection closed by 159.100.136.21 port 42930 [preauth]
Sep  5 07:56:33 nativespace-cdp sshd[2450155]: Connection closed by 159.100.136.21 port 53202 [preauth]
Sep  5 08:01:33 nativespace-cdp sshd[2451384]: Connection closed by 159.100.136.21 port 34956 [preauth]
Sep  5 08:06:33 nativespace-cdp sshd[2452673]: Connection closed by 159.100.136.21 port 45286 [preauth]
Sep  5 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:00 nativespace-cdp sudo[2453281]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:00 nativespace-cdp sudo[2453286]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:02 nativespace-cdp sudo[2453291]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 08:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:02 nativespace-cdp sudo[2453372]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 08:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:06 nativespace-cdp sudo[2453375]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:06 nativespace-cdp sudo[2453425]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:06 nativespace-cdp sudo[2453428]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:06 nativespace-cdp sudo[2453431]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:06 nativespace-cdp sudo[2453434]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:06 nativespace-cdp sudo[2453437]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:06 nativespace-cdp sudo[2453440]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 08:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:08 nativespace-cdp sudo[2453450]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 08:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:09 nativespace-cdp sudo[2453454]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=magichat user-2=hhdugcor user-3=lbhyisi user-4=dickemery123 user-5=ptkxhsbt user-6=martsblo user-7=megacards user-8=musorguk user-9=wilsonsw user-10=strathar user-11=atestord user-12=sarafoundation user-13=brmrjxl user-14=lakesan1 user-15=stephani user-16=leereyn1 user-17=agproduc user-18=still user-19=spectrum user-20=theblack user-21=hodgesonweb user-22=jarvisin user-23=ulsukarm user-24=vantagep user-25=athenare user-26=connect9 user-27=lbscrmod user-28=maflemin user-29=booff user-30=markward user-31=foundation user-32=nativene user-33=innovat1 user-34=askhform user-35=stuartge user-36=alexadmin user-37=skyfirec user-38=newstoda user-39=belle user-40=ggaaorgu user-41=bemadonn user-42=bedfords user-43=vivienn1 user-44=firstre2 user-45=oneoarco user-46=battlere user-47=nstriton user-48=brighto1
Sep  5 08:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=connectedshoppin user-50=thqkgnbz user-51=accooper user-52=ianrayne user-53=putterfi user-54=hubmaster user-55=fetch user-56=carsinyo user-57=milloyco user-58=gilpin user-59=elecleis user-60=firstred user-61=highlegh user-62=southlon user-63=clarkass user-64=firstrel user-65=costestimatorco user-66=coursemc user-67=opaiscyx user-68=ultbcrra user-69=jonhartl user-70=seftvta user-71=firstres user-72=eugincou user-73=courseme user-74=hirefootballgame user-75=cwsocial user-76=pugwash user-77=howardon user-78=paulmca1 user-79=cambria1 user-80=cathski user-81=ninejimm user-82=reliable user-83=nomistakes user-84=hidden user-85=barbersh user-86=tigerlet user-87=isleofwi user-88=smrszyqg user-89=lkpier user-90=firstre5 user-91=steakbridieme user-92=donnychicago user-93=philmcph user-94=ctedorgu user-95=nscdp user-96=putterfc user-97=leftie user-98=foods user-99=fortunaz user-100=health2045 user-101=dhyana
Sep  5 08:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=beauty user-103=darkstar user-104=eatspam user-105=nsceres user-106=fawcettd user-107=burydropin user-108=steve user-109=bwppodcast user-110=zebrapho user-111=asandcoc user-112=sibtoncc user-113=design user-114=dancinggardener user-115=stagingerris user-116=ladburyp user-117=kategilpin user-118=havantho user-119=sketchy user-120=cath user-121=nvihkvu user-122=tstardom user-123=oubpgvbx user-124=what user-125=bakery user-126=crrtipdl user-127=sosevalu user-128=boldover user-129=nove user-130=romaldki user-131=outdoorc user-132=ranxterc user-133=hodgsonmail user-134=branko user-135=onlycont user-136=lucy user-137=attlebor user-138=david user-139=careers user-140=nbhavers user-141=chrisdal user-142=mcdermos user-143=jennimil user-144=tomandle feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 08:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 08:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:10 nativespace-cdp sudo[2453459]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 08:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:11 nativespace-cdp sudo[2453468]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-WcNGKNTM2kIi8bdV.~
Sep  5 08:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:11 nativespace-cdp sudo[2453471]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-WcNGKNTM2kIi8bdV.~'
Sep  5 08:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:11 nativespace-cdp sudo[2453474]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-WcNGKNTM2kIi8bdV.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 08:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:11 nativespace-cdp sudo[2453478]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 08:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:11 nativespace-cdp sudo[2453481]: pam_unix(sudo:session): session closed for user root
Sep  5 08:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 08:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 08:10:13 nativespace-cdp sudo[2453500]: pam_unix(sudo:session): session closed for user root
Sep  5 08:11:33 nativespace-cdp sshd[2453845]: Connection closed by 159.100.136.21 port 55242 [preauth]
Sep  5 08:16:33 nativespace-cdp sshd[2455088]: Connection closed by 159.100.136.21 port 37228 [preauth]
Sep  5 08:21:33 nativespace-cdp sshd[2456449]: Connection closed by 159.100.136.21 port 47208 [preauth]
Sep  5 08:26:33 nativespace-cdp sshd[2457758]: Connection closed by 159.100.136.21 port 57446 [preauth]
Sep  5 08:31:33 nativespace-cdp sshd[2458885]: Connection closed by 159.100.136.21 port 39250 [preauth]
Sep  5 08:36:33 nativespace-cdp sshd[2460138]: Connection closed by 159.100.136.21 port 49264 [preauth]
Sep  5 08:41:33 nativespace-cdp sshd[2461397]: Connection closed by 159.100.136.21 port 59232 [preauth]
Sep  5 08:46:33 nativespace-cdp sshd[2462605]: Connection closed by 159.100.136.21 port 41222 [preauth]
Sep  5 08:51:33 nativespace-cdp sshd[2463744]: Connection closed by 159.100.136.21 port 51220 [preauth]
Sep  5 08:56:33 nativespace-cdp sshd[2464815]: Connection closed by 159.100.136.21 port 32970 [preauth]
Sep  5 09:01:33 nativespace-cdp sshd[2466529]: Connection closed by 159.100.136.21 port 42956 [preauth]
Sep  5 09:06:33 nativespace-cdp sshd[2467949]: Connection closed by 159.100.136.21 port 53280 [preauth]
Sep  5 09:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 09:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:04 nativespace-cdp sudo[2468886]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 09:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:04 nativespace-cdp sudo[2468889]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 09:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:06 nativespace-cdp sudo[2468892]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 09:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:06 nativespace-cdp sudo[2468898]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 09:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:09 nativespace-cdp sudo[2468901]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:09 nativespace-cdp sudo[2468963]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:09 nativespace-cdp sudo[2468968]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:09 nativespace-cdp sudo[2468971]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:09 nativespace-cdp sudo[2468978]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 09:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:09 nativespace-cdp sudo[2468983]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 09:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:10 nativespace-cdp sudo[2468990]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 09:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:13 nativespace-cdp sudo[2469037]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 09:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:14 nativespace-cdp sudo[2469044]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hirefootballgame user-2=courseme user-3=eugincou user-4=reliable user-5=ninejimm user-6=cambria1 user-7=cathski user-8=cwsocial user-9=howardon user-10=paulmca1 user-11=pugwash user-12=smrszyqg user-13=isleofwi user-14=tigerlet user-15=barbersh user-16=nomistakes user-17=hidden user-18=leftie user-19=foods user-20=fortunaz user-21=health2045 user-22=nscdp user-23=putterfc user-24=firstre5 user-25=steakbridieme user-26=donnychicago user-27=philmcph user-28=ctedorgu user-29=lkpier user-30=darkstar user-31=eatspam user-32=beauty user-33=dhyana user-34=fawcettd user-35=burydropin user-36=nsceres user-37=zebrapho user-38=bwppodcast user-39=steve user-40=asandcoc user-41=sibtoncc user-42=kategilpin user-43=dancinggardener user-44=stagingerris user-45=ladburyp user-46=design user-47=what
Sep  5 09:10:14 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=tstardom user-49=oubpgvbx user-50=nvihkvu user-51=havantho user-52=sketchy user-53=cath user-54=crrtipdl user-55=sosevalu user-56=bakery user-57=nove user-58=boldover user-59=branko user-60=ranxterc user-61=outdoorc user-62=hodgsonmail user-63=romaldki user-64=lucy user-65=attlebor user-66=onlycont user-67=mcdermos user-68=chrisdal user-69=david user-70=careers user-71=nbhavers user-72=tomandle user-73=jennimil user-74=hhdugcor user-75=lbhyisi user-76=magichat user-77=martsblo user-78=ptkxhsbt user-79=dickemery123 user-80=wilsonsw user-81=megacards user-82=musorguk user-83=brmrjxl user-84=lakesan1 user-85=atestord user-86=sarafoundation user-87=strathar user-88=agproduc user-89=still user-90=leereyn1 user-91=stephani user-92=jarvisin user-93=theblack user-94=hodgesonweb user-95=spectrum user-96=ulsukarm user-97=markward user-98=booff user-99=foundation user-100=lbscrmod user-101=maflemin user-102=vantagep
Sep  5 09:10:14 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=connect9 user-104=athenare user-105=askhform user-106=stuartge user-107=innovat1 user-108=nativene user-109=skyfirec user-110=alexadmin user-111=bedfords user-112=bemadonn user-113=newstoda user-114=ggaaorgu user-115=belle user-116=nstriton user-117=brighto1 user-118=oneoarco user-119=battlere user-120=vivienn1 user-121=firstre2 user-122=ianrayne user-123=accooper user-124=thqkgnbz user-125=connectedshoppin user-126=elecleis user-127=gilpin user-128=milloyco user-129=fetch user-130=carsinyo user-131=putterfi user-132=hubmaster user-133=costestimatorco user-134=clarkass user-135=firstrel user-136=highlegh user-137=southlon user-138=firstred user-139=firstres user-140=ultbcrra user-141=jonhartl user-142=seftvta user-143=coursemc user-144=opaiscyx feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 09:10:14 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 09:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:15 nativespace-cdp sudo[2469062]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 09:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:16 nativespace-cdp sudo[2469070]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Li0JbBDnDzxlIZBX.~
Sep  5 09:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:16 nativespace-cdp sudo[2469076]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Li0JbBDnDzxlIZBX.~'
Sep  5 09:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:16 nativespace-cdp sudo[2469081]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Li0JbBDnDzxlIZBX.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 09:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:16 nativespace-cdp sudo[2469087]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 09:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:16 nativespace-cdp sudo[2469092]: pam_unix(sudo:session): session closed for user root
Sep  5 09:10:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 09:10:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 09:10:29 nativespace-cdp sudo[2469161]: pam_unix(sudo:session): session closed for user root
Sep  5 09:11:33 nativespace-cdp sshd[2469472]: Connection closed by 159.100.136.21 port 35006 [preauth]
Sep  5 09:16:33 nativespace-cdp sshd[2470854]: Connection closed by 159.100.136.21 port 45236 [preauth]
Sep  5 09:21:33 nativespace-cdp sshd[2472094]: Connection closed by 159.100.136.21 port 55250 [preauth]
Sep  5 09:26:33 nativespace-cdp sshd[2473573]: Connection closed by 159.100.136.21 port 37326 [preauth]
Sep  5 09:31:33 nativespace-cdp sshd[2474806]: Connection closed by 159.100.136.21 port 47462 [preauth]
Sep  5 09:36:33 nativespace-cdp sshd[2475904]: Connection closed by 159.100.136.21 port 57826 [preauth]
Sep  5 09:41:33 nativespace-cdp sshd[2477374]: Connection closed by 159.100.136.21 port 39600 [preauth]
Sep  5 09:46:33 nativespace-cdp sshd[2478660]: Connection closed by 159.100.136.21 port 49886 [preauth]
Sep  5 09:51:33 nativespace-cdp sshd[2479952]: Connection closed by 159.100.136.21 port 59918 [preauth]
Sep  5 09:56:33 nativespace-cdp sshd[2481483]: Connection closed by 159.100.136.21 port 41990 [preauth]
Sep  5 10:01:33 nativespace-cdp sshd[2482838]: Connection closed by 159.100.136.21 port 52030 [preauth]
Sep  5 10:06:33 nativespace-cdp sshd[2484157]: Connection closed by 159.100.136.21 port 34126 [preauth]
Sep  5 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:09:59 nativespace-cdp sudo[2485011]: pam_unix(sudo:session): session closed for user root
Sep  5 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:09:59 nativespace-cdp sudo[2485016]: pam_unix(sudo:session): session closed for user root
Sep  5 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:00 nativespace-cdp sudo[2485020]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 10:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:00 nativespace-cdp sudo[2485027]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 10:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:03 nativespace-cdp sudo[2485034]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:03 nativespace-cdp sudo[2485153]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:03 nativespace-cdp sudo[2485158]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:03 nativespace-cdp sudo[2485161]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:03 nativespace-cdp sudo[2485165]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:03 nativespace-cdp sudo[2485169]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:03 nativespace-cdp sudo[2485172]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:06 nativespace-cdp sudo[2485247]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:06 nativespace-cdp sudo[2485252]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=agproduc user-2=still user-3=stephani user-4=leereyn1 user-5=jarvisin user-6=spectrum user-7=hodgesonweb user-8=theblack user-9=ulsukarm user-10=foundation user-11=markward user-12=booff user-13=vantagep user-14=connect9 user-15=athenare user-16=lbscrmod user-17=maflemin user-18=hhdugcor user-19=lbhyisi user-20=magichat user-21=martsblo user-22=dickemery123 user-23=ptkxhsbt user-24=wilsonsw user-25=megacards user-26=musorguk user-27=brmrjxl user-28=lakesan1 user-29=strathar user-30=atestord user-31=sarafoundation user-32=accooper user-33=ianrayne user-34=connectedshoppin user-35=thqkgnbz user-36=milloyco user-37=gilpin user-38=elecleis user-39=putterfi user-40=hubmaster user-41=fetch user-42=carsinyo user-43=firstrel user-44=clarkass user-45=costestimatorco user-46=firstred user-47=highlegh
Sep  5 10:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=southlon user-49=ultbcrra user-50=jonhartl user-51=seftvta user-52=firstres user-53=coursemc user-54=opaiscyx user-55=innovat1 user-56=askhform user-57=stuartge user-58=nativene user-59=alexadmin user-60=skyfirec user-61=bedfords user-62=newstoda user-63=belle user-64=ggaaorgu user-65=bemadonn user-66=nstriton user-67=brighto1 user-68=vivienn1 user-69=firstre2 user-70=oneoarco user-71=battlere user-72=beauty user-73=darkstar user-74=eatspam user-75=dhyana user-76=fawcettd user-77=burydropin user-78=nsceres user-79=bwppodcast user-80=zebrapho user-81=steve user-82=sibtoncc user-83=asandcoc user-84=hirefootballgame user-85=eugincou user-86=courseme user-87=cathski user-88=cambria1 user-89=reliable user-90=ninejimm user-91=cwsocial user-92=paulmca1 user-93=howardon user-94=pugwash user-95=isleofwi user-96=smrszyqg user-97=nomistakes user-98=hidden user-99=barbersh user-100=tigerlet user-101=nscdp
Sep  5 10:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=putterfc user-103=leftie user-104=foods user-105=fortunaz user-106=health2045 user-107=lkpier user-108=firstre5 user-109=steakbridieme user-110=donnychicago user-111=ctedorgu user-112=philmcph user-113=outdoorc user-114=hodgsonmail user-115=ranxterc user-116=branko user-117=romaldki user-118=lucy user-119=attlebor user-120=onlycont user-121=chrisdal user-122=mcdermos user-123=david user-124=careers user-125=nbhavers user-126=tomandle user-127=jennimil user-128=stagingerris user-129=dancinggardener user-130=ladburyp user-131=kategilpin user-132=design user-133=oubpgvbx user-134=tstardom user-135=what user-136=havantho user-137=cath user-138=sketchy user-139=nvihkvu user-140=bakery user-141=crrtipdl user-142=sosevalu user-143=nove user-144=boldover feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 10:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:07 nativespace-cdp sudo[2485304]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 10:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:08 nativespace-cdp sudo[2485314]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hTKf6JaINJIaJeQL.~
Sep  5 10:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:08 nativespace-cdp sudo[2485320]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hTKf6JaINJIaJeQL.~'
Sep  5 10:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:08 nativespace-cdp sudo[2485324]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hTKf6JaINJIaJeQL.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 10:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:08 nativespace-cdp sudo[2485330]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 10:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:08 nativespace-cdp sudo[2485335]: pam_unix(sudo:session): session closed for user root
Sep  5 10:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 10:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 10:10:13 nativespace-cdp sudo[2485361]: pam_unix(sudo:session): session closed for user root
Sep  5 10:11:33 nativespace-cdp sshd[2485575]: Connection closed by 159.100.136.21 port 43938 [preauth]
Sep  5 10:16:33 nativespace-cdp sshd[2486939]: Connection closed by 159.100.136.21 port 54194 [preauth]
Sep  5 10:21:33 nativespace-cdp sshd[2488131]: Connection closed by 159.100.136.21 port 35982 [preauth]
Sep  5 10:26:33 nativespace-cdp sshd[2489226]: Connection closed by 159.100.136.21 port 46262 [preauth]
Sep  5 10:31:33 nativespace-cdp sshd[2490834]: Connection closed by 159.100.136.21 port 56342 [preauth]
Sep  5 10:36:33 nativespace-cdp sshd[2492098]: Connection closed by 159.100.136.21 port 38426 [preauth]
Sep  5 10:41:33 nativespace-cdp sshd[2493607]: Connection closed by 159.100.136.21 port 48444 [preauth]
Sep  5 10:46:33 nativespace-cdp sshd[2494895]: Connection closed by 159.100.136.21 port 58710 [preauth]
Sep  5 10:51:33 nativespace-cdp sshd[2496414]: Connection closed by 159.100.136.21 port 40498 [preauth]
Sep  5 10:56:33 nativespace-cdp sshd[2497581]: Connection closed by 159.100.136.21 port 50794 [preauth]
Sep  5 11:01:33 nativespace-cdp sshd[2499126]: Connection closed by 159.100.136.21 port 60830 [preauth]
Sep  5 11:06:33 nativespace-cdp sshd[2500636]: Connection closed by 159.100.136.21 port 42942 [preauth]
Sep  5 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:54 nativespace-cdp sudo[2501379]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:54 nativespace-cdp sudo[2501383]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:55 nativespace-cdp sudo[2501389]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 11:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:55 nativespace-cdp sudo[2501395]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 11:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:58 nativespace-cdp sudo[2501402]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:58 nativespace-cdp sudo[2501467]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:59 nativespace-cdp sudo[2501472]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:59 nativespace-cdp sudo[2501476]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:59 nativespace-cdp sudo[2501482]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:59 nativespace-cdp sudo[2501487]: pam_unix(sudo:session): session closed for user root
Sep  5 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:09:59 nativespace-cdp sudo[2501493]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 11:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:01 nativespace-cdp sudo[2501505]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 11:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:01 nativespace-cdp sudo[2501513]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bedfords user-2=bemadonn user-3=belle user-4=ggaaorgu user-5=newstoda user-6=brighto1 user-7=nstriton user-8=battlere user-9=oneoarco user-10=firstre2 user-11=vivienn1 user-12=stuartge user-13=askhform user-14=innovat1 user-15=nativene user-16=skyfirec user-17=alexadmin user-18=costestimatorco user-19=clarkass user-20=firstrel user-21=southlon user-22=highlegh user-23=firstred user-24=firstres user-25=seftvta user-26=jonhartl user-27=ultbcrra user-28=coursemc user-29=opaiscyx user-30=ianrayne user-31=accooper user-32=thqkgnbz user-33=connectedshoppin user-34=elecleis user-35=milloyco user-36=gilpin user-37=carsinyo user-38=fetch user-39=hubmaster user-40=putterfi user-41=wilsonsw user-42=musorguk user-43=megacards user-44=brmrjxl user-45=lakesan1 user-46=sarafoundation user-47=atestord
Sep  5 11:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=strathar user-49=lbhyisi user-50=hhdugcor user-51=magichat user-52=martsblo user-53=ptkxhsbt user-54=dickemery123 user-55=ulsukarm user-56=booff user-57=markward user-58=foundation user-59=maflemin user-60=lbscrmod user-61=connect9 user-62=athenare user-63=vantagep user-64=still user-65=agproduc user-66=leereyn1 user-67=stephani user-68=jarvisin user-69=hodgesonweb user-70=theblack user-71=spectrum user-72=sosevalu user-73=crrtipdl user-74=bakery user-75=nove user-76=boldover user-77=kategilpin user-78=ladburyp user-79=dancinggardener user-80=stagingerris user-81=design user-82=what user-83=tstardom user-84=oubpgvbx user-85=nvihkvu user-86=sketchy user-87=cath user-88=havantho user-89=mcdermos user-90=chrisdal user-91=nbhavers user-92=careers user-93=david user-94=tomandle user-95=jennimil user-96=branko user-97=outdoorc user-98=ranxterc user-99=hodgsonmail user-100=romaldki user-101=attlebor
Sep  5 11:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=lucy user-103=onlycont user-104=isleofwi user-105=smrszyqg user-106=tigerlet user-107=barbersh user-108=hidden user-109=nomistakes user-110=health2045 user-111=fortunaz user-112=leftie user-113=foods user-114=putterfc user-115=nscdp user-116=ctedorgu user-117=philmcph user-118=donnychicago user-119=firstre5 user-120=steakbridieme user-121=lkpier user-122=hirefootballgame user-123=courseme user-124=eugincou user-125=ninejimm user-126=reliable user-127=cambria1 user-128=cathski user-129=howardon user-130=paulmca1 user-131=pugwash user-132=cwsocial user-133=zebrapho user-134=bwppodcast user-135=steve user-136=asandcoc user-137=sibtoncc user-138=eatspam user-139=darkstar user-140=beauty user-141=dhyana user-142=burydropin user-143=fawcettd user-144=nsceres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 11:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 11:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:02 nativespace-cdp sudo[2501523]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  5 11:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:03 nativespace-cdp sudo[2501689]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep  5 11:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  5 11:10:04 nativespace-cdp sudo[2501694]: pam_unix(sudo:session): session closed for user onlycont
Sep  5 11:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  5 11:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:04 nativespace-cdp sudo[2501706]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  5 11:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 11:10:04 nativespace-cdp sudo[2501711]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 11:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  5 11:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:06 nativespace-cdp sudo[2501734]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep  5 11:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  5 11:10:06 nativespace-cdp sudo[2501739]: pam_unix(sudo:session): session closed for user lkpier
Sep  5 11:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  5 11:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:07 nativespace-cdp sudo[2501754]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep  5 11:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  5 11:10:07 nativespace-cdp sudo[2501759]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  5 11:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  5 11:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  5 11:10:07 nativespace-cdp sudo[2501774]: pam_unix(sudo:session): session closed for user oneoarco
Sep  5 11:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  5 11:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:08 nativespace-cdp sudo[2501787]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep  5 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  5 11:10:08 nativespace-cdp sudo[2501791]: pam_unix(sudo:session): session closed for user fortunaz
Sep  5 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep  5 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:08 nativespace-cdp sudo[2501804]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 11:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:08 nativespace-cdp sudo[2501809]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep  5 11:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:25 nativespace-cdp sudo[2502755]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep  5 11:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:25 nativespace-cdp sudo[2502760]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 11:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:26 nativespace-cdp sudo[2502771]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5Rk06y6rZ9gFRrtB.~
Sep  5 11:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:26 nativespace-cdp sudo[2502777]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5Rk06y6rZ9gFRrtB.~'
Sep  5 11:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:26 nativespace-cdp sudo[2502781]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5Rk06y6rZ9gFRrtB.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 11:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:26 nativespace-cdp sudo[2502787]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 11:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:26 nativespace-cdp sudo[2502792]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 11:10:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 11:10:31 nativespace-cdp sudo[2502813]: pam_unix(sudo:session): session closed for user root
Sep  5 11:10:55 nativespace-cdp sshd[2502898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.18.242.236  user=root
Sep  5 11:10:55 nativespace-cdp sshd[2502898]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 11:10:58 nativespace-cdp sshd[2502898]: Failed password for root from 178.18.242.236 port 55884 ssh2
Sep  5 11:10:58 nativespace-cdp sshd[2502898]: Received disconnect from 178.18.242.236 port 55884:11: Bye Bye [preauth]
Sep  5 11:10:58 nativespace-cdp sshd[2502898]: Disconnected from 178.18.242.236 port 55884 [preauth]
Sep  5 11:11:01 nativespace-cdp sshd[2502908]: Invalid user postgre from 34.126.80.8 port 42898
Sep  5 11:11:01 nativespace-cdp sshd[2502908]: input_userauth_request: invalid user postgre [preauth]
Sep  5 11:11:01 nativespace-cdp sshd[2502908]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 11:11:01 nativespace-cdp sshd[2502908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.126.80.8
Sep  5 11:11:03 nativespace-cdp sshd[2502908]: Failed password for invalid user postgre from 34.126.80.8 port 42898 ssh2
Sep  5 11:11:03 nativespace-cdp sshd[2502908]: Received disconnect from 34.126.80.8 port 42898:11: Bye Bye [preauth]
Sep  5 11:11:03 nativespace-cdp sshd[2502908]: Disconnected from 34.126.80.8 port 42898 [preauth]
Sep  5 11:11:33 nativespace-cdp sshd[2502992]: Connection closed by 159.100.136.21 port 52960 [preauth]
Sep  5 11:15:42 nativespace-cdp sshd[2504017]: Invalid user jahan from 109.94.172.229 port 34664
Sep  5 11:15:42 nativespace-cdp sshd[2504017]: input_userauth_request: invalid user jahan [preauth]
Sep  5 11:15:42 nativespace-cdp sshd[2504017]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 11:15:42 nativespace-cdp sshd[2504017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.94.172.229
Sep  5 11:15:44 nativespace-cdp sshd[2504017]: Failed password for invalid user jahan from 109.94.172.229 port 34664 ssh2
Sep  5 11:15:44 nativespace-cdp sshd[2504017]: Received disconnect from 109.94.172.229 port 34664:11: Bye Bye [preauth]
Sep  5 11:15:44 nativespace-cdp sshd[2504017]: Disconnected from 109.94.172.229 port 34664 [preauth]
Sep  5 11:16:33 nativespace-cdp sshd[2504493]: Connection closed by 159.100.136.21 port 34988 [preauth]
Sep  5 11:17:33 nativespace-cdp sshd[2504731]: Invalid user mohamed from 143.110.250.108 port 41108
Sep  5 11:17:33 nativespace-cdp sshd[2504731]: input_userauth_request: invalid user mohamed [preauth]
Sep  5 11:17:33 nativespace-cdp sshd[2504731]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 11:17:33 nativespace-cdp sshd[2504731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.250.108
Sep  5 11:17:35 nativespace-cdp sshd[2504731]: Failed password for invalid user mohamed from 143.110.250.108 port 41108 ssh2
Sep  5 11:17:35 nativespace-cdp sshd[2504731]: Received disconnect from 143.110.250.108 port 41108:11: Bye Bye [preauth]
Sep  5 11:17:35 nativespace-cdp sshd[2504731]: Disconnected from 143.110.250.108 port 41108 [preauth]
Sep  5 11:18:05 nativespace-cdp sshd[2504814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.18.242.236  user=root
Sep  5 11:18:05 nativespace-cdp sshd[2504814]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 11:18:07 nativespace-cdp sshd[2504814]: Failed password for root from 178.18.242.236 port 53150 ssh2
Sep  5 11:18:07 nativespace-cdp sshd[2504814]: Received disconnect from 178.18.242.236 port 53150:11: Bye Bye [preauth]
Sep  5 11:18:07 nativespace-cdp sshd[2504814]: Disconnected from 178.18.242.236 port 53150 [preauth]
Sep  5 11:18:17 nativespace-cdp sshd[2504845]: Invalid user rfprod from 109.94.172.229 port 47843
Sep  5 11:18:17 nativespace-cdp sshd[2504845]: input_userauth_request: invalid user rfprod [preauth]
Sep  5 11:18:17 nativespace-cdp sshd[2504845]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 11:18:17 nativespace-cdp sshd[2504845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.94.172.229
Sep  5 11:18:20 nativespace-cdp sshd[2504845]: Failed password for invalid user rfprod from 109.94.172.229 port 47843 ssh2
Sep  5 11:18:20 nativespace-cdp sshd[2504845]: Received disconnect from 109.94.172.229 port 47843:11: Bye Bye [preauth]
Sep  5 11:18:20 nativespace-cdp sshd[2504845]: Disconnected from 109.94.172.229 port 47843 [preauth]
Sep  5 11:18:21 nativespace-cdp sshd[2504856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.126.80.8  user=root
Sep  5 11:18:21 nativespace-cdp sshd[2504856]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 11:18:23 nativespace-cdp sshd[2504856]: Failed password for root from 34.126.80.8 port 57546 ssh2
Sep  5 11:18:23 nativespace-cdp sshd[2504856]: Received disconnect from 34.126.80.8 port 57546:11: Bye Bye [preauth]
Sep  5 11:18:23 nativespace-cdp sshd[2504856]: Disconnected from 34.126.80.8 port 57546 [preauth]
Sep  5 11:18:55 nativespace-cdp sshd[2504976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.18.242.236  user=root
Sep  5 11:18:55 nativespace-cdp sshd[2504976]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 11:18:57 nativespace-cdp sshd[2504976]: Failed password for root from 178.18.242.236 port 37992 ssh2
Sep  5 11:18:57 nativespace-cdp sshd[2504976]: Received disconnect from 178.18.242.236 port 37992:11: Bye Bye [preauth]
Sep  5 11:18:57 nativespace-cdp sshd[2504976]: Disconnected from 178.18.242.236 port 37992 [preauth]
Sep  5 11:19:03 nativespace-cdp sshd[2505030]: Invalid user maurice from 34.126.80.8 port 56116
Sep  5 11:19:03 nativespace-cdp sshd[2505030]: input_userauth_request: invalid user maurice [preauth]
Sep  5 11:19:03 nativespace-cdp sshd[2505030]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 11:19:03 nativespace-cdp sshd[2505030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.126.80.8
Sep  5 11:19:06 nativespace-cdp sshd[2505030]: Failed password for invalid user maurice from 34.126.80.8 port 56116 ssh2
Sep  5 11:19:06 nativespace-cdp sshd[2505034]: Invalid user sdr from 143.110.250.108 port 35872
Sep  5 11:19:06 nativespace-cdp sshd[2505034]: input_userauth_request: invalid user sdr [preauth]
Sep  5 11:19:06 nativespace-cdp sshd[2505034]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 11:19:06 nativespace-cdp sshd[2505034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.250.108
Sep  5 11:19:06 nativespace-cdp sshd[2505030]: Received disconnect from 34.126.80.8 port 56116:11: Bye Bye [preauth]
Sep  5 11:19:06 nativespace-cdp sshd[2505030]: Disconnected from 34.126.80.8 port 56116 [preauth]
Sep  5 11:19:08 nativespace-cdp sshd[2505034]: Failed password for invalid user sdr from 143.110.250.108 port 35872 ssh2
Sep  5 11:19:08 nativespace-cdp sshd[2505034]: Received disconnect from 143.110.250.108 port 35872:11: Bye Bye [preauth]
Sep  5 11:19:08 nativespace-cdp sshd[2505034]: Disconnected from 143.110.250.108 port 35872 [preauth]
Sep  5 11:19:11 nativespace-cdp sshd[2505069]: Invalid user brian from 109.94.172.229 port 55545
Sep  5 11:19:11 nativespace-cdp sshd[2505069]: input_userauth_request: invalid user brian [preauth]
Sep  5 11:19:11 nativespace-cdp sshd[2505069]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 11:19:11 nativespace-cdp sshd[2505069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.94.172.229
Sep  5 11:19:13 nativespace-cdp sshd[2505069]: Failed password for invalid user brian from 109.94.172.229 port 55545 ssh2
Sep  5 11:19:13 nativespace-cdp sshd[2505069]: Received disconnect from 109.94.172.229 port 55545:11: Bye Bye [preauth]
Sep  5 11:19:13 nativespace-cdp sshd[2505069]: Disconnected from 109.94.172.229 port 55545 [preauth]
Sep  5 11:21:00 nativespace-cdp sshd[2505556]: Invalid user elastic from 143.110.250.108 port 34158
Sep  5 11:21:00 nativespace-cdp sshd[2505556]: input_userauth_request: invalid user elastic [preauth]
Sep  5 11:21:00 nativespace-cdp sshd[2505556]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 11:21:00 nativespace-cdp sshd[2505556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.250.108
Sep  5 11:21:02 nativespace-cdp sshd[2505556]: Failed password for invalid user elastic from 143.110.250.108 port 34158 ssh2
Sep  5 11:21:02 nativespace-cdp sshd[2505556]: Received disconnect from 143.110.250.108 port 34158:11: Bye Bye [preauth]
Sep  5 11:21:02 nativespace-cdp sshd[2505556]: Disconnected from 143.110.250.108 port 34158 [preauth]
Sep  5 11:21:33 nativespace-cdp sshd[2505730]: Connection closed by 159.100.136.21 port 44960 [preauth]
Sep  5 11:26:33 nativespace-cdp sshd[2507359]: Connection closed by 159.100.136.21 port 55266 [preauth]
Sep  5 11:31:33 nativespace-cdp sshd[2508717]: Connection closed by 159.100.136.21 port 37108 [preauth]
Sep  5 11:36:33 nativespace-cdp sshd[2509949]: Connection closed by 159.100.136.21 port 47430 [preauth]
Sep  5 11:41:33 nativespace-cdp sshd[2511472]: Connection closed by 159.100.136.21 port 57446 [preauth]
Sep  5 11:46:33 nativespace-cdp sshd[2512659]: Connection closed by 159.100.136.21 port 38608 [preauth]
Sep  5 11:51:33 nativespace-cdp sshd[2513808]: Connection closed by 159.100.136.21 port 48620 [preauth]
Sep  5 11:56:33 nativespace-cdp sshd[2515155]: Connection closed by 159.100.136.21 port 58922 [preauth]
Sep  5 12:01:33 nativespace-cdp sshd[2516359]: Connection closed by 159.100.136.21 port 40732 [preauth]
Sep  5 12:06:33 nativespace-cdp sshd[2517915]: Connection closed by 159.100.136.21 port 51094 [preauth]
Sep  5 12:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 12:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:07 nativespace-cdp sudo[2519343]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 12:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:07 nativespace-cdp sudo[2519356]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 12:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:09 nativespace-cdp sudo[2519362]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 12:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:09 nativespace-cdp sudo[2519406]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 12:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:13 nativespace-cdp sudo[2519409]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 12:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:13 nativespace-cdp sudo[2519427]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 12:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:13 nativespace-cdp sudo[2519430]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 12:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:13 nativespace-cdp sudo[2519433]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 12:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:13 nativespace-cdp sudo[2519436]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 12:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:13 nativespace-cdp sudo[2519439]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 12:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:13 nativespace-cdp sudo[2519442]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 12:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:15 nativespace-cdp sudo[2519454]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 12:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:16 nativespace-cdp sudo[2519459]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bakery user-2=crrtipdl user-3=sosevalu user-4=nove user-5=boldover user-6=dancinggardener user-7=stagingerris user-8=ladburyp user-9=kategilpin user-10=design user-11=oubpgvbx user-12=tstardom user-13=what user-14=havantho user-15=sketchy user-16=cath user-17=nvihkvu user-18=chrisdal user-19=mcdermos user-20=david user-21=nbhavers user-22=careers user-23=tomandle user-24=jennimil user-25=hodgsonmail user-26=outdoorc user-27=ranxterc user-28=branko user-29=romaldki user-30=lucy user-31=attlebor user-32=onlycont user-33=smrszyqg user-34=isleofwi user-35=nomistakes user-36=hidden user-37=tigerlet user-38=barbersh user-39=nscdp user-40=putterfc user-41=leftie user-42=foods user-43=health2045 user-44=fortunaz user-45=lkpier user-46=donnychicago user-47=firstre5 user-48=steakbridieme user-49=ctedorgu
Sep  5 12:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=philmcph user-51=hirefootballgame user-52=eugincou user-53=courseme user-54=cambria1 user-55=cathski user-56=reliable user-57=ninejimm user-58=cwsocial user-59=pugwash user-60=howardon user-61=paulmca1 user-62=bwppodcast user-63=zebrapho user-64=steve user-65=sibtoncc user-66=asandcoc user-67=beauty user-68=darkstar user-69=eatspam user-70=dhyana user-71=fawcettd user-72=burydropin user-73=nsceres user-74=bedfords user-75=newstoda user-76=belle user-77=ggaaorgu user-78=bemadonn user-79=nstriton user-80=brighto1 user-81=vivienn1 user-82=firstre2 user-83=oneoarco user-84=battlere user-85=innovat1 user-86=stuartge user-87=askhform user-88=nativene user-89=skyfirec user-90=alexadmin user-91=clarkass user-92=firstrel user-93=costestimatorco user-94=firstred user-95=highlegh user-96=southlon user-97=ultbcrra user-98=jonhartl user-99=seftvta user-100=firstres user-101=coursemc user-102=opaiscyx user-103=accooper
Sep  5 12:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=ianrayne user-105=connectedshoppin user-106=thqkgnbz user-107=milloyco user-108=gilpin user-109=elecleis user-110=putterfi user-111=hubmaster user-112=fetch user-113=carsinyo user-114=wilsonsw user-115=megacards user-116=musorguk user-117=lakesan1 user-118=brmrjxl user-119=strathar user-120=atestord user-121=sarafoundation user-122=hhdugcor user-123=lbhyisi user-124=magichat user-125=martsblo user-126=dickemery123 user-127=ptkxhsbt user-128=ulsukarm user-129=markward user-130=foundation user-131=booff user-132=vantagep user-133=athenare user-134=connect9 user-135=lbscrmod user-136=maflemin user-137=agproduc user-138=still user-139=stephani user-140=leereyn1 user-141=jarvisin user-142=spectrum user-143=hodgesonweb user-144=theblack feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains feature-9=webprotect
Sep  5 12:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 12:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:18 nativespace-cdp sudo[2519467]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 12:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:18 nativespace-cdp sudo[2519475]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-B3DxyLunDycPJWmk.~
Sep  5 12:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:18 nativespace-cdp sudo[2519478]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-B3DxyLunDycPJWmk.~'
Sep  5 12:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:18 nativespace-cdp sudo[2519481]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-B3DxyLunDycPJWmk.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 12:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:18 nativespace-cdp sudo[2519485]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 12:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:18 nativespace-cdp sudo[2519488]: pam_unix(sudo:session): session closed for user root
Sep  5 12:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 12:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 12:10:20 nativespace-cdp sudo[2519507]: pam_unix(sudo:session): session closed for user root
Sep  5 12:11:33 nativespace-cdp sshd[2519814]: Connection closed by 159.100.136.21 port 32896 [preauth]
Sep  5 12:16:33 nativespace-cdp sshd[2520971]: Connection closed by 159.100.136.21 port 43152 [preauth]
Sep  5 12:21:33 nativespace-cdp sshd[2522077]: Connection closed by 159.100.136.21 port 53182 [preauth]
Sep  5 12:26:33 nativespace-cdp sshd[2523192]: Connection closed by 159.100.136.21 port 35270 [preauth]
Sep  5 12:31:33 nativespace-cdp sshd[2524631]: Connection closed by 159.100.136.21 port 45338 [preauth]
Sep  5 12:36:33 nativespace-cdp sshd[2525761]: Connection closed by 159.100.136.21 port 55546 [preauth]
Sep  5 12:41:35 nativespace-cdp sshd[2527417]: Connection closed by 159.100.136.21 port 37000 [preauth]
Sep  5 12:46:33 nativespace-cdp sshd[2528572]: Connection closed by 159.100.136.21 port 46978 [preauth]
Sep  5 12:51:33 nativespace-cdp sshd[2529623]: Connection closed by 159.100.136.21 port 55834 [preauth]
Sep  5 12:56:35 nativespace-cdp sshd[2530804]: Connection closed by 159.100.136.21 port 37410 [preauth]
Sep  5 13:01:33 nativespace-cdp sshd[2532223]: Connection closed by 159.100.136.21 port 46880 [preauth]
Sep  5 13:06:36 nativespace-cdp sshd[2533370]: Connection closed by 159.100.136.21 port 56390 [preauth]
Sep  5 13:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 13:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:08 nativespace-cdp sudo[2534468]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 13:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:08 nativespace-cdp sudo[2534488]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 13:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:15 nativespace-cdp sudo[2534491]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 13:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:15 nativespace-cdp sudo[2534618]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 13:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:20 nativespace-cdp sudo[2534621]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 13:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:20 nativespace-cdp sudo[2534644]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 13:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:20 nativespace-cdp sudo[2534647]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 13:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:20 nativespace-cdp sudo[2534650]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 13:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:20 nativespace-cdp sudo[2534653]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 13:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:21 nativespace-cdp sudo[2534656]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 13:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:21 nativespace-cdp sudo[2534660]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 13:10:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:29 nativespace-cdp sudo[2534740]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 13:10:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:30 nativespace-cdp sudo[2534746]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=beauty user-2=eatspam user-3=darkstar user-4=dhyana user-5=burydropin user-6=fawcettd user-7=nsceres user-8=bwppodcast user-9=zebrapho user-10=steve user-11=sibtoncc user-12=asandcoc user-13=hirefootballgame user-14=eugincou user-15=courseme user-16=cathski user-17=cambria1 user-18=ninejimm user-19=reliable user-20=howardon user-21=paulmca1 user-22=pugwash user-23=cwsocial user-24=smrszyqg user-25=isleofwi user-26=hidden user-27=nomistakes user-28=barbersh user-29=tigerlet user-30=putterfc user-31=nscdp user-32=health2045 user-33=fortunaz user-34=foods user-35=leftie user-36=lkpier user-37=philmcph user-38=ctedorgu user-39=firstre5 user-40=steakbridieme user-41=donnychicago user-42=outdoorc user-43=hodgsonmail user-44=ranxterc user-45=branko user-46=romaldki user-47=attlebor user-48=lucy
Sep  5 13:10:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=chrisdal user-51=mcdermos user-52=nbhavers user-53=careers user-54=david user-55=tomandle user-56=jennimil user-57=ladburyp user-58=dancinggardener user-59=stagingerris user-60=kategilpin user-61=design user-62=tstardom user-63=oubpgvbx user-64=what user-65=cath user-66=sketchy user-67=havantho user-68=nvihkvu user-69=bakery user-70=sosevalu user-71=crrtipdl user-72=nove user-73=boldover user-74=still user-75=agproduc user-76=stephani user-77=leereyn1 user-78=jarvisin user-79=spectrum user-80=hodgesonweb user-81=theblack user-82=ulsukarm user-83=markward user-84=foundation user-85=booff user-86=athenare user-87=connect9 user-88=vantagep user-89=maflemin user-90=lbscrmod user-91=lbhyisi user-92=hhdugcor user-93=magichat user-94=martsblo user-95=dickemery123 user-96=ptkxhsbt user-97=wilsonsw user-98=musorguk user-99=megacards user-100=brmrjxl user-101=lakesan1 user-102=strathar
Sep  5 13:10:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=sarafoundation user-104=atestord user-105=accooper user-106=ianrayne user-107=connectedshoppin user-108=thqkgnbz user-109=gilpin user-110=milloyco user-111=elecleis user-112=putterfi user-113=hubmaster user-114=carsinyo user-115=fetch user-116=clarkass user-117=firstrel user-118=costestimatorco user-119=firstred user-120=southlon user-121=highlegh user-122=seftvta user-123=jonhartl user-124=ultbcrra user-125=firstres user-126=opaiscyx user-127=coursemc user-128=innovat1 user-129=stuartge user-130=askhform user-131=nativene user-132=skyfirec user-133=alexadmin user-134=bedfords user-135=belle user-136=ggaaorgu user-137=newstoda user-138=bemadonn user-139=brighto1 user-140=nstriton user-141=firstre2 user-142=vivienn1 user-143=battlere user-144=oneoarco feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 13:10:30 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 13:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:32 nativespace-cdp sudo[2534756]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 13:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:32 nativespace-cdp sudo[2534766]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rhmv6JX4anZwQjqD.~
Sep  5 13:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:32 nativespace-cdp sudo[2534772]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rhmv6JX4anZwQjqD.~'
Sep  5 13:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:32 nativespace-cdp sudo[2534776]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rhmv6JX4anZwQjqD.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 13:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:32 nativespace-cdp sudo[2534782]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 13:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:32 nativespace-cdp sudo[2534787]: pam_unix(sudo:session): session closed for user root
Sep  5 13:10:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 13:10:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 13:10:35 nativespace-cdp sudo[2534812]: pam_unix(sudo:session): session closed for user root
Sep  5 13:11:33 nativespace-cdp sshd[2535073]: Connection closed by 159.100.136.21 port 37396 [preauth]
Sep  5 13:16:34 nativespace-cdp sshd[2536472]: Connection closed by 159.100.136.21 port 46058 [preauth]
Sep  5 13:21:33 nativespace-cdp sshd[2538448]: Connection closed by 159.100.136.21 port 53814 [preauth]
Sep  5 13:26:33 nativespace-cdp sshd[2541055]: Connection closed by 159.100.136.21 port 34738 [preauth]
Sep  5 13:31:33 nativespace-cdp sshd[2543885]: Connection closed by 159.100.136.21 port 44150 [preauth]
Sep  5 13:36:33 nativespace-cdp sshd[2546475]: Connection closed by 159.100.136.21 port 53494 [preauth]
Sep  5 13:41:33 nativespace-cdp sshd[2549002]: Connection closed by 159.100.136.21 port 34524 [preauth]
Sep  5 13:46:34 nativespace-cdp sshd[2550372]: Connection closed by 159.100.136.21 port 44416 [preauth]
Sep  5 13:51:33 nativespace-cdp sshd[2551501]: Connection closed by 159.100.136.21 port 53832 [preauth]
Sep  5 13:56:33 nativespace-cdp sshd[2553052]: Connection closed by 159.100.136.21 port 35848 [preauth]
Sep  5 14:01:33 nativespace-cdp sshd[2554357]: Connection closed by 159.100.136.21 port 45698 [preauth]
Sep  5 14:06:33 nativespace-cdp sshd[2555661]: Connection closed by 159.100.136.21 port 56064 [preauth]
Sep  5 14:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 14:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:01 nativespace-cdp sudo[2556505]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 14:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:01 nativespace-cdp sudo[2556509]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 14:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:03 nativespace-cdp sudo[2556514]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 14:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:03 nativespace-cdp sudo[2556638]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 14:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:06 nativespace-cdp sudo[2556641]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:06 nativespace-cdp sudo[2556671]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:06 nativespace-cdp sudo[2556674]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:06 nativespace-cdp sudo[2556677]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:06 nativespace-cdp sudo[2556680]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:06 nativespace-cdp sudo[2556683]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:06 nativespace-cdp sudo[2556687]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 14:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:09 nativespace-cdp sudo[2556703]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 14:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:09 nativespace-cdp sudo[2556708]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=agproduc user-2=still user-3=stephani user-4=leereyn1 user-5=jarvisin user-6=spectrum user-7=hodgesonweb user-8=theblack user-9=ulsukarm user-10=markward user-11=booff user-12=foundation user-13=vantagep user-14=athenare user-15=connect9 user-16=lbscrmod user-17=maflemin user-18=hhdugcor user-19=lbhyisi user-20=magichat user-21=martsblo user-22=dickemery123 user-23=ptkxhsbt user-24=wilsonsw user-25=megacards user-26=musorguk user-27=lakesan1 user-28=brmrjxl user-29=strathar user-30=atestord user-31=sarafoundation user-32=accooper user-33=ianrayne user-34=connectedshoppin user-35=thqkgnbz user-36=gilpin user-37=milloyco user-38=elecleis user-39=putterfi user-40=hubmaster user-41=fetch user-42=carsinyo user-43=clarkass user-44=firstrel user-45=costestimatorco user-46=firstred user-47=highlegh
Sep  5 14:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=southlon user-49=ultbcrra user-50=seftvta user-51=jonhartl user-52=firstres user-53=opaiscyx user-54=coursemc user-55=innovat1 user-56=stuartge user-57=askhform user-58=nativene user-59=alexadmin user-60=skyfirec user-61=bedfords user-62=newstoda user-63=belle user-64=ggaaorgu user-65=bemadonn user-66=nstriton user-67=brighto1 user-68=vivienn1 user-69=firstre2 user-70=oneoarco user-71=battlere user-72=beauty user-73=darkstar user-74=eatspam user-75=dhyana user-76=fawcettd user-77=burydropin user-78=nsceres user-79=bwppodcast user-80=zebrapho user-81=steve user-82=asandcoc user-83=sibtoncc user-84=hirefootballgame user-85=eugincou user-86=courseme user-87=cathski user-88=cambria1 user-89=reliable user-90=ninejimm user-91=cwsocial user-92=howardon user-93=paulmca1 user-94=pugwash user-95=smrszyqg user-96=isleofwi user-97=nomistakes user-98=hidden user-99=barbersh user-100=tigerlet user-101=nscdp
Sep  5 14:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=putterfc user-103=foods user-104=leftie user-105=fortunaz user-106=health2045 user-107=lkpier user-108=donnychicago user-109=firstre5 user-110=steakbridieme user-111=philmcph user-112=ctedorgu user-113=ranxterc user-114=outdoorc user-115=hodgsonmail user-116=branko user-117=romaldki user-118=lucy user-119=attlebor user-120=onlycont user-121=chrisdal user-122=mcdermos user-123=david user-124=careers user-125=nbhavers user-126=tomandle user-127=jennimil user-128=stagingerris user-129=dancinggardener user-130=ladburyp user-131=kategilpin user-132=design user-133=tstardom user-134=oubpgvbx user-135=what user-136=havantho user-137=sketchy user-138=cath user-139=nvihkvu user-140=bakery user-141=crrtipdl user-142=sosevalu user-143=nove user-144=boldover feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 14:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 14:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:10 nativespace-cdp sudo[2556715]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 14:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:11 nativespace-cdp sudo[2556735]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6tZodYGN3O4JZDGz.~
Sep  5 14:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:11 nativespace-cdp sudo[2556739]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6tZodYGN3O4JZDGz.~'
Sep  5 14:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:11 nativespace-cdp sudo[2556742]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6tZodYGN3O4JZDGz.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 14:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:11 nativespace-cdp sudo[2556746]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 14:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:11 nativespace-cdp sudo[2556750]: pam_unix(sudo:session): session closed for user root
Sep  5 14:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 14:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 14:10:12 nativespace-cdp sudo[2556779]: pam_unix(sudo:session): session closed for user root
Sep  5 14:11:33 nativespace-cdp sshd[2557178]: Connection closed by 159.100.136.21 port 37812 [preauth]
Sep  5 14:16:33 nativespace-cdp sshd[2559037]: Connection closed by 159.100.136.21 port 48082 [preauth]
Sep  5 14:21:36 nativespace-cdp sshd[2560255]: Connection closed by 159.100.136.21 port 58116 [preauth]
Sep  5 14:26:33 nativespace-cdp sshd[2561710]: Connection closed by 159.100.136.21 port 40134 [preauth]
Sep  5 14:31:33 nativespace-cdp sshd[2562811]: Connection closed by 159.100.136.21 port 50120 [preauth]
Sep  5 14:36:33 nativespace-cdp sshd[2563842]: Connection closed by 159.100.136.21 port 60436 [preauth]
Sep  5 14:41:33 nativespace-cdp sshd[2565040]: Connection closed by 159.100.136.21 port 41952 [preauth]
Sep  5 14:46:33 nativespace-cdp sshd[2566473]: Connection closed by 159.100.136.21 port 52222 [preauth]
Sep  5 14:51:36 nativespace-cdp sshd[2567645]: Connection closed by 159.100.136.21 port 33104 [preauth]
Sep  5 14:56:35 nativespace-cdp sshd[2569070]: Connection closed by 159.100.136.21 port 42786 [preauth]
Sep  5 15:01:37 nativespace-cdp sshd[2570474]: Connection closed by 159.100.136.21 port 52284 [preauth]
Sep  5 15:06:33 nativespace-cdp sshd[2571637]: Connection closed by 159.100.136.21 port 34058 [preauth]
Sep  5 15:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 15:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:09:59 nativespace-cdp sudo[2572354]: pam_unix(sudo:session): session closed for user root
Sep  5 15:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 15:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:09:59 nativespace-cdp sudo[2572358]: pam_unix(sudo:session): session closed for user root
Sep  5 15:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 15:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:01 nativespace-cdp sudo[2572364]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 15:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:01 nativespace-cdp sudo[2572373]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 15:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:03 nativespace-cdp sudo[2572379]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 15:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:03 nativespace-cdp sudo[2572510]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 15:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:03 nativespace-cdp sudo[2572513]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 15:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:03 nativespace-cdp sudo[2572516]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 15:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:03 nativespace-cdp sudo[2572519]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 15:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:04 nativespace-cdp sudo[2572522]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 15:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:04 nativespace-cdp sudo[2572525]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 15:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:08 nativespace-cdp sudo[2572573]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 15:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:09 nativespace-cdp sudo[2572577]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=theblack user-2=hodgesonweb user-3=spectrum user-4=jarvisin user-5=leereyn1 user-6=stephani user-7=still user-8=agproduc user-9=maflemin user-10=lbscrmod user-11=connect9 user-12=athenare user-13=vantagep user-14=booff user-15=markward user-16=foundation user-17=ulsukarm user-18=ptkxhsbt user-19=dickemery123 user-20=martsblo user-21=magichat user-22=lbhyisi user-23=hhdugcor user-24=sarafoundation user-25=atestord user-26=strathar user-27=brmrjxl user-28=lakesan1 user-29=musorguk user-30=megacards user-31=wilsonsw user-32=carsinyo user-33=fetch user-34=putterfi user-35=hubmaster user-36=elecleis user-37=milloyco user-38=gilpin user-39=thqkgnbz user-40=connectedshoppin user-41=ianrayne user-42=accooper user-43=coursemc user-44=opaiscyx user-45=firstres user-46=jonhartl user-47=seftvta
Sep  5 15:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=ultbcrra user-49=southlon user-50=highlegh user-51=firstred user-52=costestimatorco user-53=clarkass user-54=firstrel user-55=alexadmin user-56=skyfirec user-57=nativene user-58=stuartge user-59=askhform user-60=innovat1 user-61=battlere user-62=oneoarco user-63=firstre2 user-64=vivienn1 user-65=brighto1 user-66=nstriton user-67=bemadonn user-68=ggaaorgu user-69=belle user-70=newstoda user-71=bedfords user-72=nsceres user-73=burydropin user-74=fawcettd user-75=dhyana user-76=eatspam user-77=darkstar user-78=beauty user-79=sibtoncc user-80=asandcoc user-81=steve user-82=zebrapho user-83=bwppodcast user-84=howardon user-85=pugwash user-86=paulmca1 user-87=cwsocial user-88=reliable user-89=ninejimm user-90=cambria1 user-91=cathski user-92=courseme user-93=eugincou user-94=hirefootballgame user-95=ctedorgu user-96=philmcph user-97=steakbridieme user-98=firstre5 user-99=donnychicago user-100=lkpier
Sep  5 15:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-101=fortunaz user-102=health2045 user-103=foods user-104=leftie user-105=putterfc user-106=nscdp user-107=barbersh user-108=tigerlet user-109=hidden user-110=nomistakes user-111=smrszyqg user-112=isleofwi user-113=onlycont user-114=attlebor user-115=lucy user-116=romaldki user-117=branko user-118=outdoorc user-119=hodgsonmail user-120=ranxterc user-121=jennimil user-122=tomandle user-123=careers user-124=nbhavers user-125=david user-126=mcdermos user-127=chrisdal user-128=nvihkvu user-129=sketchy user-130=cath user-131=havantho user-132=what user-133=tstardom user-134=oubpgvbx user-135=design user-136=kategilpin user-137=ladburyp user-138=stagingerris user-139=dancinggardener user-140=boldover user-141=nove user-142=sosevalu user-143=crrtipdl user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  5 15:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:10 nativespace-cdp sudo[2572606]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 15:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:10 nativespace-cdp sudo[2572611]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fQsVMOo1nIBWcUDM.~
Sep  5 15:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:11 nativespace-cdp sudo[2572614]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fQsVMOo1nIBWcUDM.~'
Sep  5 15:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:11 nativespace-cdp sudo[2572617]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fQsVMOo1nIBWcUDM.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 15:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:11 nativespace-cdp sudo[2572622]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 15:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:11 nativespace-cdp sudo[2572625]: pam_unix(sudo:session): session closed for user root
Sep  5 15:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 15:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 15:10:28 nativespace-cdp sudo[2572767]: pam_unix(sudo:session): session closed for user root
Sep  5 15:11:34 nativespace-cdp sshd[2573004]: Connection closed by 159.100.136.21 port 43552 [preauth]
Sep  5 15:16:36 nativespace-cdp sshd[2574365]: Connection closed by 159.100.136.21 port 53326 [preauth]
Sep  5 15:21:33 nativespace-cdp sshd[2575547]: Connection closed by 159.100.136.21 port 34390 [preauth]
Sep  5 15:26:35 nativespace-cdp sshd[2576596]: Connection closed by 159.100.136.21 port 44182 [preauth]
Sep  5 15:31:33 nativespace-cdp sshd[2577892]: Connection closed by 159.100.136.21 port 53676 [preauth]
Sep  5 15:36:34 nativespace-cdp sshd[2579161]: Connection closed by 159.100.136.21 port 35344 [preauth]
Sep  5 15:41:34 nativespace-cdp sshd[2580649]: Connection closed by 159.100.136.21 port 44942 [preauth]
Sep  5 15:46:34 nativespace-cdp sshd[2581702]: Connection closed by 159.100.136.21 port 54140 [preauth]
Sep  5 15:51:33 nativespace-cdp sshd[2582723]: Connection closed by 159.100.136.21 port 35256 [preauth]
Sep  5 15:56:34 nativespace-cdp sshd[2584000]: Connection closed by 159.100.136.21 port 44992 [preauth]
Sep  5 16:01:36 nativespace-cdp sshd[2585321]: Connection closed by 159.100.136.21 port 53924 [preauth]
Sep  5 16:06:33 nativespace-cdp sshd[2586537]: Connection closed by 159.100.136.21 port 35118 [preauth]
Sep  5 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:02 nativespace-cdp sudo[2587358]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:02 nativespace-cdp sudo[2587372]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:03 nativespace-cdp sudo[2587375]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 16:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:03 nativespace-cdp sudo[2587402]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 16:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:06 nativespace-cdp sudo[2587406]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 16:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:06 nativespace-cdp sudo[2587423]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 16:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:06 nativespace-cdp sudo[2587426]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 16:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:06 nativespace-cdp sudo[2587429]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 16:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:06 nativespace-cdp sudo[2587432]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 16:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:06 nativespace-cdp sudo[2587435]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 16:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:06 nativespace-cdp sudo[2587438]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 16:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:22 nativespace-cdp sudo[2587531]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 16:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:23 nativespace-cdp sudo[2587564]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=costestimatorco user-2=firstrel user-3=clarkass user-4=southlon user-5=highlegh user-6=firstred user-7=firstres user-8=seftvta user-9=jonhartl user-10=ultbcrra user-11=coursemc user-12=opaiscyx user-13=ianrayne user-14=accooper user-15=thqkgnbz user-16=connectedshoppin user-17=elecleis user-18=milloyco user-19=gilpin user-20=carsinyo user-21=fetch user-22=putterfi user-23=hubmaster user-24=bedfords user-25=bemadonn user-26=ggaaorgu user-27=belle user-28=newstoda user-29=brighto1 user-30=nstriton user-31=battlere user-32=oneoarco user-33=firstre2 user-34=vivienn1 user-35=askhform user-36=stuartge user-37=innovat1 user-38=nativene user-39=alexadmin user-40=skyfirec user-41=ulsukarm user-42=markward user-43=booff user-44=foundation user-45=maflemin user-46=lbscrmod user-47=connect9 user-48=athenare
Sep  5 16:10:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=vantagep user-50=still user-51=agproduc user-52=leereyn1 user-53=stephani user-54=jarvisin user-55=hodgesonweb user-56=theblack user-57=spectrum user-58=wilsonsw user-59=musorguk user-60=megacards user-61=lakesan1 user-62=brmrjxl user-63=sarafoundation user-64=atestord user-65=strathar user-66=lbhyisi user-67=hhdugcor user-68=magichat user-69=martsblo user-70=ptkxhsbt user-71=dickemery123 user-72=mcdermos user-73=chrisdal user-74=careers user-75=nbhavers user-76=david user-77=tomandle user-78=jennimil user-79=branko user-80=hodgsonmail user-81=outdoorc user-82=ranxterc user-83=romaldki user-84=attlebor user-85=lucy user-86=onlycont user-87=sosevalu user-88=crrtipdl user-89=bakery user-90=nove user-91=boldover user-92=kategilpin user-93=ladburyp user-94=stagingerris user-95=dancinggardener user-96=design user-97=what user-98=oubpgvbx user-99=tstardom user-100=nvihkvu user-101=sketchy user-102=cath
Sep  5 16:10:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=havantho user-104=zebrapho user-105=bwppodcast user-106=steve user-107=sibtoncc user-108=asandcoc user-109=eatspam user-110=darkstar user-111=beauty user-112=dhyana user-113=burydropin user-114=fawcettd user-115=nsceres user-116=isleofwi user-117=smrszyqg user-118=barbersh user-119=tigerlet user-120=hidden user-121=nomistakes user-122=fortunaz user-123=health2045 user-124=leftie user-125=foods user-126=putterfc user-127=nscdp user-128=philmcph user-129=ctedorgu user-130=donnychicago user-131=firstre5 user-132=steakbridieme user-133=lkpier user-134=hirefootballgame user-135=courseme user-136=eugincou user-137=reliable user-138=ninejimm user-139=cambria1 user-140=cathski user-141=howardon user-142=paulmca1 user-143=pugwash user-144=cwsocial feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 16:10:23 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 16:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:23 nativespace-cdp sudo[2587572]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 16:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:25 nativespace-cdp sudo[2587639]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hiSxkY6HmrR531Oe.~
Sep  5 16:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:25 nativespace-cdp sudo[2587650]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hiSxkY6HmrR531Oe.~'
Sep  5 16:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:25 nativespace-cdp sudo[2587654]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hiSxkY6HmrR531Oe.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 16:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:25 nativespace-cdp sudo[2587659]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 16:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:25 nativespace-cdp sudo[2587665]: pam_unix(sudo:session): session closed for user root
Sep  5 16:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 16:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 16:10:39 nativespace-cdp sudo[2587864]: pam_unix(sudo:session): session closed for user root
Sep  5 16:11:33 nativespace-cdp sshd[2588143]: Connection closed by 159.100.136.21 port 44470 [preauth]
Sep  5 16:16:33 nativespace-cdp sshd[2589245]: Connection closed by 159.100.136.21 port 53940 [preauth]
Sep  5 16:21:33 nativespace-cdp sshd[2590512]: Connection closed by 159.100.136.21 port 35296 [preauth]
Sep  5 16:26:33 nativespace-cdp sshd[2591780]: Connection closed by 159.100.136.21 port 44938 [preauth]
Sep  5 16:31:33 nativespace-cdp sshd[2593090]: Connection closed by 159.100.136.21 port 54438 [preauth]
Sep  5 16:36:33 nativespace-cdp sshd[2594548]: Connection closed by 159.100.136.21 port 36020 [preauth]
Sep  5 16:41:34 nativespace-cdp sshd[2596155]: Connection closed by 159.100.136.21 port 45230 [preauth]
Sep  5 16:46:37 nativespace-cdp sshd[2597527]: Connection closed by 159.100.136.21 port 54908 [preauth]
Sep  5 16:51:33 nativespace-cdp sshd[2598694]: Connection closed by 159.100.136.21 port 36594 [preauth]
Sep  5 16:56:33 nativespace-cdp sshd[2600216]: Connection closed by 159.100.136.21 port 46860 [preauth]
Sep  5 17:01:33 nativespace-cdp sshd[2601736]: Connection closed by 159.100.136.21 port 56860 [preauth]
Sep  5 17:06:33 nativespace-cdp sshd[2602881]: Connection closed by 159.100.136.21 port 38922 [preauth]
Sep  5 17:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 17:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:01 nativespace-cdp sudo[2603838]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 17:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:01 nativespace-cdp sudo[2603842]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 17:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:03 nativespace-cdp sudo[2603848]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 17:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:03 nativespace-cdp sudo[2603964]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 17:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:07 nativespace-cdp sudo[2603968]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 17:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:07 nativespace-cdp sudo[2603986]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 17:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:07 nativespace-cdp sudo[2603989]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 17:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:07 nativespace-cdp sudo[2603992]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 17:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:07 nativespace-cdp sudo[2603995]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 17:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:07 nativespace-cdp sudo[2603999]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 17:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:07 nativespace-cdp sudo[2604003]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:09 nativespace-cdp sudo[2604011]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:10 nativespace-cdp sudo[2604016]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=alexadmin user-2=skyfirec user-3=nativene user-4=innovat1 user-5=askhform user-6=stuartge user-7=vivienn1 user-8=firstre2 user-9=oneoarco user-10=battlere user-11=nstriton user-12=brighto1 user-13=newstoda user-14=belle user-15=ggaaorgu user-16=bemadonn user-17=bedfords user-18=putterfi user-19=hubmaster user-20=fetch user-21=carsinyo user-22=gilpin user-23=milloyco user-24=elecleis user-25=connectedshoppin user-26=thqkgnbz user-27=accooper user-28=ianrayne user-29=opaiscyx user-30=coursemc user-31=ultbcrra user-32=seftvta user-33=jonhartl user-34=firstres user-35=firstred user-36=highlegh user-37=southlon user-38=firstrel user-39=clarkass user-40=costestimatorco user-41=dickemery123 user-42=ptkxhsbt user-43=martsblo user-44=magichat user-45=hhdugcor user-46=lbhyisi user-47=strathar
Sep  5 17:10:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=atestord user-49=sarafoundation user-50=brmrjxl user-51=lakesan1 user-52=megacards user-53=musorguk user-54=wilsonsw user-55=spectrum user-56=theblack user-57=hodgesonweb user-58=jarvisin user-59=stephani user-60=leereyn1 user-61=agproduc user-62=still user-63=vantagep user-64=athenare user-65=connect9 user-66=lbscrmod user-67=maflemin user-68=markward user-69=foundation user-70=booff user-71=ulsukarm user-72=havantho user-73=sketchy user-74=cath user-75=nvihkvu user-76=tstardom user-77=oubpgvbx user-78=what user-79=design user-80=dancinggardener user-81=stagingerris user-82=ladburyp user-83=kategilpin user-84=boldover user-85=nove user-86=bakery user-87=crrtipdl user-88=sosevalu user-89=onlycont user-90=lucy user-91=attlebor user-92=romaldki user-93=hodgsonmail user-94=outdoorc user-95=ranxterc user-96=branko user-97=jennimil user-98=tomandle user-99=david user-100=careers user-101=nbhavers
Sep  5 17:10:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=chrisdal user-103=mcdermos user-104=cwsocial user-105=pugwash user-106=howardon user-107=paulmca1 user-108=cathski user-109=cambria1 user-110=reliable user-111=ninejimm user-112=eugincou user-113=courseme user-114=hirefootballgame user-115=lkpier user-116=steakbridieme user-117=firstre5 user-118=donnychicago user-119=philmcph user-120=ctedorgu user-121=nscdp user-122=putterfc user-123=foods user-124=leftie user-125=health2045 user-126=fortunaz user-127=nomistakes user-128=hidden user-129=tigerlet user-130=barbersh user-131=smrszyqg user-132=isleofwi user-133=nsceres user-134=fawcettd user-135=burydropin user-136=dhyana user-137=beauty user-138=darkstar user-139=eatspam user-140=sibtoncc user-141=asandcoc user-142=steve user-143=bwppodcast user-144=zebrapho feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  5 17:10:10 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:11 nativespace-cdp sudo[2604021]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 17:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:12 nativespace-cdp sudo[2604033]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GkOKbRy9pC6wkM2E.~
Sep  5 17:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:12 nativespace-cdp sudo[2604037]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GkOKbRy9pC6wkM2E.~'
Sep  5 17:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:12 nativespace-cdp sudo[2604040]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GkOKbRy9pC6wkM2E.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 17:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:12 nativespace-cdp sudo[2604044]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 17:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:12 nativespace-cdp sudo[2604047]: pam_unix(sudo:session): session closed for user root
Sep  5 17:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 17:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 17:10:29 nativespace-cdp sudo[2604107]: pam_unix(sudo:session): session closed for user root
Sep  5 17:11:33 nativespace-cdp sshd[2604341]: Connection closed by 159.100.136.21 port 48300 [preauth]
Sep  5 17:16:35 nativespace-cdp sshd[2605723]: Connection closed by 159.100.136.21 port 57978 [preauth]
Sep  5 17:21:36 nativespace-cdp sshd[2607011]: Connection closed by 159.100.136.21 port 39106 [preauth]
Sep  5 17:26:33 nativespace-cdp sshd[2608343]: Connection closed by 159.100.136.21 port 48972 [preauth]
Sep  5 17:31:33 nativespace-cdp sshd[2609552]: Connection closed by 159.100.136.21 port 58818 [preauth]
Sep  5 17:36:33 nativespace-cdp sshd[2611012]: Connection closed by 159.100.136.21 port 40882 [preauth]
Sep  5 17:41:33 nativespace-cdp sshd[2612237]: Connection closed by 159.100.136.21 port 50704 [preauth]
Sep  5 17:46:33 nativespace-cdp sshd[2613933]: Connection closed by 159.100.136.21 port 60940 [preauth]
Sep  5 17:51:33 nativespace-cdp sshd[2615174]: Connection closed by 159.100.136.21 port 42560 [preauth]
Sep  5 17:56:33 nativespace-cdp sshd[2616260]: Connection closed by 159.100.136.21 port 50778 [preauth]
Sep  5 18:01:33 nativespace-cdp sshd[2617787]: Connection closed by 159.100.136.21 port 58164 [preauth]
Sep  5 18:06:33 nativespace-cdp sshd[2619026]: Connection closed by 159.100.136.21 port 39484 [preauth]
Sep  5 18:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 18:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:09:59 nativespace-cdp sudo[2619753]: pam_unix(sudo:session): session closed for user root
Sep  5 18:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 18:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:09:59 nativespace-cdp sudo[2619758]: pam_unix(sudo:session): session closed for user root
Sep  5 18:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 18:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:00 nativespace-cdp sudo[2619763]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:00 nativespace-cdp sudo[2619776]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 18:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:05 nativespace-cdp sudo[2619782]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:05 nativespace-cdp sudo[2619911]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:05 nativespace-cdp sudo[2619914]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:05 nativespace-cdp sudo[2619917]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:05 nativespace-cdp sudo[2619920]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:05 nativespace-cdp sudo[2619923]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 18:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:05 nativespace-cdp sudo[2619926]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 18:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:10 nativespace-cdp sudo[2619936]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 18:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:11 nativespace-cdp sudo[2619945]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bwppodcast user-2=zebrapho user-3=steve user-4=asandcoc user-5=sibtoncc user-6=beauty user-7=eatspam user-8=darkstar user-9=dhyana user-10=burydropin user-11=fawcettd user-12=nsceres user-13=isleofwi user-14=smrszyqg user-15=hidden user-16=nomistakes user-17=barbersh user-18=tigerlet user-19=putterfc user-20=nscdp user-21=health2045 user-22=fortunaz user-23=foods user-24=leftie user-25=lkpier user-26=ctedorgu user-27=philmcph user-28=donnychicago user-29=firstre5 user-30=steakbridieme user-31=hirefootballgame user-32=eugincou user-33=courseme user-34=cathski user-35=cambria1 user-36=reliable user-37=ninejimm user-38=paulmca1 user-39=howardon user-40=pugwash user-41=cwsocial user-42=chrisdal user-43=mcdermos user-44=nbhavers user-45=careers user-46=david user-47=tomandle user-48=jennimil
Sep  5 18:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ranxterc user-50=hodgsonmail user-51=outdoorc user-52=branko user-53=romaldki user-54=attlebor user-55=lucy user-56=onlycont user-57=bakery user-58=sosevalu user-59=crrtipdl user-60=nove user-61=boldover user-62=ladburyp user-63=stagingerris user-64=dancinggardener user-65=kategilpin user-66=design user-67=oubpgvbx user-68=tstardom user-69=what user-70=sketchy user-71=cath user-72=havantho user-73=nvihkvu user-74=ulsukarm user-75=booff user-76=markward user-77=foundation user-78=athenare user-79=connect9 user-80=vantagep user-81=maflemin user-82=lbscrmod user-83=still user-84=agproduc user-85=stephani user-86=leereyn1 user-87=jarvisin user-88=spectrum user-89=hodgesonweb user-90=theblack user-91=wilsonsw user-92=musorguk user-93=megacards user-94=brmrjxl user-95=lakesan1 user-96=strathar user-97=sarafoundation user-98=atestord user-99=lbhyisi user-100=hhdugcor user-101=magichat user-102=martsblo
Sep  5 18:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=dickemery123 user-104=ptkxhsbt user-105=firstrel user-106=clarkass user-107=costestimatorco user-108=firstred user-109=southlon user-110=highlegh user-111=seftvta user-112=jonhartl user-113=ultbcrra user-114=firstres user-115=coursemc user-116=opaiscyx user-117=accooper user-118=ianrayne user-119=connectedshoppin user-120=thqkgnbz user-121=milloyco user-122=gilpin user-123=elecleis user-124=putterfi user-125=hubmaster user-126=carsinyo user-127=fetch user-128=bedfords user-129=ggaaorgu user-130=belle user-131=newstoda user-132=bemadonn user-133=brighto1 user-134=nstriton user-135=firstre2 user-136=vivienn1 user-137=battlere user-138=oneoarco user-139=innovat1 user-140=askhform user-141=stuartge user-142=nativene user-143=skyfirec user-144=alexadmin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 18:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 18:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:12 nativespace-cdp sudo[2619952]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 18:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:13 nativespace-cdp sudo[2619967]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-t67ct3dQh9xPLxvw.~
Sep  5 18:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:13 nativespace-cdp sudo[2619970]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-t67ct3dQh9xPLxvw.~'
Sep  5 18:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:13 nativespace-cdp sudo[2619973]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-t67ct3dQh9xPLxvw.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 18:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:13 nativespace-cdp sudo[2619977]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 18:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:13 nativespace-cdp sudo[2619980]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep  5 18:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:13 nativespace-cdp sudo[2619984]: pam_unix(sudo:session): session closed for user root
Sep  5 18:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 18:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 18:10:25 nativespace-cdp sudo[2620085]: pam_unix(sudo:session): session closed for user root
Sep  5 18:11:33 nativespace-cdp sshd[2620272]: Connection closed by 159.100.136.21 port 47886 [preauth]
Sep  5 18:16:33 nativespace-cdp sshd[2621692]: Connection closed by 159.100.136.21 port 57292 [preauth]
Sep  5 18:21:33 nativespace-cdp sshd[2622869]: Connection closed by 159.100.136.21 port 38514 [preauth]
Sep  5 18:26:33 nativespace-cdp sshd[2624249]: Connection closed by 159.100.136.21 port 46776 [preauth]
Sep  5 18:31:33 nativespace-cdp sshd[2625356]: Connection closed by 159.100.136.21 port 56670 [preauth]
Sep  5 18:36:35 nativespace-cdp sshd[2626414]: Connection closed by 159.100.136.21 port 38408 [preauth]
Sep  5 18:41:33 nativespace-cdp sshd[2627553]: Connection closed by 159.100.136.21 port 47494 [preauth]
Sep  5 18:46:33 nativespace-cdp sshd[2628748]: Connection closed by 159.100.136.21 port 56322 [preauth]
Sep  5 18:51:36 nativespace-cdp sshd[2630181]: Connection closed by 159.100.136.21 port 37600 [preauth]
Sep  5 18:53:26 nativespace-cdp sshd[2630515]: Invalid user system from 188.251.80.194 port 63409
Sep  5 18:53:26 nativespace-cdp sshd[2630515]: input_userauth_request: invalid user system [preauth]
Sep  5 18:53:26 nativespace-cdp sshd[2630515]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 18:53:26 nativespace-cdp sshd[2630515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.251.80.194
Sep  5 18:53:28 nativespace-cdp sshd[2630515]: Failed password for invalid user system from 188.251.80.194 port 63409 ssh2
Sep  5 18:53:28 nativespace-cdp sshd[2630515]: Received disconnect from 188.251.80.194 port 63409:11: Bye Bye [preauth]
Sep  5 18:53:28 nativespace-cdp sshd[2630515]: Disconnected from 188.251.80.194 port 63409 [preauth]
Sep  5 18:54:38 nativespace-cdp sshd[2630697]: Invalid user zhangzw from 188.251.80.194 port 58811
Sep  5 18:54:38 nativespace-cdp sshd[2630697]: input_userauth_request: invalid user zhangzw [preauth]
Sep  5 18:54:38 nativespace-cdp sshd[2630697]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 18:54:38 nativespace-cdp sshd[2630697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.251.80.194
Sep  5 18:54:40 nativespace-cdp sshd[2630697]: Failed password for invalid user zhangzw from 188.251.80.194 port 58811 ssh2
Sep  5 18:54:40 nativespace-cdp sshd[2630697]: Received disconnect from 188.251.80.194 port 58811:11: Bye Bye [preauth]
Sep  5 18:54:40 nativespace-cdp sshd[2630697]: Disconnected from 188.251.80.194 port 58811 [preauth]
Sep  5 18:55:19 nativespace-cdp sshd[2631089]: Invalid user exx from 188.251.80.194 port 60679
Sep  5 18:55:19 nativespace-cdp sshd[2631089]: input_userauth_request: invalid user exx [preauth]
Sep  5 18:55:19 nativespace-cdp sshd[2631089]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 18:55:19 nativespace-cdp sshd[2631089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.251.80.194
Sep  5 18:55:20 nativespace-cdp sshd[2631089]: Failed password for invalid user exx from 188.251.80.194 port 60679 ssh2
Sep  5 18:55:20 nativespace-cdp sshd[2631089]: Received disconnect from 188.251.80.194 port 60679:11: Bye Bye [preauth]
Sep  5 18:55:20 nativespace-cdp sshd[2631089]: Disconnected from 188.251.80.194 port 60679 [preauth]
Sep  5 18:56:33 nativespace-cdp sshd[2631422]: Connection closed by 159.100.136.21 port 47698 [preauth]
Sep  5 19:01:33 nativespace-cdp sshd[2632907]: Connection closed by 159.100.136.21 port 55648 [preauth]
Sep  5 19:06:33 nativespace-cdp sshd[2634041]: Connection closed by 159.100.136.21 port 37714 [preauth]
Sep  5 19:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 19:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:06 nativespace-cdp sudo[2634959]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 19:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:06 nativespace-cdp sudo[2634963]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 19:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:08 nativespace-cdp sudo[2634967]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 19:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:08 nativespace-cdp sudo[2634972]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 19:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:12 nativespace-cdp sudo[2634975]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 19:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:12 nativespace-cdp sudo[2635055]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 19:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:12 nativespace-cdp sudo[2635061]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 19:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:12 nativespace-cdp sudo[2635067]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 19:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:12 nativespace-cdp sudo[2635070]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 19:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:12 nativespace-cdp sudo[2635078]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 19:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:12 nativespace-cdp sudo[2635084]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 19:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:20 nativespace-cdp sudo[2635130]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 19:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:21 nativespace-cdp sudo[2635135]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=what user-2=oubpgvbx user-3=tstardom user-4=nvihkvu user-5=havantho user-6=sketchy user-7=cath user-8=kategilpin user-9=stagingerris user-10=dancinggardener user-11=ladburyp user-12=design user-13=nove user-14=boldover user-15=crrtipdl user-16=sosevalu user-17=bakery user-18=lucy user-19=attlebor user-20=onlycont user-21=branko user-22=ranxterc user-23=hodgsonmail user-24=outdoorc user-25=romaldki user-26=tomandle user-27=jennimil user-28=mcdermos user-29=chrisdal user-30=david user-31=nbhavers user-32=careers user-33=reliable user-34=ninejimm user-35=cathski user-36=cambria1 user-37=cwsocial user-38=pugwash user-39=howardon user-40=paulmca1 user-41=hirefootballgame user-42=courseme user-43=eugincou user-44=leftie user-45=foods user-46=fortunaz user-47=health2045 user-48=nscdp user-49=putterfc
Sep  5 19:10:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=firstre5 user-51=donnychicago user-52=steakbridieme user-53=ctedorgu user-54=philmcph user-55=lkpier user-56=isleofwi user-57=smrszyqg user-58=tigerlet user-59=barbersh user-60=nomistakes user-61=hidden user-62=fawcettd user-63=burydropin user-64=nsceres user-65=darkstar user-66=eatspam user-67=beauty user-68=dhyana user-69=asandcoc user-70=sibtoncc user-71=zebrapho user-72=bwppodcast user-73=steve user-74=alexadmin user-75=skyfirec user-76=askhform user-77=stuartge user-78=innovat1 user-79=nativene user-80=nstriton user-81=brighto1 user-82=oneoarco user-83=battlere user-84=vivienn1 user-85=firstre2 user-86=bedfords user-87=bemadonn user-88=newstoda user-89=belle user-90=ggaaorgu user-91=elecleis user-92=gilpin user-93=milloyco user-94=fetch user-95=carsinyo user-96=putterfi user-97=hubmaster user-98=ianrayne user-99=accooper user-100=thqkgnbz user-101=connectedshoppin user-102=firstres user-103=ultbcrra
Sep  5 19:10:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=seftvta user-105=jonhartl user-106=coursemc user-107=opaiscyx user-108=costestimatorco user-109=firstrel user-110=clarkass user-111=highlegh user-112=southlon user-113=firstred user-114=martsblo user-115=ptkxhsbt user-116=dickemery123 user-117=hhdugcor user-118=lbhyisi user-119=magichat user-120=lakesan1 user-121=brmrjxl user-122=atestord user-123=sarafoundation user-124=strathar user-125=wilsonsw user-126=megacards user-127=musorguk user-128=jarvisin user-129=hodgesonweb user-130=theblack user-131=spectrum user-132=agproduc user-133=still user-134=leereyn1 user-135=stephani user-136=markward user-137=foundation user-138=booff user-139=lbscrmod user-140=maflemin user-141=vantagep user-142=connect9 user-143=athenare user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains feature-9=webprotect
Sep  5 19:10:21 nativespace-cdp sudo: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 19:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:23 nativespace-cdp sudo[2635142]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 19:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:24 nativespace-cdp sudo[2635207]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xxXUDMGcFprMl8Ih.~
Sep  5 19:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:24 nativespace-cdp sudo[2635213]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xxXUDMGcFprMl8Ih.~'
Sep  5 19:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:24 nativespace-cdp sudo[2635217]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xxXUDMGcFprMl8Ih.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 19:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:24 nativespace-cdp sudo[2635223]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 19:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:24 nativespace-cdp sudo[2635228]: pam_unix(sudo:session): session closed for user root
Sep  5 19:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 19:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 19:10:37 nativespace-cdp sudo[2635285]: pam_unix(sudo:session): session closed for user root
Sep  5 19:11:33 nativespace-cdp sshd[2635460]: Connection closed by 159.100.136.21 port 47444 [preauth]
Sep  5 19:16:33 nativespace-cdp sshd[2636573]: Connection closed by 159.100.136.21 port 57070 [preauth]
Sep  5 19:21:34 nativespace-cdp sshd[2638083]: Connection closed by 159.100.136.21 port 38366 [preauth]
Sep  5 19:26:33 nativespace-cdp sshd[2639436]: Connection closed by 159.100.136.21 port 47810 [preauth]
Sep  5 19:31:33 nativespace-cdp sshd[2640562]: Connection closed by 159.100.136.21 port 57100 [preauth]
Sep  5 19:31:58 nativespace-cdp sshd[2640635]: Invalid user daniel from 209.38.229.174 port 36580
Sep  5 19:31:58 nativespace-cdp sshd[2640635]: input_userauth_request: invalid user daniel [preauth]
Sep  5 19:31:58 nativespace-cdp sshd[2640635]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 19:31:58 nativespace-cdp sshd[2640635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.229.174
Sep  5 19:32:01 nativespace-cdp sshd[2640635]: Failed password for invalid user daniel from 209.38.229.174 port 36580 ssh2
Sep  5 19:32:01 nativespace-cdp sshd[2640635]: Received disconnect from 209.38.229.174 port 36580:11: Bye Bye [preauth]
Sep  5 19:32:01 nativespace-cdp sshd[2640635]: Disconnected from 209.38.229.174 port 36580 [preauth]
Sep  5 19:36:33 nativespace-cdp sshd[2641661]: Connection closed by 159.100.136.21 port 38808 [preauth]
Sep  5 19:40:13 nativespace-cdp sshd[2642534]: Invalid user be from 209.38.229.174 port 59800
Sep  5 19:40:13 nativespace-cdp sshd[2642534]: input_userauth_request: invalid user be [preauth]
Sep  5 19:40:13 nativespace-cdp sshd[2642534]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 19:40:13 nativespace-cdp sshd[2642534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.229.174
Sep  5 19:40:15 nativespace-cdp sshd[2642534]: Failed password for invalid user be from 209.38.229.174 port 59800 ssh2
Sep  5 19:40:15 nativespace-cdp sshd[2642534]: Received disconnect from 209.38.229.174 port 59800:11: Bye Bye [preauth]
Sep  5 19:40:15 nativespace-cdp sshd[2642534]: Disconnected from 209.38.229.174 port 59800 [preauth]
Sep  5 19:40:52 nativespace-cdp sshd[2642998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.229.174  user=root
Sep  5 19:40:52 nativespace-cdp sshd[2642998]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 19:40:55 nativespace-cdp sshd[2642998]: Failed password for root from 209.38.229.174 port 51440 ssh2
Sep  5 19:40:55 nativespace-cdp sshd[2642998]: Received disconnect from 209.38.229.174 port 51440:11: Bye Bye [preauth]
Sep  5 19:40:55 nativespace-cdp sshd[2642998]: Disconnected from 209.38.229.174 port 51440 [preauth]
Sep  5 19:41:33 nativespace-cdp sshd[2643181]: Connection closed by 159.100.136.21 port 48194 [preauth]
Sep  5 19:44:20 nativespace-cdp sshd[2643617]: Invalid user git from 41.208.147.21 port 59062
Sep  5 19:44:20 nativespace-cdp sshd[2643617]: input_userauth_request: invalid user git [preauth]
Sep  5 19:44:20 nativespace-cdp sshd[2643617]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 19:44:20 nativespace-cdp sshd[2643617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.208.147.21
Sep  5 19:44:22 nativespace-cdp sshd[2643617]: Failed password for invalid user git from 41.208.147.21 port 59062 ssh2
Sep  5 19:44:22 nativespace-cdp sshd[2643617]: Received disconnect from 41.208.147.21 port 59062:11: Bye Bye [preauth]
Sep  5 19:44:22 nativespace-cdp sshd[2643617]: Disconnected from 41.208.147.21 port 59062 [preauth]
Sep  5 19:46:33 nativespace-cdp sshd[2644204]: Connection closed by 159.100.136.21 port 57652 [preauth]
Sep  5 19:46:47 nativespace-cdp sshd[2644243]: Invalid user gabriel from 41.208.147.21 port 46098
Sep  5 19:46:47 nativespace-cdp sshd[2644243]: input_userauth_request: invalid user gabriel [preauth]
Sep  5 19:46:47 nativespace-cdp sshd[2644243]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 19:46:47 nativespace-cdp sshd[2644243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.208.147.21
Sep  5 19:46:49 nativespace-cdp sshd[2644243]: Failed password for invalid user gabriel from 41.208.147.21 port 46098 ssh2
Sep  5 19:47:32 nativespace-cdp sshd[2644243]: Received disconnect from 41.208.147.21 port 46098:11: Bye Bye [preauth]
Sep  5 19:47:32 nativespace-cdp sshd[2644243]: Disconnected from 41.208.147.21 port 46098 [preauth]
Sep  5 19:48:05 nativespace-cdp sshd[2644462]: Invalid user operador from 41.208.147.21 port 44230
Sep  5 19:48:05 nativespace-cdp sshd[2644462]: input_userauth_request: invalid user operador [preauth]
Sep  5 19:48:05 nativespace-cdp sshd[2644462]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 19:48:05 nativespace-cdp sshd[2644462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.208.147.21
Sep  5 19:48:07 nativespace-cdp sshd[2644462]: Failed password for invalid user operador from 41.208.147.21 port 44230 ssh2
Sep  5 19:51:33 nativespace-cdp sshd[2645324]: Connection closed by 159.100.136.21 port 38754 [preauth]
Sep  5 19:56:33 nativespace-cdp sshd[2646837]: Connection closed by 159.100.136.21 port 48594 [preauth]
Sep  5 20:01:33 nativespace-cdp sshd[2648240]: Connection closed by 159.100.136.21 port 57892 [preauth]
Sep  5 20:06:33 nativespace-cdp sshd[2649401]: Connection closed by 159.100.136.21 port 39734 [preauth]
Sep  5 20:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 20:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:03 nativespace-cdp sudo[2650397]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 20:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:03 nativespace-cdp sudo[2650408]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 20:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:06 nativespace-cdp sudo[2650414]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 20:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:06 nativespace-cdp sudo[2650585]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 20:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:10 nativespace-cdp sudo[2650592]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:11 nativespace-cdp sudo[2650648]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:11 nativespace-cdp sudo[2650654]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:11 nativespace-cdp sudo[2650658]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:11 nativespace-cdp sudo[2650664]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:11 nativespace-cdp sudo[2650671]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 20:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:11 nativespace-cdp sudo[2650676]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 20:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:13 nativespace-cdp sudo[2650755]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 20:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:15 nativespace-cdp sudo[2650788]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=boldover user-2=nove user-3=crrtipdl user-4=sosevalu user-5=bakery user-6=nvihkvu user-7=havantho user-8=cath user-9=sketchy user-10=what user-11=oubpgvbx user-12=tstardom user-13=design user-14=kategilpin user-15=stagingerris user-16=dancinggardener user-17=ladburyp user-18=jennimil user-19=tomandle user-20=david user-21=nbhavers user-22=careers user-23=mcdermos user-24=chrisdal user-25=onlycont user-26=lucy user-27=attlebor user-28=romaldki user-29=branko user-30=ranxterc user-31=outdoorc user-32=hodgsonmail user-33=steakbridieme user-34=firstre5 user-35=donnychicago user-36=philmcph user-37=ctedorgu user-38=lkpier user-39=foods user-40=leftie user-41=fortunaz user-42=health2045 user-43=nscdp user-44=putterfc user-45=tigerlet user-46=barbersh user-47=nomistakes user-48=hidden user-49=smrszyqg
Sep  5 20:10:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=isleofwi user-51=cwsocial user-52=pugwash user-53=howardon user-54=paulmca1 user-55=ninejimm user-56=reliable user-57=cathski user-58=cambria1 user-59=courseme user-60=eugincou user-61=hirefootballgame user-62=sibtoncc user-63=asandcoc user-64=steve user-65=zebrapho user-66=bwppodcast user-67=nsceres user-68=fawcettd user-69=burydropin user-70=dhyana user-71=darkstar user-72=eatspam user-73=beauty user-74=oneoarco user-75=battlere user-76=vivienn1 user-77=firstre2 user-78=nstriton user-79=brighto1 user-80=bemadonn user-81=newstoda user-82=belle user-83=ggaaorgu user-84=bedfords user-85=alexadmin user-86=skyfirec user-87=nativene user-88=stuartge user-89=askhform user-90=innovat1 user-91=coursemc user-92=opaiscyx user-93=firstres user-94=ultbcrra user-95=seftvta user-96=jonhartl user-97=highlegh user-98=southlon user-99=firstred user-100=costestimatorco user-101=firstrel user-102=clarkass user-103=fetch
Sep  5 20:10:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=carsinyo user-105=putterfi user-106=hubmaster user-107=elecleis user-108=milloyco user-109=gilpin user-110=thqkgnbz user-111=connectedshoppin user-112=ianrayne user-113=accooper user-114=atestord user-115=sarafoundation user-116=strathar user-117=lakesan1 user-118=brmrjxl user-119=megacards user-120=musorguk user-121=wilsonsw user-122=ptkxhsbt user-123=dickemery123 user-124=martsblo user-125=magichat user-126=hhdugcor user-127=lbhyisi user-128=lbscrmod user-129=maflemin user-130=vantagep user-131=athenare user-132=connect9 user-133=markward user-134=foundation user-135=booff user-136=ulsukarm user-137=theblack user-138=hodgesonweb user-139=spectrum user-140=jarvisin user-141=leereyn1 user-142=stephani user-143=agproduc user-144=still feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 20:10:15 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 20:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:16 nativespace-cdp sudo[2650870]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 20:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:17 nativespace-cdp sudo[2650888]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6RswhjpJNWDR1cH2.~
Sep  5 20:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:17 nativespace-cdp sudo[2650893]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6RswhjpJNWDR1cH2.~'
Sep  5 20:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:17 nativespace-cdp sudo[2650897]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6RswhjpJNWDR1cH2.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 20:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:17 nativespace-cdp sudo[2650903]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 20:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:17 nativespace-cdp sudo[2650908]: pam_unix(sudo:session): session closed for user root
Sep  5 20:10:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 20:10:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 20:10:31 nativespace-cdp sudo[2651007]: pam_unix(sudo:session): session closed for user root
Sep  5 20:11:33 nativespace-cdp sshd[2651246]: Connection closed by 159.100.136.21 port 49406 [preauth]
Sep  5 20:16:35 nativespace-cdp sshd[2652310]: Connection closed by 159.100.136.21 port 58788 [preauth]
Sep  5 20:21:34 nativespace-cdp sshd[2653385]: Connection closed by 159.100.136.21 port 40024 [preauth]
Sep  5 20:26:33 nativespace-cdp sshd[2654782]: Connection closed by 159.100.136.21 port 49720 [preauth]
Sep  5 20:31:33 nativespace-cdp sshd[2655915]: Connection closed by 159.100.136.21 port 58918 [preauth]
Sep  5 20:36:33 nativespace-cdp sshd[2656977]: Connection closed by 159.100.136.21 port 40178 [preauth]
Sep  5 20:41:33 nativespace-cdp sshd[2658214]: Connection closed by 159.100.136.21 port 49918 [preauth]
Sep  5 20:45:37 nativespace-cdp sshd[2659595]: Invalid user tj from 45.233.58.140 port 38424
Sep  5 20:45:37 nativespace-cdp sshd[2659595]: input_userauth_request: invalid user tj [preauth]
Sep  5 20:45:37 nativespace-cdp sshd[2659595]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:45:37 nativespace-cdp sshd[2659595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.233.58.140
Sep  5 20:45:39 nativespace-cdp sshd[2659595]: Failed password for invalid user tj from 45.233.58.140 port 38424 ssh2
Sep  5 20:45:40 nativespace-cdp sshd[2659595]: Received disconnect from 45.233.58.140 port 38424:11: Bye Bye [preauth]
Sep  5 20:45:40 nativespace-cdp sshd[2659595]: Disconnected from 45.233.58.140 port 38424 [preauth]
Sep  5 20:46:33 nativespace-cdp sshd[2659895]: Connection closed by 159.100.136.21 port 59612 [preauth]
Sep  5 20:46:50 nativespace-cdp sshd[2659933]: Invalid user dachuang from 69.49.246.187 port 40394
Sep  5 20:46:50 nativespace-cdp sshd[2659933]: input_userauth_request: invalid user dachuang [preauth]
Sep  5 20:46:50 nativespace-cdp sshd[2659933]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:46:50 nativespace-cdp sshd[2659933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.49.246.187
Sep  5 20:46:53 nativespace-cdp sshd[2659933]: Failed password for invalid user dachuang from 69.49.246.187 port 40394 ssh2
Sep  5 20:46:53 nativespace-cdp sshd[2659933]: Received disconnect from 69.49.246.187 port 40394:11: Bye Bye [preauth]
Sep  5 20:46:53 nativespace-cdp sshd[2659933]: Disconnected from 69.49.246.187 port 40394 [preauth]
Sep  5 20:47:10 nativespace-cdp sshd[2660027]: Invalid user redmine from 152.42.214.15 port 57754
Sep  5 20:47:10 nativespace-cdp sshd[2660027]: input_userauth_request: invalid user redmine [preauth]
Sep  5 20:47:10 nativespace-cdp sshd[2660027]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:47:10 nativespace-cdp sshd[2660027]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.214.15
Sep  5 20:47:13 nativespace-cdp sshd[2660027]: Failed password for invalid user redmine from 152.42.214.15 port 57754 ssh2
Sep  5 20:47:13 nativespace-cdp sshd[2660027]: Received disconnect from 152.42.214.15 port 57754:11: Bye Bye [preauth]
Sep  5 20:47:13 nativespace-cdp sshd[2660027]: Disconnected from 152.42.214.15 port 57754 [preauth]
Sep  5 20:47:56 nativespace-cdp sshd[2660164]: Invalid user test from 157.230.228.48 port 57378
Sep  5 20:47:56 nativespace-cdp sshd[2660164]: input_userauth_request: invalid user test [preauth]
Sep  5 20:47:56 nativespace-cdp sshd[2660164]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:47:56 nativespace-cdp sshd[2660164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.228.48
Sep  5 20:47:58 nativespace-cdp sshd[2660164]: Failed password for invalid user test from 157.230.228.48 port 57378 ssh2
Sep  5 20:47:59 nativespace-cdp sshd[2660164]: Received disconnect from 157.230.228.48 port 57378:11: Bye Bye [preauth]
Sep  5 20:47:59 nativespace-cdp sshd[2660164]: Disconnected from 157.230.228.48 port 57378 [preauth]
Sep  5 20:49:13 nativespace-cdp sshd[2660376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.100.24.139  user=root
Sep  5 20:49:13 nativespace-cdp sshd[2660376]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 20:49:15 nativespace-cdp sshd[2660376]: Failed password for root from 175.100.24.139 port 50900 ssh2
Sep  5 20:49:15 nativespace-cdp sshd[2660376]: Received disconnect from 175.100.24.139 port 50900:11: Bye Bye [preauth]
Sep  5 20:49:15 nativespace-cdp sshd[2660376]: Disconnected from 175.100.24.139 port 50900 [preauth]
Sep  5 20:51:35 nativespace-cdp sshd[2661023]: Connection closed by 159.100.136.21 port 40590 [preauth]
Sep  5 20:52:42 nativespace-cdp sshd[2661158]: Invalid user danial from 103.96.148.81 port 48000
Sep  5 20:52:42 nativespace-cdp sshd[2661158]: input_userauth_request: invalid user danial [preauth]
Sep  5 20:52:42 nativespace-cdp sshd[2661158]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:52:42 nativespace-cdp sshd[2661158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.96.148.81
Sep  5 20:52:44 nativespace-cdp sshd[2661158]: Failed password for invalid user danial from 103.96.148.81 port 48000 ssh2
Sep  5 20:52:44 nativespace-cdp sshd[2661158]: Received disconnect from 103.96.148.81 port 48000:11: Bye Bye [preauth]
Sep  5 20:52:44 nativespace-cdp sshd[2661158]: Disconnected from 103.96.148.81 port 48000 [preauth]
Sep  5 20:53:16 nativespace-cdp sshd[2661344]: Invalid user redmine from 64.227.188.110 port 34584
Sep  5 20:53:16 nativespace-cdp sshd[2661344]: input_userauth_request: invalid user redmine [preauth]
Sep  5 20:53:16 nativespace-cdp sshd[2661344]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:53:16 nativespace-cdp sshd[2661344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.188.110
Sep  5 20:53:18 nativespace-cdp sshd[2661344]: Failed password for invalid user redmine from 64.227.188.110 port 34584 ssh2
Sep  5 20:53:22 nativespace-cdp sshd[2661344]: Received disconnect from 64.227.188.110 port 34584:11: Bye Bye [preauth]
Sep  5 20:53:22 nativespace-cdp sshd[2661344]: Disconnected from 64.227.188.110 port 34584 [preauth]
Sep  5 20:53:41 nativespace-cdp sshd[2661442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.233.58.140  user=root
Sep  5 20:53:41 nativespace-cdp sshd[2661442]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 20:53:43 nativespace-cdp sshd[2661442]: Failed password for root from 45.233.58.140 port 38680 ssh2
Sep  5 20:53:43 nativespace-cdp sshd[2661442]: Received disconnect from 45.233.58.140 port 38680:11: Bye Bye [preauth]
Sep  5 20:53:43 nativespace-cdp sshd[2661442]: Disconnected from 45.233.58.140 port 38680 [preauth]
Sep  5 20:53:56 nativespace-cdp sshd[2661487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.49.246.187  user=root
Sep  5 20:53:56 nativespace-cdp sshd[2661487]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 20:53:59 nativespace-cdp sshd[2661487]: Failed password for root from 69.49.246.187 port 47600 ssh2
Sep  5 20:53:59 nativespace-cdp sshd[2661487]: Received disconnect from 69.49.246.187 port 47600:11: Bye Bye [preauth]
Sep  5 20:53:59 nativespace-cdp sshd[2661487]: Disconnected from 69.49.246.187 port 47600 [preauth]
Sep  5 20:54:20 nativespace-cdp sshd[2661551]: Invalid user plex from 64.227.188.110 port 33498
Sep  5 20:54:20 nativespace-cdp sshd[2661551]: input_userauth_request: invalid user plex [preauth]
Sep  5 20:54:20 nativespace-cdp sshd[2661551]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:54:20 nativespace-cdp sshd[2661551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.188.110
Sep  5 20:54:21 nativespace-cdp sshd[2661554]: Invalid user plex from 157.230.228.48 port 32998
Sep  5 20:54:21 nativespace-cdp sshd[2661554]: input_userauth_request: invalid user plex [preauth]
Sep  5 20:54:21 nativespace-cdp sshd[2661554]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:54:21 nativespace-cdp sshd[2661554]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.228.48
Sep  5 20:54:23 nativespace-cdp sshd[2661554]: Failed password for invalid user plex from 157.230.228.48 port 32998 ssh2
Sep  5 20:54:23 nativespace-cdp sshd[2661554]: Received disconnect from 157.230.228.48 port 32998:11: Bye Bye [preauth]
Sep  5 20:54:23 nativespace-cdp sshd[2661554]: Disconnected from 157.230.228.48 port 32998 [preauth]
Sep  5 20:54:23 nativespace-cdp sshd[2661551]: Failed password for invalid user plex from 64.227.188.110 port 33498 ssh2
Sep  5 20:54:23 nativespace-cdp sshd[2661551]: Received disconnect from 64.227.188.110 port 33498:11: Bye Bye [preauth]
Sep  5 20:54:23 nativespace-cdp sshd[2661551]: Disconnected from 64.227.188.110 port 33498 [preauth]
Sep  5 20:54:38 nativespace-cdp sshd[2661590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.214.15  user=root
Sep  5 20:54:38 nativespace-cdp sshd[2661590]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 20:54:39 nativespace-cdp sshd[2661597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.102.26  user=root
Sep  5 20:54:39 nativespace-cdp sshd[2661597]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 20:54:40 nativespace-cdp sshd[2661602]: Invalid user yjp from 69.49.246.187 port 53106
Sep  5 20:54:40 nativespace-cdp sshd[2661602]: input_userauth_request: invalid user yjp [preauth]
Sep  5 20:54:40 nativespace-cdp sshd[2661602]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:54:40 nativespace-cdp sshd[2661602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.49.246.187
Sep  5 20:54:40 nativespace-cdp sshd[2661590]: Failed password for root from 152.42.214.15 port 55370 ssh2
Sep  5 20:54:40 nativespace-cdp sshd[2661605]: Connection closed by 45.233.58.140 port 38744 [preauth]
Sep  5 20:54:40 nativespace-cdp sshd[2661590]: Received disconnect from 152.42.214.15 port 55370:11: Bye Bye [preauth]
Sep  5 20:54:40 nativespace-cdp sshd[2661590]: Disconnected from 152.42.214.15 port 55370 [preauth]
Sep  5 20:54:41 nativespace-cdp sshd[2661597]: Failed password for root from 138.197.102.26 port 60518 ssh2
Sep  5 20:54:42 nativespace-cdp sshd[2661602]: Failed password for invalid user yjp from 69.49.246.187 port 53106 ssh2
Sep  5 20:54:45 nativespace-cdp sshd[2661602]: Received disconnect from 69.49.246.187 port 53106:11: Bye Bye [preauth]
Sep  5 20:54:45 nativespace-cdp sshd[2661602]: Disconnected from 69.49.246.187 port 53106 [preauth]
Sep  5 20:54:47 nativespace-cdp sshd[2661597]: Received disconnect from 138.197.102.26 port 60518:11: Bye Bye [preauth]
Sep  5 20:54:47 nativespace-cdp sshd[2661597]: Disconnected from 138.197.102.26 port 60518 [preauth]
Sep  5 20:55:04 nativespace-cdp sshd[2661934]: Invalid user mcq from 157.230.228.48 port 46700
Sep  5 20:55:04 nativespace-cdp sshd[2661934]: input_userauth_request: invalid user mcq [preauth]
Sep  5 20:55:04 nativespace-cdp sshd[2661934]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:55:04 nativespace-cdp sshd[2661934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.228.48
Sep  5 20:55:04 nativespace-cdp sshd[2661798]: Invalid user trend from 175.100.24.139 port 38322
Sep  5 20:55:04 nativespace-cdp sshd[2661798]: input_userauth_request: invalid user trend [preauth]
Sep  5 20:55:04 nativespace-cdp sshd[2661798]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:55:04 nativespace-cdp sshd[2661798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.100.24.139
Sep  5 20:55:05 nativespace-cdp sshd[2661937]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.188.110  user=root
Sep  5 20:55:05 nativespace-cdp sshd[2661937]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 20:55:05 nativespace-cdp sshd[2661806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.96.148.81  user=root
Sep  5 20:55:05 nativespace-cdp sshd[2661806]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 20:55:06 nativespace-cdp sshd[2661937]: Failed password for root from 64.227.188.110 port 55950 ssh2
Sep  5 20:55:06 nativespace-cdp sshd[2661937]: Received disconnect from 64.227.188.110 port 55950:11: Bye Bye [preauth]
Sep  5 20:55:06 nativespace-cdp sshd[2661937]: Disconnected from 64.227.188.110 port 55950 [preauth]
Sep  5 20:55:07 nativespace-cdp sshd[2661806]: Failed password for root from 103.96.148.81 port 42228 ssh2
Sep  5 20:55:07 nativespace-cdp sshd[2661806]: Received disconnect from 103.96.148.81 port 42228:11: Bye Bye [preauth]
Sep  5 20:55:07 nativespace-cdp sshd[2661806]: Disconnected from 103.96.148.81 port 42228 [preauth]
Sep  5 20:55:07 nativespace-cdp sshd[2661934]: Failed password for invalid user mcq from 157.230.228.48 port 46700 ssh2
Sep  5 20:55:07 nativespace-cdp sshd[2661798]: Failed password for invalid user trend from 175.100.24.139 port 38322 ssh2
Sep  5 20:55:07 nativespace-cdp sshd[2661798]: Received disconnect from 175.100.24.139 port 38322:11: Bye Bye [preauth]
Sep  5 20:55:07 nativespace-cdp sshd[2661798]: Disconnected from 175.100.24.139 port 38322 [preauth]
Sep  5 20:55:22 nativespace-cdp sshd[2662270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.102.26  user=root
Sep  5 20:55:22 nativespace-cdp sshd[2662270]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  5 20:55:25 nativespace-cdp sshd[2662276]: Invalid user test from 45.233.58.140 port 38804
Sep  5 20:55:25 nativespace-cdp sshd[2662276]: input_userauth_request: invalid user test [preauth]
Sep  5 20:55:25 nativespace-cdp sshd[2662276]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:55:25 nativespace-cdp sshd[2662276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.233.58.140
Sep  5 20:55:25 nativespace-cdp sshd[2662270]: Failed password for root from 138.197.102.26 port 45564 ssh2
Sep  5 20:55:25 nativespace-cdp sshd[2662270]: Received disconnect from 138.197.102.26 port 45564:11: Bye Bye [preauth]
Sep  5 20:55:25 nativespace-cdp sshd[2662270]: Disconnected from 138.197.102.26 port 45564 [preauth]
Sep  5 20:55:27 nativespace-cdp sshd[2662276]: Failed password for invalid user test from 45.233.58.140 port 38804 ssh2
Sep  5 20:55:30 nativespace-cdp sshd[2662316]: Invalid user trend from 152.42.214.15 port 57340
Sep  5 20:55:30 nativespace-cdp sshd[2662316]: input_userauth_request: invalid user trend [preauth]
Sep  5 20:55:30 nativespace-cdp sshd[2662316]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:55:30 nativespace-cdp sshd[2662316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.214.15
Sep  5 20:55:31 nativespace-cdp sshd[2662316]: Failed password for invalid user trend from 152.42.214.15 port 57340 ssh2
Sep  5 20:55:48 nativespace-cdp sshd[2662433]: Invalid user user from 103.96.148.81 port 47256
Sep  5 20:55:48 nativespace-cdp sshd[2662433]: input_userauth_request: invalid user user [preauth]
Sep  5 20:55:48 nativespace-cdp sshd[2662433]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:55:48 nativespace-cdp sshd[2662433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.96.148.81
Sep  5 20:55:49 nativespace-cdp sshd[2662433]: Failed password for invalid user user from 103.96.148.81 port 47256 ssh2
Sep  5 20:55:50 nativespace-cdp sshd[2662433]: Received disconnect from 103.96.148.81 port 47256:11: Bye Bye [preauth]
Sep  5 20:55:50 nativespace-cdp sshd[2662433]: Disconnected from 103.96.148.81 port 47256 [preauth]
Sep  5 20:55:50 nativespace-cdp sshd[2662444]: Invalid user zw from 175.100.24.139 port 51740
Sep  5 20:55:50 nativespace-cdp sshd[2662444]: input_userauth_request: invalid user zw [preauth]
Sep  5 20:55:50 nativespace-cdp sshd[2662444]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:55:50 nativespace-cdp sshd[2662444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.100.24.139
Sep  5 20:55:52 nativespace-cdp sshd[2662444]: Failed password for invalid user zw from 175.100.24.139 port 51740 ssh2
Sep  5 20:55:52 nativespace-cdp sshd[2662444]: Received disconnect from 175.100.24.139 port 51740:11: Bye Bye [preauth]
Sep  5 20:55:52 nativespace-cdp sshd[2662444]: Disconnected from 175.100.24.139 port 51740 [preauth]
Sep  5 20:56:05 nativespace-cdp sshd[2662617]: Invalid user trend from 138.197.102.26 port 58458
Sep  5 20:56:05 nativespace-cdp sshd[2662617]: input_userauth_request: invalid user trend [preauth]
Sep  5 20:56:05 nativespace-cdp sshd[2662617]: pam_unix(sshd:auth): check pass; user unknown
Sep  5 20:56:05 nativespace-cdp sshd[2662617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.102.26
Sep  5 20:56:06 nativespace-cdp sshd[2662617]: Failed password for invalid user trend from 138.197.102.26 port 58458 ssh2
Sep  5 20:56:07 nativespace-cdp sshd[2662617]: Received disconnect from 138.197.102.26 port 58458:11: Bye Bye [preauth]
Sep  5 20:56:07 nativespace-cdp sshd[2662617]: Disconnected from 138.197.102.26 port 58458 [preauth]
Sep  5 20:56:33 nativespace-cdp sshd[2662710]: Connection closed by 159.100.136.21 port 50154 [preauth]
Sep  5 21:01:33 nativespace-cdp sshd[2663958]: Connection closed by 159.100.136.21 port 59860 [preauth]
Sep  5 21:06:33 nativespace-cdp sshd[2664962]: Connection closed by 159.100.136.21 port 41244 [preauth]
Sep  5 21:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 21:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:00 nativespace-cdp sudo[2665674]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 21:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:00 nativespace-cdp sudo[2665685]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 21:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:01 nativespace-cdp sudo[2665690]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:01 nativespace-cdp sudo[2665701]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:05 nativespace-cdp sudo[2665707]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:05 nativespace-cdp sudo[2665832]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:05 nativespace-cdp sudo[2665836]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:05 nativespace-cdp sudo[2665839]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:05 nativespace-cdp sudo[2665843]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:05 nativespace-cdp sudo[2665846]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:05 nativespace-cdp sudo[2665852]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:08 nativespace-cdp sudo[2665928]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:08 nativespace-cdp sudo[2665933]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nvihkvu user-2=sketchy user-3=cath user-4=havantho user-5=what user-6=oubpgvbx user-7=tstardom user-8=design user-9=kategilpin user-10=ladburyp user-11=dancinggardener user-12=stagingerris user-13=boldover user-14=nove user-15=sosevalu user-16=crrtipdl user-17=bakery user-18=onlycont user-19=attlebor user-20=lucy user-21=romaldki user-22=branko user-23=ranxterc user-24=hodgsonmail user-25=outdoorc user-26=jennimil user-27=tomandle user-28=nbhavers user-29=careers user-30=david user-31=mcdermos user-32=chrisdal user-33=howardon user-34=paulmca1 user-35=pugwash user-36=cwsocial user-37=reliable user-38=ninejimm user-39=cambria1 user-40=cathski user-41=courseme user-42=eugincou user-43=hirefootballgame user-44=ctedorgu user-45=philmcph user-46=firstre5 user-47=donnychicago user-48=steakbridieme
Sep  5 21:10:08 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=lkpier user-50=fortunaz user-51=health2045 user-52=leftie user-53=foods user-54=putterfc user-55=nscdp user-56=tigerlet user-57=barbersh user-58=hidden user-59=nomistakes user-60=smrszyqg user-61=isleofwi user-62=nsceres user-63=burydropin user-64=fawcettd user-65=dhyana user-66=eatspam user-67=darkstar user-68=beauty user-69=asandcoc user-70=sibtoncc user-71=steve user-72=zebrapho user-73=bwppodcast user-74=alexadmin user-75=skyfirec user-76=nativene user-77=stuartge user-78=askhform user-79=innovat1 user-80=battlere user-81=oneoarco user-82=firstre2 user-83=vivienn1 user-84=brighto1 user-85=nstriton user-86=bemadonn user-87=belle user-88=ggaaorgu user-89=newstoda user-90=bedfords user-91=carsinyo user-92=fetch user-93=putterfi user-94=hubmaster user-95=elecleis user-96=milloyco user-97=gilpin user-98=thqkgnbz user-99=connectedshoppin user-100=ianrayne user-101=accooper user-102=opaiscyx
Sep  5 21:10:08 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=coursemc user-104=firstres user-105=jonhartl user-106=seftvta user-107=ultbcrra user-108=southlon user-109=highlegh user-110=firstred user-111=costestimatorco user-112=clarkass user-113=firstrel user-114=ptkxhsbt user-115=dickemery123 user-116=martsblo user-117=magichat user-118=lbhyisi user-119=hhdugcor user-120=sarafoundation user-121=atestord user-122=strathar user-123=lakesan1 user-124=brmrjxl user-125=musorguk user-126=megacards user-127=wilsonsw user-128=theblack user-129=hodgesonweb user-130=spectrum user-131=jarvisin user-132=leereyn1 user-133=stephani user-134=still user-135=agproduc user-136=maflemin user-137=lbscrmod user-138=connect9 user-139=athenare user-140=vantagep user-141=foundation user-142=markward user-143=booff user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 21:10:08 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:09 nativespace-cdp sudo[2665938]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:09 nativespace-cdp sudo[2665943]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-s9NI2gB5FJSG9lec.~
Sep  5 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:09 nativespace-cdp sudo[2665946]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-s9NI2gB5FJSG9lec.~'
Sep  5 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:09 nativespace-cdp sudo[2665949]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-s9NI2gB5FJSG9lec.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:09 nativespace-cdp sudo[2665953]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:09 nativespace-cdp sudo[2665956]: pam_unix(sudo:session): session closed for user root
Sep  5 21:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 21:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:10:16 nativespace-cdp sudo[2666035]: pam_unix(sudo:session): session closed for user root
Sep  5 21:11:33 nativespace-cdp sshd[2666591]: Connection closed by 159.100.136.21 port 50530 [preauth]
Sep  5 21:16:33 nativespace-cdp sshd[2667626]: Connection closed by 159.100.136.21 port 59548 [preauth]
Sep  5 21:21:34 nativespace-cdp sshd[2668665]: Connection closed by 159.100.136.21 port 40818 [preauth]
Sep  5 21:26:33 nativespace-cdp sshd[2670049]: Connection closed by 159.100.136.21 port 50548 [preauth]
Sep  5 21:31:33 nativespace-cdp sshd[2671221]: Connection closed by 159.100.136.21 port 59478 [preauth]
Sep  5 21:36:33 nativespace-cdp sshd[2672336]: Connection closed by 159.100.136.21 port 40876 [preauth]
Sep  5 21:41:35 nativespace-cdp sshd[2673439]: Connection closed by 159.100.136.21 port 50604 [preauth]
Sep  5 21:42:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 21:42:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:42:38 nativespace-cdp sudo[2673796]: pam_unix(sudo:session): session closed for user root
Sep  5 21:42:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  5 21:42:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:42:55 nativespace-cdp sudo[2673811]: pam_unix(sudo:session): session closed for user root
Sep  5 21:42:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  5 21:42:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 21:43:00 nativespace-cdp sudo[2673870]: pam_unix(sudo:session): session closed for user root
Sep  5 21:46:33 nativespace-cdp sshd[2674763]: Connection closed by 159.100.136.21 port 60478 [preauth]
Sep  5 21:46:39 nativespace-cdp sshd[2674779]: Did not receive identification string from 87.236.176.197 port 53445
Sep  5 21:46:40 nativespace-cdp sshd[2674786]: Connection closed by 87.236.176.197 port 49603 [preauth]
Sep  5 21:51:33 nativespace-cdp sshd[2675985]: Connection closed by 159.100.136.21 port 41388 [preauth]
Sep  5 21:56:33 nativespace-cdp sshd[2677524]: Connection closed by 159.100.136.21 port 51150 [preauth]
Sep  5 22:01:34 nativespace-cdp sshd[2678948]: Connection closed by 159.100.136.21 port 59934 [preauth]
Sep  5 22:06:34 nativespace-cdp sshd[2679956]: Connection closed by 159.100.136.21 port 39444 [preauth]
Sep  5 22:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 22:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:00 nativespace-cdp sudo[2680662]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 22:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:00 nativespace-cdp sudo[2680666]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 22:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:01 nativespace-cdp sudo[2680671]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 22:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:01 nativespace-cdp sudo[2680757]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 22:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:05 nativespace-cdp sudo[2680764]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 22:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:05 nativespace-cdp sudo[2680818]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 22:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:05 nativespace-cdp sudo[2680821]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 22:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:06 nativespace-cdp sudo[2680826]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 22:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:06 nativespace-cdp sudo[2680832]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 22:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:06 nativespace-cdp sudo[2680836]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 22:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:06 nativespace-cdp sudo[2680853]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 22:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:09 nativespace-cdp sudo[2680982]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 22:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:10 nativespace-cdp sudo[2681000]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=agproduc user-2=still user-3=stephani user-4=leereyn1 user-5=jarvisin user-6=spectrum user-7=theblack user-8=hodgesonweb user-9=ulsukarm user-10=markward user-11=booff user-12=foundation user-13=vantagep user-14=connect9 user-15=athenare user-16=lbscrmod user-17=maflemin user-18=hhdugcor user-19=lbhyisi user-20=magichat user-21=martsblo user-22=dickemery123 user-23=ptkxhsbt user-24=wilsonsw user-25=megacards user-26=musorguk user-27=brmrjxl user-28=lakesan1 user-29=strathar user-30=atestord user-31=sarafoundation user-32=accooper user-33=ianrayne user-34=connectedshoppin user-35=thqkgnbz user-36=milloyco user-37=gilpin user-38=elecleis user-39=hubmaster user-40=putterfi user-41=fetch user-42=carsinyo user-43=firstrel user-44=clarkass user-45=costestimatorco user-46=firstred user-47=highlegh
Sep  5 22:10:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=southlon user-49=ultbcrra user-50=jonhartl user-51=seftvta user-52=firstres user-53=coursemc user-54=opaiscyx user-55=innovat1 user-56=stuartge user-57=askhform user-58=nativene user-59=alexadmin user-60=skyfirec user-61=bedfords user-62=newstoda user-63=belle user-64=ggaaorgu user-65=bemadonn user-66=nstriton user-67=brighto1 user-68=vivienn1 user-69=firstre2 user-70=oneoarco user-71=battlere user-72=beauty user-73=darkstar user-74=eatspam user-75=dhyana user-76=fawcettd user-77=burydropin user-78=nsceres user-79=bwppodcast user-80=zebrapho user-81=steve user-82=asandcoc user-83=sibtoncc user-84=hirefootballgame user-85=eugincou user-86=courseme user-87=cathski user-88=cambria1 user-89=ninejimm user-90=reliable user-91=cwsocial user-92=howardon user-93=pugwash user-94=paulmca1 user-95=isleofwi user-96=smrszyqg user-97=nomistakes user-98=hidden user-99=barbersh user-100=tigerlet user-101=nscdp
Sep  5 22:10:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=putterfc user-103=foods user-104=leftie user-105=fortunaz user-106=health2045 user-107=lkpier user-108=firstre5 user-109=donnychicago user-110=steakbridieme user-111=philmcph user-112=ctedorgu user-113=hodgsonmail user-114=outdoorc user-115=ranxterc user-116=branko user-117=romaldki user-118=lucy user-119=attlebor user-120=onlycont user-121=chrisdal user-122=mcdermos user-123=david user-124=careers user-125=nbhavers user-126=tomandle user-127=jennimil user-128=dancinggardener user-129=stagingerris user-130=ladburyp user-131=kategilpin user-132=design user-133=tstardom user-134=oubpgvbx user-135=what user-136=havantho user-137=sketchy user-138=cath user-139=nvihkvu user-140=bakery user-141=crrtipdl user-142=sosevalu user-143=nove user-144=boldover feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 22:10:10 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 22:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:11 nativespace-cdp sudo[2681008]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 22:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:11 nativespace-cdp sudo[2681016]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-lV0BTzxkncXvCuRx.~
Sep  5 22:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:11 nativespace-cdp sudo[2681022]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-lV0BTzxkncXvCuRx.~'
Sep  5 22:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:12 nativespace-cdp sudo[2681026]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-lV0BTzxkncXvCuRx.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 22:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:12 nativespace-cdp sudo[2681032]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 22:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:12 nativespace-cdp sudo[2681037]: pam_unix(sudo:session): session closed for user root
Sep  5 22:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 22:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 22:10:19 nativespace-cdp sudo[2681193]: pam_unix(sudo:session): session closed for user root
Sep  5 22:11:34 nativespace-cdp sshd[2681538]: Connection closed by 159.100.136.21 port 48620 [preauth]
Sep  5 22:16:36 nativespace-cdp sshd[2682679]: Connection closed by 159.100.136.21 port 57686 [preauth]
Sep  5 22:21:33 nativespace-cdp sshd[2683692]: Connection closed by 159.100.136.21 port 37816 [preauth]
Sep  5 22:26:33 nativespace-cdp sshd[2684649]: Connection closed by 159.100.136.21 port 47180 [preauth]
Sep  5 22:31:36 nativespace-cdp sshd[2686101]: Connection closed by 159.100.136.21 port 56802 [preauth]
Sep  5 22:36:35 nativespace-cdp sshd[2687111]: Connection closed by 159.100.136.21 port 37590 [preauth]
Sep  5 22:41:34 nativespace-cdp sshd[2688560]: Connection closed by 159.100.136.21 port 46376 [preauth]
Sep  5 22:46:33 nativespace-cdp sshd[2689586]: Connection closed by 159.100.136.21 port 54944 [preauth]
Sep  5 22:51:33 nativespace-cdp sshd[2690547]: Connection closed by 159.100.136.21 port 36226 [preauth]
Sep  5 22:56:33 nativespace-cdp sshd[2691502]: Connection closed by 159.100.136.21 port 45718 [preauth]
Sep  5 23:01:33 nativespace-cdp sshd[2692954]: Connection closed by 159.100.136.21 port 54550 [preauth]
Sep  5 23:06:36 nativespace-cdp sshd[2693913]: Connection closed by 159.100.136.21 port 35646 [preauth]
Sep  5 23:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  5 23:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:09:55 nativespace-cdp sudo[2694489]: pam_unix(sudo:session): session closed for user root
Sep  5 23:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  5 23:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:09:55 nativespace-cdp sudo[2694493]: pam_unix(sudo:session): session closed for user root
Sep  5 23:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  5 23:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:09:56 nativespace-cdp sudo[2694499]: pam_unix(sudo:session): session closed for user root
Sep  5 23:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  5 23:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:09:56 nativespace-cdp sudo[2694511]: pam_unix(sudo:session): session closed for user root
Sep  5 23:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  5 23:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:23 nativespace-cdp sudo[2694517]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  5 23:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:24 nativespace-cdp sudo[2694929]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  5 23:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:24 nativespace-cdp sudo[2694932]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  5 23:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:24 nativespace-cdp sudo[2694936]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  5 23:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:24 nativespace-cdp sudo[2694939]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  5 23:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:24 nativespace-cdp sudo[2694942]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  5 23:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:24 nativespace-cdp sudo[2694945]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  5 23:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:32 nativespace-cdp sudo[2694972]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  5 23:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:32 nativespace-cdp sudo[2694976]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ultbcrra user-2=seftvta user-3=jonhartl user-4=firstres user-5=coursemc user-6=opaiscyx user-7=firstrel user-8=clarkass user-9=costestimatorco user-10=firstred user-11=highlegh user-12=southlon user-13=gilpin user-14=milloyco user-15=elecleis user-16=hubmaster user-17=putterfi user-18=fetch user-19=carsinyo user-20=accooper user-21=ianrayne user-22=connectedshoppin user-23=thqkgnbz user-24=nstriton user-25=brighto1 user-26=vivienn1 user-27=firstre2 user-28=oneoarco user-29=battlere user-30=bedfords user-31=newstoda user-32=belle user-33=ggaaorgu user-34=bemadonn user-35=skyfirec user-36=alexadmin user-37=innovat1 user-38=askhform user-39=stuartge user-40=nativene user-41=markward user-42=foundation user-43=booff user-44=vantagep user-45=athenare user-46=connect9 user-47=lbscrmod user-48=maflemin
Sep  5 23:10:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=jarvisin user-51=spectrum user-52=theblack user-53=hodgesonweb user-54=agproduc user-55=still user-56=stephani user-57=leereyn1 user-58=lakesan1 user-59=brmrjxl user-60=strathar user-61=atestord user-62=sarafoundation user-63=wilsonsw user-64=megacards user-65=musorguk user-66=martsblo user-67=dickemery123 user-68=ptkxhsbt user-69=hhdugcor user-70=lbhyisi user-71=magichat user-72=tomandle user-73=jennimil user-74=chrisdal user-75=mcdermos user-76=david user-77=nbhavers user-78=careers user-79=lucy user-80=attlebor user-81=onlycont user-82=ranxterc user-83=hodgsonmail user-84=outdoorc user-85=branko user-86=romaldki user-87=nove user-88=boldover user-89=bakery user-90=crrtipdl user-91=sosevalu user-92=tstardom user-93=oubpgvbx user-94=what user-95=havantho user-96=cath user-97=sketchy user-98=nvihkvu user-99=dancinggardener user-100=stagingerris user-101=ladburyp user-102=kategilpin
Sep  5 23:10:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=design user-104=asandcoc user-105=sibtoncc user-106=bwppodcast user-107=zebrapho user-108=steve user-109=fawcettd user-110=burydropin user-111=nsceres user-112=beauty user-113=darkstar user-114=eatspam user-115=dhyana user-116=nscdp user-117=putterfc user-118=foods user-119=leftie user-120=health2045 user-121=fortunaz user-122=lkpier user-123=donnychicago user-124=firstre5 user-125=steakbridieme user-126=ctedorgu user-127=philmcph user-128=smrszyqg user-129=isleofwi user-130=nomistakes user-131=hidden user-132=barbersh user-133=tigerlet user-134=cambria1 user-135=cathski user-136=ninejimm user-137=reliable user-138=cwsocial user-139=pugwash user-140=howardon user-141=paulmca1 user-142=hirefootballgame user-143=eugincou user-144=courseme feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  5 23:10:32 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  5 23:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:33 nativespace-cdp sudo[2694980]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 23:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:33 nativespace-cdp sudo[2694985]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kqhkb65R8iyM9kf7.~
Sep  5 23:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:33 nativespace-cdp sudo[2694988]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kqhkb65R8iyM9kf7.~'
Sep  5 23:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:33 nativespace-cdp sudo[2694991]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kqhkb65R8iyM9kf7.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  5 23:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:33 nativespace-cdp sudo[2694995]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  5 23:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:33 nativespace-cdp sudo[2694998]: pam_unix(sudo:session): session closed for user root
Sep  5 23:10:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  5 23:10:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  5 23:10:34 nativespace-cdp sudo[2695017]: pam_unix(sudo:session): session closed for user root
Sep  5 23:11:33 nativespace-cdp sshd[2695211]: Connection closed by 159.100.136.21 port 44536 [preauth]
Sep  5 23:16:33 nativespace-cdp sshd[2696436]: Connection closed by 159.100.136.21 port 53610 [preauth]
Sep  5 23:21:33 nativespace-cdp sshd[2697479]: Connection closed by 159.100.136.21 port 34022 [preauth]
Sep  5 23:26:33 nativespace-cdp sshd[2698505]: Connection closed by 159.100.136.21 port 43712 [preauth]
Sep  5 23:31:34 nativespace-cdp sshd[2699952]: Connection closed by 159.100.136.21 port 53026 [preauth]
Sep  5 23:36:36 nativespace-cdp sshd[2700957]: Connection closed by 159.100.136.21 port 33810 [preauth]
Sep  5 23:41:33 nativespace-cdp sshd[2702187]: Connection closed by 159.100.136.21 port 43186 [preauth]
Sep  5 23:46:33 nativespace-cdp sshd[2703500]: Connection closed by 159.100.136.21 port 53328 [preauth]
Sep  5 23:51:33 nativespace-cdp sshd[2704541]: Connection closed by 159.100.136.21 port 35060 [preauth]
Sep  5 23:56:33 nativespace-cdp sshd[2705970]: Connection closed by 159.100.136.21 port 45322 [preauth]
Sep  6 00:01:33 nativespace-cdp sshd[2707123]: Connection closed by 159.100.136.21 port 55308 [preauth]
Sep  6 00:05:14 nativespace-cdp sshd[2707854]: Invalid user sftp from 190.129.122.86 port 52640
Sep  6 00:05:14 nativespace-cdp sshd[2707854]: input_userauth_request: invalid user sftp [preauth]
Sep  6 00:05:14 nativespace-cdp sshd[2707854]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:05:14 nativespace-cdp sshd[2707854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.129.122.86
Sep  6 00:05:16 nativespace-cdp sshd[2707854]: Failed password for invalid user sftp from 190.129.122.86 port 52640 ssh2
Sep  6 00:05:16 nativespace-cdp sshd[2707854]: Received disconnect from 190.129.122.86 port 52640:11: Bye Bye [preauth]
Sep  6 00:05:16 nativespace-cdp sshd[2707854]: Disconnected from 190.129.122.86 port 52640 [preauth]
Sep  6 00:06:24 nativespace-cdp sshd[2708057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.121.56.26  user=root
Sep  6 00:06:24 nativespace-cdp sshd[2708057]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:06:26 nativespace-cdp sshd[2708057]: Failed password for root from 168.121.56.26 port 45086 ssh2
Sep  6 00:06:27 nativespace-cdp sshd[2708057]: Received disconnect from 168.121.56.26 port 45086:11: Bye Bye [preauth]
Sep  6 00:06:27 nativespace-cdp sshd[2708057]: Disconnected from 168.121.56.26 port 45086 [preauth]
Sep  6 00:06:33 nativespace-cdp sshd[2708079]: Connection closed by 159.100.136.21 port 37406 [preauth]
Sep  6 00:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 00:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:01 nativespace-cdp sudo[2708696]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 00:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:01 nativespace-cdp sudo[2708701]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 00:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:02 nativespace-cdp sudo[2708707]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 00:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:02 nativespace-cdp sudo[2708824]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 00:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:05 nativespace-cdp sudo[2708827]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 00:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:05 nativespace-cdp sudo[2708852]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 00:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:05 nativespace-cdp sudo[2708855]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 00:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:05 nativespace-cdp sudo[2708859]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 00:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:05 nativespace-cdp sudo[2708862]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 00:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:05 nativespace-cdp sudo[2708865]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 00:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:05 nativespace-cdp sudo[2708868]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 00:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:07 nativespace-cdp sudo[2708877]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 00:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:07 nativespace-cdp sudo[2708882]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nomistakes user-2=hidden user-3=tigerlet user-4=barbersh user-5=smrszyqg user-6=isleofwi user-7=lkpier user-8=firstre5 user-9=steakbridieme user-10=donnychicago user-11=ctedorgu user-12=philmcph user-13=nscdp user-14=putterfc user-15=leftie user-16=foods user-17=health2045 user-18=fortunaz user-19=eugincou user-20=courseme user-21=hirefootballgame user-22=cwsocial user-23=howardon user-24=paulmca1 user-25=pugwash user-26=cathski user-27=cambria1 user-28=reliable user-29=ninejimm user-30=steve user-31=bwppodcast user-32=zebrapho user-33=asandcoc user-34=sibtoncc user-35=dhyana user-36=beauty user-37=darkstar user-38=eatspam user-39=nsceres user-40=fawcettd user-41=burydropin user-42=bakery user-43=crrtipdl user-44=sosevalu user-45=boldover user-46=nove user-47=design user-48=stagingerris
Sep  6 00:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=dancinggardener user-50=ladburyp user-51=kategilpin user-52=havantho user-53=cath user-54=sketchy user-55=nvihkvu user-56=tstardom user-57=oubpgvbx user-58=what user-59=david user-60=careers user-61=nbhavers user-62=chrisdal user-63=mcdermos user-64=jennimil user-65=tomandle user-66=romaldki user-67=ranxterc user-68=outdoorc user-69=hodgsonmail user-70=branko user-71=onlycont user-72=lucy user-73=attlebor user-74=megacards user-75=musorguk user-76=wilsonsw user-77=strathar user-78=atestord user-79=sarafoundation user-80=brmrjxl user-81=lakesan1 user-82=magichat user-83=hhdugcor user-84=lbhyisi user-85=dickemery123 user-86=ptkxhsbt user-87=martsblo user-88=ulsukarm user-89=vantagep user-90=connect9 user-91=athenare user-92=lbscrmod user-93=maflemin user-94=markward user-95=foundation user-96=booff user-97=stephani user-98=leereyn1 user-99=agproduc user-100=still user-101=spectrum user-102=hodgesonweb
Sep  6 00:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=theblack user-104=jarvisin user-105=newstoda user-106=ggaaorgu user-107=belle user-108=bemadonn user-109=bedfords user-110=vivienn1 user-111=firstre2 user-112=oneoarco user-113=battlere user-114=nstriton user-115=brighto1 user-116=nativene user-117=innovat1 user-118=askhform user-119=stuartge user-120=skyfirec user-121=alexadmin user-122=firstred user-123=highlegh user-124=southlon user-125=clarkass user-126=firstrel user-127=costestimatorco user-128=coursemc user-129=opaiscyx user-130=ultbcrra user-131=seftvta user-132=jonhartl user-133=firstres user-134=connectedshoppin user-135=thqkgnbz user-136=accooper user-137=ianrayne user-138=putterfi user-139=hubmaster user-140=fetch user-141=carsinyo user-142=gilpin user-143=milloyco user-144=elecleis feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 00:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 00:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:09 nativespace-cdp sudo[2708887]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 00:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:09 nativespace-cdp sudo[2708892]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DtONk2UU5B0O94qs.~
Sep  6 00:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:09 nativespace-cdp sudo[2708895]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DtONk2UU5B0O94qs.~'
Sep  6 00:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:09 nativespace-cdp sudo[2708898]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DtONk2UU5B0O94qs.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 00:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:09 nativespace-cdp sudo[2708902]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 00:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:09 nativespace-cdp sudo[2708905]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 00:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 00:10:11 nativespace-cdp sudo[2708925]: pam_unix(sudo:session): session closed for user root
Sep  6 00:10:26 nativespace-cdp sshd[2708959]: Invalid user integration from 51.68.137.240 port 33980
Sep  6 00:10:26 nativespace-cdp sshd[2708959]: input_userauth_request: invalid user integration [preauth]
Sep  6 00:10:26 nativespace-cdp sshd[2708959]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:10:26 nativespace-cdp sshd[2708959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.137.240
Sep  6 00:10:28 nativespace-cdp sshd[2708959]: Failed password for invalid user integration from 51.68.137.240 port 33980 ssh2
Sep  6 00:10:28 nativespace-cdp sshd[2708959]: Received disconnect from 51.68.137.240 port 33980:11: Bye Bye [preauth]
Sep  6 00:10:28 nativespace-cdp sshd[2708959]: Disconnected from 51.68.137.240 port 33980 [preauth]
Sep  6 00:10:29 nativespace-cdp sshd[2708957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.128.9.126  user=root
Sep  6 00:10:29 nativespace-cdp sshd[2708957]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:10:31 nativespace-cdp sshd[2708957]: Failed password for root from 14.128.9.126 port 46606 ssh2
Sep  6 00:10:31 nativespace-cdp sshd[2708957]: Received disconnect from 14.128.9.126 port 46606:11: Bye Bye [preauth]
Sep  6 00:10:31 nativespace-cdp sshd[2708957]: Disconnected from 14.128.9.126 port 46606 [preauth]
Sep  6 00:11:07 nativespace-cdp sshd[2709108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.157.100  user=root
Sep  6 00:11:07 nativespace-cdp sshd[2709108]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:11:08 nativespace-cdp sshd[2709104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.74.95.243  user=root
Sep  6 00:11:08 nativespace-cdp sshd[2709104]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:11:09 nativespace-cdp sshd[2709108]: Failed password for root from 164.92.157.100 port 46718 ssh2
Sep  6 00:11:09 nativespace-cdp sshd[2709108]: Received disconnect from 164.92.157.100 port 46718:11: Bye Bye [preauth]
Sep  6 00:11:09 nativespace-cdp sshd[2709108]: Disconnected from 164.92.157.100 port 46718 [preauth]
Sep  6 00:11:10 nativespace-cdp sshd[2709104]: Failed password for root from 97.74.95.243 port 38972 ssh2
Sep  6 00:11:10 nativespace-cdp sshd[2709104]: Received disconnect from 97.74.95.243 port 38972:11: Bye Bye [preauth]
Sep  6 00:11:10 nativespace-cdp sshd[2709104]: Disconnected from 97.74.95.243 port 38972 [preauth]
Sep  6 00:11:20 nativespace-cdp sshd[2709133]: Invalid user jw from 190.181.4.12 port 40064
Sep  6 00:11:20 nativespace-cdp sshd[2709133]: input_userauth_request: invalid user jw [preauth]
Sep  6 00:11:20 nativespace-cdp sshd[2709133]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:11:20 nativespace-cdp sshd[2709133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.181.4.12
Sep  6 00:11:22 nativespace-cdp sshd[2709133]: Failed password for invalid user jw from 190.181.4.12 port 40064 ssh2
Sep  6 00:11:22 nativespace-cdp sshd[2709133]: Received disconnect from 190.181.4.12 port 40064:11: Bye Bye [preauth]
Sep  6 00:11:22 nativespace-cdp sshd[2709133]: Disconnected from 190.181.4.12 port 40064 [preauth]
Sep  6 00:11:33 nativespace-cdp sshd[2709174]: Connection closed by 159.100.136.21 port 47368 [preauth]
Sep  6 00:12:03 nativespace-cdp sshd[2709257]: Invalid user postgres from 186.28.217.6 port 44094
Sep  6 00:12:03 nativespace-cdp sshd[2709257]: input_userauth_request: invalid user postgres [preauth]
Sep  6 00:12:03 nativespace-cdp sshd[2709257]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:12:03 nativespace-cdp sshd[2709257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.28.217.6
Sep  6 00:12:05 nativespace-cdp sshd[2709257]: Failed password for invalid user postgres from 186.28.217.6 port 44094 ssh2
Sep  6 00:12:06 nativespace-cdp sshd[2709257]: Received disconnect from 186.28.217.6 port 44094:11: Bye Bye [preauth]
Sep  6 00:12:06 nativespace-cdp sshd[2709257]: Disconnected from 186.28.217.6 port 44094 [preauth]
Sep  6 00:12:10 nativespace-cdp sshd[2709276]: Invalid user daniel from 180.148.4.194 port 51344
Sep  6 00:12:10 nativespace-cdp sshd[2709276]: input_userauth_request: invalid user daniel [preauth]
Sep  6 00:12:10 nativespace-cdp sshd[2709276]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:12:10 nativespace-cdp sshd[2709276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.148.4.194
Sep  6 00:12:13 nativespace-cdp sshd[2709276]: Failed password for invalid user daniel from 180.148.4.194 port 51344 ssh2
Sep  6 00:12:13 nativespace-cdp sshd[2709276]: Received disconnect from 180.148.4.194 port 51344:11: Bye Bye [preauth]
Sep  6 00:12:13 nativespace-cdp sshd[2709276]: Disconnected from 180.148.4.194 port 51344 [preauth]
Sep  6 00:12:55 nativespace-cdp sshd[2709452]: Invalid user ludmila from 148.113.15.210 port 58152
Sep  6 00:12:55 nativespace-cdp sshd[2709452]: input_userauth_request: invalid user ludmila [preauth]
Sep  6 00:12:55 nativespace-cdp sshd[2709452]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:12:55 nativespace-cdp sshd[2709452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.15.210
Sep  6 00:12:58 nativespace-cdp sshd[2709452]: Failed password for invalid user ludmila from 148.113.15.210 port 58152 ssh2
Sep  6 00:12:58 nativespace-cdp sshd[2709452]: Received disconnect from 148.113.15.210 port 58152:11: Bye Bye [preauth]
Sep  6 00:12:58 nativespace-cdp sshd[2709452]: Disconnected from 148.113.15.210 port 58152 [preauth]
Sep  6 00:13:16 nativespace-cdp sshd[2709515]: Invalid user elasticsearch from 164.92.157.100 port 37088
Sep  6 00:13:16 nativespace-cdp sshd[2709515]: input_userauth_request: invalid user elasticsearch [preauth]
Sep  6 00:13:16 nativespace-cdp sshd[2709515]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:13:16 nativespace-cdp sshd[2709515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.157.100
Sep  6 00:13:17 nativespace-cdp sshd[2709517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.129.122.86  user=root
Sep  6 00:13:17 nativespace-cdp sshd[2709517]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:13:18 nativespace-cdp sshd[2709515]: Failed password for invalid user elasticsearch from 164.92.157.100 port 37088 ssh2
Sep  6 00:13:18 nativespace-cdp sshd[2709515]: Received disconnect from 164.92.157.100 port 37088:11: Bye Bye [preauth]
Sep  6 00:13:18 nativespace-cdp sshd[2709515]: Disconnected from 164.92.157.100 port 37088 [preauth]
Sep  6 00:13:19 nativespace-cdp sshd[2709517]: Failed password for root from 190.129.122.86 port 39074 ssh2
Sep  6 00:13:19 nativespace-cdp sshd[2709517]: Received disconnect from 190.129.122.86 port 39074:11: Bye Bye [preauth]
Sep  6 00:13:19 nativespace-cdp sshd[2709517]: Disconnected from 190.129.122.86 port 39074 [preauth]
Sep  6 00:13:25 nativespace-cdp sshd[2709532]: Invalid user ludmila from 97.74.95.243 port 32934
Sep  6 00:13:25 nativespace-cdp sshd[2709532]: input_userauth_request: invalid user ludmila [preauth]
Sep  6 00:13:25 nativespace-cdp sshd[2709532]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:13:25 nativespace-cdp sshd[2709532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.74.95.243
Sep  6 00:13:27 nativespace-cdp sshd[2709532]: Failed password for invalid user ludmila from 97.74.95.243 port 32934 ssh2
Sep  6 00:13:27 nativespace-cdp sshd[2709532]: Received disconnect from 97.74.95.243 port 32934:11: Bye Bye [preauth]
Sep  6 00:13:27 nativespace-cdp sshd[2709532]: Disconnected from 97.74.95.243 port 32934 [preauth]
Sep  6 00:13:55 nativespace-cdp sshd[2709608]: Invalid user youssef from 51.68.137.240 port 52796
Sep  6 00:13:55 nativespace-cdp sshd[2709608]: input_userauth_request: invalid user youssef [preauth]
Sep  6 00:13:55 nativespace-cdp sshd[2709608]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:13:55 nativespace-cdp sshd[2709608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.137.240
Sep  6 00:13:57 nativespace-cdp sshd[2709608]: Failed password for invalid user youssef from 51.68.137.240 port 52796 ssh2
Sep  6 00:13:57 nativespace-cdp sshd[2709608]: Received disconnect from 51.68.137.240 port 52796:11: Bye Bye [preauth]
Sep  6 00:13:57 nativespace-cdp sshd[2709608]: Disconnected from 51.68.137.240 port 52796 [preauth]
Sep  6 00:14:04 nativespace-cdp sshd[2709633]: Invalid user mostafa from 148.113.15.210 port 40100
Sep  6 00:14:04 nativespace-cdp sshd[2709633]: input_userauth_request: invalid user mostafa [preauth]
Sep  6 00:14:04 nativespace-cdp sshd[2709633]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:14:04 nativespace-cdp sshd[2709633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.15.210
Sep  6 00:14:05 nativespace-cdp sshd[2709633]: Failed password for invalid user mostafa from 148.113.15.210 port 40100 ssh2
Sep  6 00:14:05 nativespace-cdp sshd[2709633]: Received disconnect from 148.113.15.210 port 40100:11: Bye Bye [preauth]
Sep  6 00:14:05 nativespace-cdp sshd[2709633]: Disconnected from 148.113.15.210 port 40100 [preauth]
Sep  6 00:14:06 nativespace-cdp sshd[2709643]: Invalid user ludmila from 190.129.122.86 port 37812
Sep  6 00:14:06 nativespace-cdp sshd[2709643]: input_userauth_request: invalid user ludmila [preauth]
Sep  6 00:14:06 nativespace-cdp sshd[2709643]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:14:06 nativespace-cdp sshd[2709643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.129.122.86
Sep  6 00:14:08 nativespace-cdp sshd[2709643]: Failed password for invalid user ludmila from 190.129.122.86 port 37812 ssh2
Sep  6 00:14:08 nativespace-cdp sshd[2709643]: Received disconnect from 190.129.122.86 port 37812:11: Bye Bye [preauth]
Sep  6 00:14:08 nativespace-cdp sshd[2709643]: Disconnected from 190.129.122.86 port 37812 [preauth]
Sep  6 00:14:11 nativespace-cdp sshd[2709653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.28.217.6  user=root
Sep  6 00:14:11 nativespace-cdp sshd[2709653]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:14:11 nativespace-cdp sshd[2709651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.74.95.243  user=root
Sep  6 00:14:11 nativespace-cdp sshd[2709651]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:14:12 nativespace-cdp sshd[2709653]: Failed password for root from 186.28.217.6 port 37692 ssh2
Sep  6 00:14:12 nativespace-cdp sshd[2709653]: Received disconnect from 186.28.217.6 port 37692:11: Bye Bye [preauth]
Sep  6 00:14:12 nativespace-cdp sshd[2709653]: Disconnected from 186.28.217.6 port 37692 [preauth]
Sep  6 00:14:12 nativespace-cdp sshd[2709651]: Failed password for root from 97.74.95.243 port 46126 ssh2
Sep  6 00:14:13 nativespace-cdp sshd[2709651]: Received disconnect from 97.74.95.243 port 46126:11: Bye Bye [preauth]
Sep  6 00:14:13 nativespace-cdp sshd[2709651]: Disconnected from 97.74.95.243 port 46126 [preauth]
Sep  6 00:14:15 nativespace-cdp sshd[2709720]: Invalid user jensen from 164.92.157.100 port 42090
Sep  6 00:14:15 nativespace-cdp sshd[2709720]: input_userauth_request: invalid user jensen [preauth]
Sep  6 00:14:15 nativespace-cdp sshd[2709720]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:14:15 nativespace-cdp sshd[2709720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.157.100
Sep  6 00:14:17 nativespace-cdp sshd[2709720]: Failed password for invalid user jensen from 164.92.157.100 port 42090 ssh2
Sep  6 00:14:17 nativespace-cdp sshd[2709720]: Received disconnect from 164.92.157.100 port 42090:11: Bye Bye [preauth]
Sep  6 00:14:17 nativespace-cdp sshd[2709720]: Disconnected from 164.92.157.100 port 42090 [preauth]
Sep  6 00:14:20 nativespace-cdp sshd[2709754]: Invalid user pippo from 168.121.56.26 port 55150
Sep  6 00:14:20 nativespace-cdp sshd[2709754]: input_userauth_request: invalid user pippo [preauth]
Sep  6 00:14:20 nativespace-cdp sshd[2709754]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:14:20 nativespace-cdp sshd[2709754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.121.56.26
Sep  6 00:14:22 nativespace-cdp sshd[2709754]: Failed password for invalid user pippo from 168.121.56.26 port 55150 ssh2
Sep  6 00:14:22 nativespace-cdp sshd[2709754]: Received disconnect from 168.121.56.26 port 55150:11: Bye Bye [preauth]
Sep  6 00:14:22 nativespace-cdp sshd[2709754]: Disconnected from 168.121.56.26 port 55150 [preauth]
Sep  6 00:14:36 nativespace-cdp sshd[2709817]: Invalid user ndd from 51.68.137.240 port 36440
Sep  6 00:14:36 nativespace-cdp sshd[2709817]: input_userauth_request: invalid user ndd [preauth]
Sep  6 00:14:36 nativespace-cdp sshd[2709817]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:14:36 nativespace-cdp sshd[2709817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.137.240
Sep  6 00:14:38 nativespace-cdp sshd[2709817]: Failed password for invalid user ndd from 51.68.137.240 port 36440 ssh2
Sep  6 00:14:38 nativespace-cdp sshd[2709817]: Received disconnect from 51.68.137.240 port 36440:11: Bye Bye [preauth]
Sep  6 00:14:38 nativespace-cdp sshd[2709817]: Disconnected from 51.68.137.240 port 36440 [preauth]
Sep  6 00:14:55 nativespace-cdp sshd[2709890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.15.210  user=root
Sep  6 00:14:55 nativespace-cdp sshd[2709890]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:14:57 nativespace-cdp sshd[2709890]: Failed password for root from 148.113.15.210 port 36708 ssh2
Sep  6 00:14:57 nativespace-cdp sshd[2709890]: Received disconnect from 148.113.15.210 port 36708:11: Bye Bye [preauth]
Sep  6 00:14:57 nativespace-cdp sshd[2709890]: Disconnected from 148.113.15.210 port 36708 [preauth]
Sep  6 00:15:00 nativespace-cdp sshd[2709901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.28.217.6  user=root
Sep  6 00:15:00 nativespace-cdp sshd[2709901]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:15:02 nativespace-cdp sshd[2709901]: Failed password for root from 186.28.217.6 port 51540 ssh2
Sep  6 00:15:21 nativespace-cdp sshd[2710200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.121.56.26  user=root
Sep  6 00:15:21 nativespace-cdp sshd[2710200]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:15:23 nativespace-cdp sshd[2710200]: Failed password for root from 168.121.56.26 port 44500 ssh2
Sep  6 00:15:23 nativespace-cdp sshd[2710200]: Received disconnect from 168.121.56.26 port 44500:11: Bye Bye [preauth]
Sep  6 00:15:23 nativespace-cdp sshd[2710200]: Disconnected from 168.121.56.26 port 44500 [preauth]
Sep  6 00:16:33 nativespace-cdp sshd[2710585]: Connection closed by 159.100.136.21 port 57600 [preauth]
Sep  6 00:17:59 nativespace-cdp sshd[2710897]: Invalid user test from 14.128.9.126 port 51162
Sep  6 00:17:59 nativespace-cdp sshd[2710897]: input_userauth_request: invalid user test [preauth]
Sep  6 00:17:59 nativespace-cdp sshd[2710897]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:17:59 nativespace-cdp sshd[2710897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.128.9.126
Sep  6 00:18:02 nativespace-cdp sshd[2710897]: Failed password for invalid user test from 14.128.9.126 port 51162 ssh2
Sep  6 00:18:02 nativespace-cdp sshd[2710897]: Received disconnect from 14.128.9.126 port 51162:11: Bye Bye [preauth]
Sep  6 00:18:02 nativespace-cdp sshd[2710897]: Disconnected from 14.128.9.126 port 51162 [preauth]
Sep  6 00:18:55 nativespace-cdp sshd[2711329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.148.4.194  user=root
Sep  6 00:18:55 nativespace-cdp sshd[2711329]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 00:18:57 nativespace-cdp sshd[2711329]: Failed password for root from 180.148.4.194 port 57814 ssh2
Sep  6 00:18:57 nativespace-cdp sshd[2711329]: Received disconnect from 180.148.4.194 port 57814:11: Bye Bye [preauth]
Sep  6 00:18:57 nativespace-cdp sshd[2711329]: Disconnected from 180.148.4.194 port 57814 [preauth]
Sep  6 00:19:15 nativespace-cdp sshd[2711388]: Invalid user jw from 14.128.9.126 port 38282
Sep  6 00:19:15 nativespace-cdp sshd[2711388]: input_userauth_request: invalid user jw [preauth]
Sep  6 00:19:15 nativespace-cdp sshd[2711388]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:19:15 nativespace-cdp sshd[2711388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.128.9.126
Sep  6 00:19:16 nativespace-cdp sshd[2711388]: Failed password for invalid user jw from 14.128.9.126 port 38282 ssh2
Sep  6 00:19:52 nativespace-cdp sshd[2711498]: Invalid user shweta from 190.181.4.12 port 34510
Sep  6 00:19:52 nativespace-cdp sshd[2711498]: input_userauth_request: invalid user shweta [preauth]
Sep  6 00:19:52 nativespace-cdp sshd[2711498]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:19:52 nativespace-cdp sshd[2711498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.181.4.12
Sep  6 00:19:54 nativespace-cdp sshd[2711498]: Failed password for invalid user shweta from 190.181.4.12 port 34510 ssh2
Sep  6 00:19:54 nativespace-cdp sshd[2711498]: Received disconnect from 190.181.4.12 port 34510:11: Bye Bye [preauth]
Sep  6 00:19:54 nativespace-cdp sshd[2711498]: Disconnected from 190.181.4.12 port 34510 [preauth]
Sep  6 00:20:16 nativespace-cdp sshd[2711684]: Invalid user ladmin from 180.148.4.194 port 44720
Sep  6 00:20:16 nativespace-cdp sshd[2711684]: input_userauth_request: invalid user ladmin [preauth]
Sep  6 00:20:16 nativespace-cdp sshd[2711684]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:20:16 nativespace-cdp sshd[2711684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.148.4.194
Sep  6 00:20:18 nativespace-cdp sshd[2711684]: Failed password for invalid user ladmin from 180.148.4.194 port 44720 ssh2
Sep  6 00:20:18 nativespace-cdp sshd[2711684]: Received disconnect from 180.148.4.194 port 44720:11: Bye Bye [preauth]
Sep  6 00:20:18 nativespace-cdp sshd[2711684]: Disconnected from 180.148.4.194 port 44720 [preauth]
Sep  6 00:21:01 nativespace-cdp sshd[2711881]: Invalid user phil from 190.181.4.12 port 58870
Sep  6 00:21:01 nativespace-cdp sshd[2711881]: input_userauth_request: invalid user phil [preauth]
Sep  6 00:21:01 nativespace-cdp sshd[2711881]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 00:21:01 nativespace-cdp sshd[2711881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.181.4.12
Sep  6 00:21:03 nativespace-cdp sshd[2711881]: Failed password for invalid user phil from 190.181.4.12 port 58870 ssh2
Sep  6 00:21:03 nativespace-cdp sshd[2711881]: Received disconnect from 190.181.4.12 port 58870:11: Bye Bye [preauth]
Sep  6 00:21:03 nativespace-cdp sshd[2711881]: Disconnected from 190.181.4.12 port 58870 [preauth]
Sep  6 00:21:33 nativespace-cdp sshd[2711994]: Connection closed by 159.100.136.21 port 39304 [preauth]
Sep  6 00:26:33 nativespace-cdp sshd[2713124]: Connection closed by 159.100.136.21 port 49594 [preauth]
Sep  6 00:31:33 nativespace-cdp sshd[2714381]: Connection closed by 159.100.136.21 port 59622 [preauth]
Sep  6 00:36:33 nativespace-cdp sshd[2715363]: Connection closed by 159.100.136.21 port 41612 [preauth]
Sep  6 00:41:34 nativespace-cdp sshd[2716466]: Connection closed by 159.100.136.21 port 51404 [preauth]
Sep  6 00:46:35 nativespace-cdp sshd[2717677]: Connection closed by 159.100.136.21 port 60188 [preauth]
Sep  6 00:51:34 nativespace-cdp sshd[2718810]: Connection closed by 159.100.136.21 port 40124 [preauth]
Sep  6 00:56:34 nativespace-cdp sshd[2720160]: Connection closed by 159.100.136.21 port 49328 [preauth]
Sep  6 01:01:33 nativespace-cdp sshd[2721336]: Connection closed by 159.100.136.21 port 58840 [preauth]
Sep  6 01:06:37 nativespace-cdp sshd[2722731]: Connection closed by 159.100.136.21 port 39922 [preauth]
Sep  6 01:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 01:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:03 nativespace-cdp sudo[2723571]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 01:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:03 nativespace-cdp sudo[2723578]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 01:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:04 nativespace-cdp sudo[2723581]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 01:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:04 nativespace-cdp sudo[2723599]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 01:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:07 nativespace-cdp sudo[2723602]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:07 nativespace-cdp sudo[2723615]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:07 nativespace-cdp sudo[2723618]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:07 nativespace-cdp sudo[2723621]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:07 nativespace-cdp sudo[2723624]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:07 nativespace-cdp sudo[2723627]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:07 nativespace-cdp sudo[2723631]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 01:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:12 nativespace-cdp sudo[2723658]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 01:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:12 nativespace-cdp sudo[2723662]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nvihkvu user-2=sketchy user-3=cath user-4=havantho user-5=what user-6=oubpgvbx user-7=tstardom user-8=design user-9=kategilpin user-10=ladburyp user-11=dancinggardener user-12=stagingerris user-13=boldover user-14=nove user-15=sosevalu user-16=crrtipdl user-17=bakery user-18=onlycont user-19=attlebor user-20=lucy user-21=romaldki user-22=branko user-23=outdoorc user-24=hodgsonmail user-25=ranxterc user-26=jennimil user-27=tomandle user-28=careers user-29=nbhavers user-30=david user-31=mcdermos user-32=chrisdal user-33=paulmca1 user-34=howardon user-35=pugwash user-36=cwsocial user-37=reliable user-38=ninejimm user-39=cambria1 user-40=cathski user-41=courseme user-42=eugincou user-43=hirefootballgame user-44=ctedorgu user-45=philmcph user-46=firstre5 user-47=donnychicago user-48=steakbridieme
Sep  6 01:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=lkpier user-50=health2045 user-51=fortunaz user-52=foods user-53=leftie user-54=putterfc user-55=nscdp user-56=tigerlet user-57=barbersh user-58=hidden user-59=nomistakes user-60=smrszyqg user-61=isleofwi user-62=nsceres user-63=burydropin user-64=fawcettd user-65=dhyana user-66=eatspam user-67=darkstar user-68=beauty user-69=sibtoncc user-70=asandcoc user-71=steve user-72=zebrapho user-73=bwppodcast user-74=skyfirec user-75=alexadmin user-76=nativene user-77=stuartge user-78=askhform user-79=innovat1 user-80=battlere user-81=oneoarco user-82=firstre2 user-83=vivienn1 user-84=brighto1 user-85=nstriton user-86=bemadonn user-87=belle user-88=ggaaorgu user-89=newstoda user-90=bedfords user-91=carsinyo user-92=fetch user-93=putterfi user-94=hubmaster user-95=elecleis user-96=milloyco user-97=gilpin user-98=thqkgnbz user-99=connectedshoppin user-100=ianrayne user-101=accooper user-102=opaiscyx
Sep  6 01:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=coursemc user-104=firstres user-105=jonhartl user-106=seftvta user-107=ultbcrra user-108=southlon user-109=highlegh user-110=firstred user-111=costestimatorco user-112=clarkass user-113=firstrel user-114=ptkxhsbt user-115=dickemery123 user-116=martsblo user-117=magichat user-118=lbhyisi user-119=hhdugcor user-120=sarafoundation user-121=atestord user-122=strathar user-123=brmrjxl user-124=lakesan1 user-125=musorguk user-126=megacards user-127=wilsonsw user-128=hodgesonweb user-129=theblack user-130=spectrum user-131=jarvisin user-132=leereyn1 user-133=stephani user-134=still user-135=agproduc user-136=maflemin user-137=lbscrmod user-138=connect9 user-139=athenare user-140=vantagep user-141=booff user-142=markward user-143=foundation user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 01:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 01:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:14 nativespace-cdp sudo[2723666]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 01:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:14 nativespace-cdp sudo[2723675]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nUb9pjm4hEun8aBG.~
Sep  6 01:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:14 nativespace-cdp sudo[2723678]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nUb9pjm4hEun8aBG.~'
Sep  6 01:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:14 nativespace-cdp sudo[2723681]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nUb9pjm4hEun8aBG.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 01:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:14 nativespace-cdp sudo[2723685]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 01:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:14 nativespace-cdp sudo[2723688]: pam_unix(sudo:session): session closed for user root
Sep  6 01:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 01:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 01:10:16 nativespace-cdp sudo[2723707]: pam_unix(sudo:session): session closed for user root
Sep  6 01:11:33 nativespace-cdp sshd[2724327]: Connection closed by 159.100.136.21 port 48994 [preauth]
Sep  6 01:16:33 nativespace-cdp sshd[2725294]: Connection closed by 159.100.136.21 port 58460 [preauth]
Sep  6 01:21:33 nativespace-cdp sshd[2726431]: Connection closed by 159.100.136.21 port 38408 [preauth]
Sep  6 01:26:33 nativespace-cdp sshd[2727452]: Connection closed by 159.100.136.21 port 47972 [preauth]
Sep  6 01:31:33 nativespace-cdp sshd[2728567]: Connection closed by 159.100.136.21 port 57226 [preauth]
Sep  6 01:36:33 nativespace-cdp sshd[2729788]: Connection closed by 159.100.136.21 port 38474 [preauth]
Sep  6 01:41:35 nativespace-cdp sshd[2730959]: Connection closed by 159.100.136.21 port 47478 [preauth]
Sep  6 01:46:36 nativespace-cdp sshd[2732190]: Connection closed by 159.100.136.21 port 57166 [preauth]
Sep  6 01:51:33 nativespace-cdp sshd[2733182]: Connection closed by 159.100.136.21 port 38264 [preauth]
Sep  6 01:52:26 nativespace-cdp sshd[2733307]: Invalid user solutec from 51.75.25.97 port 53930
Sep  6 01:52:26 nativespace-cdp sshd[2733307]: input_userauth_request: invalid user solutec [preauth]
Sep  6 01:52:26 nativespace-cdp sshd[2733307]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 01:52:26 nativespace-cdp sshd[2733307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.25.97
Sep  6 01:52:28 nativespace-cdp sshd[2733307]: Failed password for invalid user solutec from 51.75.25.97 port 53930 ssh2
Sep  6 01:52:28 nativespace-cdp sshd[2733307]: Received disconnect from 51.75.25.97 port 53930:11: Bye Bye [preauth]
Sep  6 01:52:28 nativespace-cdp sshd[2733307]: Disconnected from 51.75.25.97 port 53930 [preauth]
Sep  6 01:56:36 nativespace-cdp sshd[2734248]: Connection closed by 159.100.136.21 port 47894 [preauth]
Sep  6 01:56:38 nativespace-cdp sshd[2734250]: Invalid user trinity from 213.6.203.226 port 60277
Sep  6 01:56:38 nativespace-cdp sshd[2734250]: input_userauth_request: invalid user trinity [preauth]
Sep  6 01:56:38 nativespace-cdp sshd[2734250]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 01:56:38 nativespace-cdp sshd[2734250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.6.203.226
Sep  6 01:56:40 nativespace-cdp sshd[2734250]: Failed password for invalid user trinity from 213.6.203.226 port 60277 ssh2
Sep  6 01:56:40 nativespace-cdp sshd[2734250]: Received disconnect from 213.6.203.226 port 60277:11: Bye Bye [preauth]
Sep  6 01:56:40 nativespace-cdp sshd[2734250]: Disconnected from 213.6.203.226 port 60277 [preauth]
Sep  6 01:58:27 nativespace-cdp sshd[2734644]: Invalid user trinity from 51.75.25.97 port 42532
Sep  6 01:58:27 nativespace-cdp sshd[2734644]: input_userauth_request: invalid user trinity [preauth]
Sep  6 01:58:27 nativespace-cdp sshd[2734644]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 01:58:27 nativespace-cdp sshd[2734644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.25.97
Sep  6 01:58:29 nativespace-cdp sshd[2734644]: Failed password for invalid user trinity from 51.75.25.97 port 42532 ssh2
Sep  6 01:58:31 nativespace-cdp sshd[2734644]: Received disconnect from 51.75.25.97 port 42532:11: Bye Bye [preauth]
Sep  6 01:58:31 nativespace-cdp sshd[2734644]: Disconnected from 51.75.25.97 port 42532 [preauth]
Sep  6 01:59:17 nativespace-cdp sshd[2735012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.25.97  user=root
Sep  6 01:59:17 nativespace-cdp sshd[2735012]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 01:59:19 nativespace-cdp sshd[2735012]: Failed password for root from 51.75.25.97 port 48782 ssh2
Sep  6 01:59:24 nativespace-cdp sshd[2735336]: Invalid user wing from 213.6.203.226 port 60392
Sep  6 01:59:24 nativespace-cdp sshd[2735336]: input_userauth_request: invalid user wing [preauth]
Sep  6 01:59:24 nativespace-cdp sshd[2735336]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 01:59:24 nativespace-cdp sshd[2735336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.6.203.226
Sep  6 01:59:26 nativespace-cdp sshd[2735336]: Failed password for invalid user wing from 213.6.203.226 port 60392 ssh2
Sep  6 01:59:26 nativespace-cdp sshd[2735336]: Received disconnect from 213.6.203.226 port 60392:11: Bye Bye [preauth]
Sep  6 01:59:26 nativespace-cdp sshd[2735336]: Disconnected from 213.6.203.226 port 60392 [preauth]
Sep  6 02:00:10 nativespace-cdp sshd[2736091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.6.203.226  user=root
Sep  6 02:00:10 nativespace-cdp sshd[2736091]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 02:00:12 nativespace-cdp sshd[2736091]: Failed password for root from 213.6.203.226 port 64225 ssh2
Sep  6 02:00:12 nativespace-cdp sshd[2736091]: Received disconnect from 213.6.203.226 port 64225:11: Bye Bye [preauth]
Sep  6 02:00:12 nativespace-cdp sshd[2736091]: Disconnected from 213.6.203.226 port 64225 [preauth]
Sep  6 02:01:37 nativespace-cdp sshd[2736454]: Connection closed by 159.100.136.21 port 57288 [preauth]
Sep  6 02:06:35 nativespace-cdp sshd[2737429]: Connection closed by 159.100.136.21 port 38272 [preauth]
Sep  6 02:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 02:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:10:33 nativespace-cdp sudo[2738496]: pam_unix(sudo:session): session closed for user root
Sep  6 02:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 02:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:10:33 nativespace-cdp sudo[2738501]: pam_unix(sudo:session): session closed for user root
Sep  6 02:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 02:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:10:36 nativespace-cdp sudo[2738504]: pam_unix(sudo:session): session closed for user root
Sep  6 02:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 02:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:10:36 nativespace-cdp sudo[2738513]: pam_unix(sudo:session): session closed for user root
Sep  6 02:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 02:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:12 nativespace-cdp sudo[2738516]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 02:11:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:13 nativespace-cdp sudo[2738720]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 02:11:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:13 nativespace-cdp sudo[2738739]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 02:11:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:13 nativespace-cdp sudo[2738743]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 02:11:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:13 nativespace-cdp sudo[2738747]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 02:11:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:13 nativespace-cdp sudo[2738752]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 02:11:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:13 nativespace-cdp sudo[2738761]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 02:11:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:23 nativespace-cdp sudo[2738855]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 02:11:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:31 nativespace-cdp sudo[2738868]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=coursemc user-2=opaiscyx user-3=firstres user-4=ultbcrra user-5=seftvta user-6=jonhartl user-7=highlegh user-8=southlon user-9=firstred user-10=costestimatorco user-11=firstrel user-12=clarkass user-13=fetch user-14=carsinyo user-15=hubmaster user-16=putterfi user-17=elecleis user-18=milloyco user-19=gilpin user-20=thqkgnbz user-21=connectedshoppin user-22=ianrayne user-23=accooper user-24=oneoarco user-25=battlere user-26=vivienn1 user-27=firstre2 user-28=nstriton user-29=brighto1 user-30=bemadonn user-31=newstoda user-32=belle user-33=ggaaorgu user-34=bedfords user-35=skyfirec user-36=alexadmin user-37=nativene user-38=askhform user-39=stuartge user-40=innovat1 user-41=lbscrmod user-42=maflemin user-43=vantagep user-44=connect9 user-45=athenare user-46=markward user-47=foundation user-48=booff
Sep  6 02:11:31 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=theblack user-51=hodgesonweb user-52=spectrum user-53=jarvisin user-54=leereyn1 user-55=stephani user-56=agproduc user-57=still user-58=atestord user-59=sarafoundation user-60=strathar user-61=lakesan1 user-62=brmrjxl user-63=megacards user-64=musorguk user-65=wilsonsw user-66=ptkxhsbt user-67=dickemery123 user-68=martsblo user-69=magichat user-70=hhdugcor user-71=lbhyisi user-72=jennimil user-73=tomandle user-74=david user-75=careers user-76=nbhavers user-77=mcdermos user-78=chrisdal user-79=onlycont user-80=lucy user-81=attlebor user-82=romaldki user-83=branko user-84=ranxterc user-85=hodgsonmail user-86=outdoorc user-87=boldover user-88=nove user-89=crrtipdl user-90=sosevalu user-91=bakery user-92=nvihkvu user-93=havantho user-94=sketchy user-95=cath user-96=what user-97=tstardom user-98=oubpgvbx user-99=design user-100=kategilpin user-101=dancinggardener user-102=stagingerris
Sep  6 02:11:31 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ladburyp user-104=asandcoc user-105=sibtoncc user-106=steve user-107=zebrapho user-108=bwppodcast user-109=nsceres user-110=fawcettd user-111=burydropin user-112=dhyana user-113=darkstar user-114=eatspam user-115=beauty user-116=steakbridieme user-117=firstre5 user-118=donnychicago user-119=ctedorgu user-120=philmcph user-121=lkpier user-122=foods user-123=leftie user-124=health2045 user-125=fortunaz user-126=nscdp user-127=putterfc user-128=barbersh user-129=tigerlet user-130=nomistakes user-131=hidden user-132=isleofwi user-133=smrszyqg user-134=cwsocial user-135=howardon user-136=paulmca1 user-137=pugwash user-138=ninejimm user-139=reliable user-140=cambria1 user-141=cathski user-142=courseme user-143=eugincou user-144=hirefootballgame feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 02:11:31 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 02:11:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:34 nativespace-cdp sshd[2738913]: Connection closed by 159.100.136.21 port 47452 [preauth]
Sep  6 02:11:37 nativespace-cdp sudo[2738905]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 02:11:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:39 nativespace-cdp sudo[2738948]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wNWbYA0XBnUE9MH2.~
Sep  6 02:11:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:39 nativespace-cdp sudo[2738952]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wNWbYA0XBnUE9MH2.~'
Sep  6 02:11:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:39 nativespace-cdp sudo[2738955]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wNWbYA0XBnUE9MH2.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 02:11:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:39 nativespace-cdp sudo[2738959]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 02:11:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:39 nativespace-cdp sudo[2738963]: pam_unix(sudo:session): session closed for user root
Sep  6 02:11:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 02:11:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 02:11:55 nativespace-cdp sudo[2739038]: pam_unix(sudo:session): session closed for user root
Sep  6 02:16:35 nativespace-cdp sshd[2740134]: Connection closed by 159.100.136.21 port 57006 [preauth]
Sep  6 02:21:37 nativespace-cdp sshd[2741253]: Connection closed by 159.100.136.21 port 38216 [preauth]
Sep  6 02:26:34 nativespace-cdp sshd[2742285]: Connection closed by 159.100.136.21 port 47646 [preauth]
Sep  6 02:31:35 nativespace-cdp sshd[2743622]: Connection closed by 159.100.136.21 port 56354 [preauth]
Sep  6 02:36:36 nativespace-cdp sshd[2744773]: Connection closed by 159.100.136.21 port 37730 [preauth]
Sep  6 02:41:33 nativespace-cdp sshd[2746227]: Connection closed by 159.100.136.21 port 47020 [preauth]
Sep  6 02:46:37 nativespace-cdp sshd[2747224]: Connection closed by 159.100.136.21 port 55854 [preauth]
Sep  6 02:51:33 nativespace-cdp sshd[2748250]: Connection closed by 159.100.136.21 port 37140 [preauth]
Sep  6 02:56:33 nativespace-cdp sshd[2749408]: Connection closed by 159.100.136.21 port 46148 [preauth]
Sep  6 03:01:33 nativespace-cdp sshd[2750480]: Connection closed by 159.100.136.21 port 55828 [preauth]
Sep  6 03:06:35 nativespace-cdp sshd[2751499]: Connection closed by 159.100.136.21 port 37570 [preauth]
Sep  6 03:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 03:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:15 nativespace-cdp sudo[2752504]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 03:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:15 nativespace-cdp sudo[2752533]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 03:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:21 nativespace-cdp sudo[2752540]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 03:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:21 nativespace-cdp sudo[2752685]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 03:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:27 nativespace-cdp sudo[2752689]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 03:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:27 nativespace-cdp sudo[2752722]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 03:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:27 nativespace-cdp sudo[2752725]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 03:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:28 nativespace-cdp sudo[2752728]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 03:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:28 nativespace-cdp sudo[2752731]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 03:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:28 nativespace-cdp sudo[2752734]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 03:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:28 nativespace-cdp sudo[2752738]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 03:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:30 nativespace-cdp sudo[2752747]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 03:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:37 nativespace-cdp sudo[2752752]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=dhyana user-2=beauty user-3=eatspam user-4=darkstar user-5=nsceres user-6=burydropin user-7=fawcettd user-8=steve user-9=bwppodcast user-10=zebrapho user-11=asandcoc user-12=sibtoncc user-13=eugincou user-14=courseme user-15=hirefootballgame user-16=pugwash user-17=howardon user-18=paulmca1 user-19=cwsocial user-20=cathski user-21=cambria1 user-22=ninejimm user-23=reliable user-24=hidden user-25=nomistakes user-26=barbersh user-27=tigerlet user-28=smrszyqg user-29=isleofwi user-30=lkpier user-31=ctedorgu user-32=philmcph user-33=steakbridieme user-34=firstre5 user-35=donnychicago user-36=putterfc user-37=nscdp user-38=health2045 user-39=fortunaz user-40=foods user-41=leftie user-42=romaldki user-43=hodgsonmail user-44=outdoorc user-45=ranxterc user-46=branko user-47=onlycont user-48=attlebor
Sep  6 03:10:37 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=lucy user-50=careers user-51=nbhavers user-52=david user-53=chrisdal user-54=mcdermos user-55=jennimil user-56=tomandle user-57=design user-58=ladburyp user-59=dancinggardener user-60=stagingerris user-61=kategilpin user-62=cath user-63=sketchy user-64=havantho user-65=nvihkvu user-66=tstardom user-67=oubpgvbx user-68=what user-69=bakery user-70=sosevalu user-71=crrtipdl user-72=boldover user-73=nove user-74=stephani user-75=leereyn1 user-76=still user-77=agproduc user-78=spectrum user-79=hodgesonweb user-80=theblack user-81=jarvisin user-82=ulsukarm user-83=connect9 user-84=athenare user-85=vantagep user-86=maflemin user-87=lbscrmod user-88=foundation user-89=markward user-90=booff user-91=magichat user-92=lbhyisi user-93=hhdugcor user-94=dickemery123 user-95=ptkxhsbt user-96=martsblo user-97=musorguk user-98=megacards user-99=wilsonsw user-100=strathar user-101=sarafoundation user-102=atestord
Sep  6 03:10:37 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=brmrjxl user-104=lakesan1 user-105=connectedshoppin user-106=thqkgnbz user-107=accooper user-108=ianrayne user-109=putterfi user-110=hubmaster user-111=carsinyo user-112=fetch user-113=gilpin user-114=milloyco user-115=elecleis user-116=firstred user-117=southlon user-118=highlegh user-119=firstrel user-120=clarkass user-121=costestimatorco user-122=opaiscyx user-123=coursemc user-124=jonhartl user-125=seftvta user-126=ultbcrra user-127=firstres user-128=nativene user-129=innovat1 user-130=askhform user-131=stuartge user-132=alexadmin user-133=skyfirec user-134=belle user-135=ggaaorgu user-136=newstoda user-137=bemadonn user-138=bedfords user-139=firstre2 user-140=vivienn1 user-141=battlere user-142=oneoarco user-143=brighto1 user-144=nstriton feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 03:10:37 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 03:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:39 nativespace-cdp sudo[2752772]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 03:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:40 nativespace-cdp sudo[2752785]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dbD5yfNEh8NXMNgq.~
Sep  6 03:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:40 nativespace-cdp sudo[2752788]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dbD5yfNEh8NXMNgq.~'
Sep  6 03:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:40 nativespace-cdp sudo[2752791]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dbD5yfNEh8NXMNgq.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 03:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:41 nativespace-cdp sudo[2752795]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 03:10:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:41 nativespace-cdp sudo[2752798]: pam_unix(sudo:session): session closed for user root
Sep  6 03:10:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 03:10:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:10:55 nativespace-cdp sudo[2752888]: pam_unix(sudo:session): session closed for user root
Sep  6 03:11:34 nativespace-cdp sshd[2752999]: Connection closed by 159.100.136.21 port 46242 [preauth]
Sep  6 03:16:36 nativespace-cdp sshd[2754139]: Connection closed by 159.100.136.21 port 55952 [preauth]
Sep  6 03:21:33 nativespace-cdp sshd[2755139]: Connection closed by 159.100.136.21 port 36840 [preauth]
Sep  6 03:26:33 nativespace-cdp sshd[2756145]: Connection closed by 159.100.136.21 port 46550 [preauth]
Sep  6 03:31:37 nativespace-cdp sshd[2757461]: Connection closed by 159.100.136.21 port 55274 [preauth]
Sep  6 03:36:36 nativespace-cdp sshd[2759416]: Connection closed by 159.100.136.21 port 36028 [preauth]
Sep  6 03:41:34 nativespace-cdp sshd[2761033]: Connection closed by 159.100.136.21 port 44832 [preauth]
Sep  6 03:46:33 nativespace-cdp sshd[2762024]: Connection closed by 159.100.136.21 port 54088 [preauth]
Sep  6 03:51:33 nativespace-cdp sshd[2763020]: Connection closed by 159.100.136.21 port 34616 [preauth]
Sep  6 03:56:33 nativespace-cdp sshd[2764138]: Connection closed by 159.100.136.21 port 43928 [preauth]
Sep  6 03:58:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 03:58:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 03:58:12 nativespace-cdp sudo[2764471]: pam_unix(sudo:session): session closed for user root
Sep  6 04:01:33 nativespace-cdp sshd[2765527]: Connection closed by 159.100.136.21 port 53430 [preauth]
Sep  6 04:06:33 nativespace-cdp sshd[2766550]: Connection closed by 159.100.136.21 port 34468 [preauth]
Sep  6 04:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 04:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:08 nativespace-cdp sudo[2767312]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 04:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:08 nativespace-cdp sudo[2767316]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 04:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:14 nativespace-cdp sudo[2767319]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 04:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:14 nativespace-cdp sudo[2767388]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 04:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:25 nativespace-cdp sudo[2767394]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 04:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:25 nativespace-cdp sudo[2767491]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 04:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:25 nativespace-cdp sudo[2767494]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 04:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:25 nativespace-cdp sudo[2767497]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 04:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:25 nativespace-cdp sudo[2767500]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 04:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:25 nativespace-cdp sudo[2767503]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 04:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:25 nativespace-cdp sudo[2767506]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 04:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:28 nativespace-cdp sudo[2767545]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 04:10:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:32 nativespace-cdp sudo[2767552]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=markward user-2=foundation user-3=booff user-4=athenare user-5=connect9 user-6=vantagep user-7=maflemin user-8=lbscrmod user-9=ulsukarm user-10=jarvisin user-11=spectrum user-12=theblack user-13=hodgesonweb user-14=still user-15=agproduc user-16=stephani user-17=leereyn1 user-18=lakesan1 user-19=brmrjxl user-20=strathar user-21=sarafoundation user-22=atestord user-23=wilsonsw user-24=musorguk user-25=megacards user-26=martsblo user-27=dickemery123 user-28=ptkxhsbt user-29=lbhyisi user-30=hhdugcor user-31=magichat user-32=seftvta user-33=jonhartl user-34=ultbcrra user-35=firstres user-36=coursemc user-37=opaiscyx user-38=firstrel user-39=clarkass user-40=costestimatorco user-41=firstred user-42=southlon user-43=highlegh user-44=gilpin user-45=milloyco user-46=elecleis user-47=putterfi
Sep  6 04:10:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=hubmaster user-49=carsinyo user-50=fetch user-51=accooper user-52=ianrayne user-53=connectedshoppin user-54=thqkgnbz user-55=brighto1 user-56=nstriton user-57=firstre2 user-58=vivienn1 user-59=battlere user-60=oneoarco user-61=bedfords user-62=belle user-63=ggaaorgu user-64=newstoda user-65=bemadonn user-66=alexadmin user-67=skyfirec user-68=innovat1 user-69=stuartge user-70=askhform user-71=nativene user-72=asandcoc user-73=sibtoncc user-74=bwppodcast user-75=zebrapho user-76=steve user-77=burydropin user-78=fawcettd user-79=nsceres user-80=beauty user-81=eatspam user-82=darkstar user-83=dhyana user-84=putterfc user-85=nscdp user-86=health2045 user-87=fortunaz user-88=foods user-89=leftie user-90=lkpier user-91=ctedorgu user-92=philmcph user-93=donnychicago user-94=firstre5 user-95=steakbridieme user-96=smrszyqg user-97=isleofwi user-98=hidden user-99=nomistakes user-100=tigerlet user-101=barbersh
Sep  6 04:10:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=cathski user-103=cambria1 user-104=reliable user-105=ninejimm user-106=paulmca1 user-107=howardon user-108=pugwash user-109=cwsocial user-110=hirefootballgame user-111=eugincou user-112=courseme user-113=tomandle user-114=jennimil user-115=chrisdal user-116=mcdermos user-117=careers user-118=nbhavers user-119=david user-120=attlebor user-121=lucy user-122=onlycont user-123=ranxterc user-124=outdoorc user-125=hodgsonmail user-126=branko user-127=romaldki user-128=nove user-129=boldover user-130=bakery user-131=sosevalu user-132=crrtipdl user-133=tstardom user-134=oubpgvbx user-135=what user-136=cath user-137=sketchy user-138=havantho user-139=nvihkvu user-140=ladburyp user-141=dancinggardener user-142=stagingerris user-143=kategilpin user-144=design feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 04:10:32 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 04:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:35 nativespace-cdp sudo[2767563]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 04:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:36 nativespace-cdp sudo[2767578]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-CeTGolWy8BLwR2tU.~
Sep  6 04:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:36 nativespace-cdp sudo[2767581]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-CeTGolWy8BLwR2tU.~'
Sep  6 04:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:37 nativespace-cdp sudo[2767584]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-CeTGolWy8BLwR2tU.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 04:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:37 nativespace-cdp sudo[2767588]: pam_unix(sudo:session): session closed for user root
Sep  6 04:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 04:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:10:37 nativespace-cdp sudo[2767591]: pam_unix(sudo:session): session closed for user root
Sep  6 04:11:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 04:11:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:11:14 nativespace-cdp sudo[2767732]: pam_unix(sudo:session): session closed for user root
Sep  6 04:11:34 nativespace-cdp sshd[2767789]: Connection closed by 159.100.136.21 port 43826 [preauth]
Sep  6 04:16:34 nativespace-cdp sshd[2768789]: Connection closed by 159.100.136.21 port 52418 [preauth]
Sep  6 04:21:33 nativespace-cdp sshd[2770237]: Connection closed by 159.100.136.21 port 32946 [preauth]
Sep  6 04:26:33 nativespace-cdp sshd[2771639]: Connection closed by 159.100.136.21 port 42404 [preauth]
Sep  6 04:31:33 nativespace-cdp sshd[2772843]: Connection closed by 159.100.136.21 port 51406 [preauth]
Sep  6 04:36:34 nativespace-cdp sshd[2773752]: Connection closed by 159.100.136.21 port 60852 [preauth]
Sep  6 04:41:34 nativespace-cdp sshd[2775140]: Connection closed by 159.100.136.21 port 41778 [preauth]
Sep  6 04:46:33 nativespace-cdp sshd[2777075]: Connection closed by 159.100.136.21 port 50896 [preauth]
Sep  6 04:51:33 nativespace-cdp sshd[2778571]: Connection closed by 159.100.136.21 port 60048 [preauth]
Sep  6 04:56:33 nativespace-cdp sshd[2780064]: Connection closed by 159.100.136.21 port 41010 [preauth]
Sep  6 04:56:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 04:56:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:57:00 nativespace-cdp sudo[2780120]: pam_unix(sudo:session): session closed for user root
Sep  6 04:57:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 04:57:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:57:00 nativespace-cdp sudo[2780127]: pam_unix(sudo:session): session closed for user root
Sep  6 04:57:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 04:57:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:57:07 nativespace-cdp sudo[2780153]: pam_unix(sudo:session): session closed for user root
Sep  6 04:57:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=ptkxhsbt user-3=dickemery123 user-4=lbhyisi user-5=hhdugcor user-6=magichat user-7=brmrjxl user-8=lakesan1 user-9=sarafoundation user-10=atestord user-11=strathar user-12=wilsonsw user-13=musorguk user-14=megacards user-15=jarvisin user-16=theblack user-17=hodgesonweb user-18=spectrum user-19=still user-20=agproduc user-21=leereyn1 user-22=stephani user-23=booff user-24=foundation user-25=markward user-26=maflemin user-27=lbscrmod user-28=connect9 user-29=athenare user-30=vantagep user-31=ulsukarm user-32=alexadmin user-33=skyfirec user-34=askhform user-35=stuartge user-36=innovat1 user-37=nativene user-38=brighto1 user-39=nstriton user-40=battlere user-41=oneoarco user-42=firstre2 user-43=vivienn1 user-44=bedfords user-45=bemadonn user-46=belle user-47=ggaaorgu user-48=newstoda
Sep  6 04:57:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=elecleis user-50=milloyco user-51=gilpin user-52=carsinyo user-53=fetch user-54=putterfi user-55=hubmaster user-56=ianrayne user-57=accooper user-58=thqkgnbz user-59=connectedshoppin user-60=firstres user-61=jonhartl user-62=seftvta user-63=ultbcrra user-64=coursemc user-65=opaiscyx user-66=costestimatorco user-67=clarkass user-68=firstrel user-69=southlon user-70=highlegh user-71=firstred user-72=ninejimm user-73=reliable user-74=cathski user-75=cambria1 user-76=pugwash user-77=paulmca1 user-78=howardon user-79=cwsocial user-80=hirefootballgame user-81=courseme user-82=eugincou user-83=health2045 user-84=fortunaz user-85=foods user-86=leftie user-87=putterfc user-88=nscdp user-89=ctedorgu user-90=philmcph user-91=donnychicago user-92=firstre5 user-93=steakbridieme user-94=lkpier user-95=isleofwi user-96=smrszyqg user-97=barbersh user-98=tigerlet user-99=hidden user-100=nomistakes user-101=burydropin
Sep  6 04:57:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=fawcettd user-103=nsceres user-104=eatspam user-105=darkstar user-106=beauty user-107=dhyana user-108=asandcoc user-109=sibtoncc user-110=zebrapho user-111=bwppodcast user-112=steve user-113=what user-114=oubpgvbx user-115=tstardom user-116=nvihkvu user-117=cath user-118=sketchy user-119=havantho user-120=kategilpin user-121=ladburyp user-122=dancinggardener user-123=stagingerris user-124=design user-125=nove user-126=boldover user-127=sosevalu user-128=crrtipdl user-129=bakery user-130=attlebor user-131=lucy user-132=onlycont user-133=branko user-134=hodgsonmail user-135=outdoorc user-136=ranxterc user-137=romaldki user-138=tomandle user-139=jennimil user-140=mcdermos user-141=chrisdal user-142=careers user-143=nbhavers user-144=david feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 04:57:07 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 04:57:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:57:08 nativespace-cdp sudo[2780160]: pam_unix(sudo:session): session closed for user root
Sep  6 04:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  6 04:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:57:09 nativespace-cdp sudo[2780168]: pam_unix(sudo:session): session closed for user root
Sep  6 04:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep  6 04:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:57:10 nativespace-cdp sudo[2780173]: pam_unix(sudo:session): session closed for user root
Sep  6 04:57:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  6 04:57:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 04:57:51 nativespace-cdp sudo[2780386]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 04:57:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  6 04:57:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:57:52 nativespace-cdp sudo[2780393]: pam_unix(sudo:session): session closed for user root
Sep  6 04:57:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep  6 04:57:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:57:54 nativespace-cdp sudo[2780398]: pam_unix(sudo:session): session closed for user root
Sep  6 04:57:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep  6 04:57:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:58:01 nativespace-cdp sudo[2780406]: pam_unix(sudo:session): session closed for user root
Sep  6 04:58:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  6 04:58:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:58:01 nativespace-cdp sudo[2780423]: pam_unix(sudo:session): session closed for user root
Sep  6 04:58:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep  6 04:58:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:58:09 nativespace-cdp sudo[2780454]: pam_unix(sudo:session): session closed for user root
Sep  6 04:58:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep  6 04:58:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:58:26 nativespace-cdp sudo[2780474]: pam_unix(sudo:session): session closed for user root
Sep  6 04:58:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep  6 04:58:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:58:27 nativespace-cdp sudo[2780516]: pam_unix(sudo:session): session closed for user root
Sep  6 04:58:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep  6 04:58:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:58:28 nativespace-cdp sudo[2780523]: pam_unix(sudo:session): session closed for user root
Sep  6 04:58:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep  6 04:58:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:58:39 nativespace-cdp sudo[2780601]: pam_unix(sudo:session): session closed for user root
Sep  6 04:58:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  6 04:58:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 04:58:43 nativespace-cdp sudo[2780662]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 04:58:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  6 04:58:43 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  6 04:58:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  6 04:58:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 04:58:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 04:58:44 nativespace-cdp sudo[2780669]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 04:58:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  6 04:58:44 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  6 04:58:44 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  6 04:58:44 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 04:58:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 04:59:07 nativespace-cdp sudo[2780677]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 04:59:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  6 04:59:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 04:59:23 nativespace-cdp sudo[2780902]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 04:59:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  6 04:59:23 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  6 04:59:23 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  6 04:59:23 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 04:59:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 04:59:23 nativespace-cdp sudo[2780909]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 04:59:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  6 04:59:23 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  6 04:59:23 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  6 04:59:23 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 04:59:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 04:59:24 nativespace-cdp sudo[2780915]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 04:59:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  6 04:59:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:59:27 nativespace-cdp sudo[2780950]: pam_unix(sudo:session): session closed for user root
Sep  6 04:59:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep  6 04:59:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 04:59:28 nativespace-cdp sudo[2780956]: pam_unix(sudo:session): session closed for user root
Sep  6 05:00:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  6 05:00:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 05:00:42 nativespace-cdp sudo[2781486]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 05:00:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep  6 05:00:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:00:46 nativespace-cdp sudo[2781492]: pam_unix(sudo:session): session closed for user root
Sep  6 05:00:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep  6 05:00:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:00:52 nativespace-cdp sudo[2781510]: pam_unix(sudo:session): session closed for user root
Sep  6 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  6 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:00:52 nativespace-cdp sudo[2781526]: pam_unix(sudo:session): session closed for user root
Sep  6 05:00:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep  6 05:00:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:00:58 nativespace-cdp sudo[2781545]: pam_unix(sudo:session): session closed for user root
Sep  6 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep  6 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:00:59 nativespace-cdp sudo[2781555]: pam_unix(sudo:session): session closed for user root
Sep  6 05:01:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep  6 05:01:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:01:06 nativespace-cdp sudo[2781647]: pam_unix(sudo:session): session closed for user root
Sep  6 05:01:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  6 05:01:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 05:01:10 nativespace-cdp sudo[2781705]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 05:01:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  6 05:01:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  6 05:01:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  6 05:01:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:01:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 05:01:10 nativespace-cdp sudo[2781713]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 05:01:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  6 05:01:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  6 05:01:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  6 05:01:10 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:01:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 05:01:27 nativespace-cdp sudo[2781722]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 05:01:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  6 05:01:27 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  6 05:01:27 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  6 05:01:27 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:01:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 05:01:30 nativespace-cdp sudo[2781773]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 05:01:36 nativespace-cdp sshd[2781855]: Connection closed by 159.100.136.21 port 49618 [preauth]
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  6 05:01:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 05:01:38 nativespace-cdp sudo[2781910]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:01:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 05:01:38 nativespace-cdp sudo[2781916]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:01:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 05:01:38 nativespace-cdp sudo[2781922]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  6 05:01:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:01:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 05:01:38 nativespace-cdp sudo[2781928]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  6 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:01:43 nativespace-cdp sudo[2781966]: pam_unix(sudo:session): session closed for user root
Sep  6 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep  6 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:01:45 nativespace-cdp sudo[2781973]: pam_unix(sudo:session): session closed for user root
Sep  6 05:01:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep  6 05:01:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:01:53 nativespace-cdp sudo[2782007]: pam_unix(sudo:session): session closed for user root
Sep  6 05:01:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep  6 05:01:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:01:54 nativespace-cdp sudo[2782016]: pam_unix(sudo:session): session closed for user root
Sep  6 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  6 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  6 05:01:54 nativespace-cdp sudo[2782027]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  6 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep  6 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:01:55 nativespace-cdp sudo[2782033]: pam_unix(sudo:session): session closed for user root
Sep  6 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep  6 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:01:56 nativespace-cdp sudo[2782037]: pam_unix(sudo:session): session closed for user root
Sep  6 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep  6 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:02:03 nativespace-cdp sudo[2782041]: pam_unix(sudo:session): session closed for user root
Sep  6 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  6 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:02:03 nativespace-cdp sudo[2782072]: pam_unix(sudo:session): session closed for user root
Sep  6 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  6 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 05:03:07 nativespace-cdp sudo[2782269]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 05:03:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  6 05:03:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:03:09 nativespace-cdp sudo[2782276]: pam_unix(sudo:session): session closed for user root
Sep  6 05:03:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  6 05:03:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:03:09 nativespace-cdp sudo[2782283]: pam_unix(sudo:session): session closed for user root
Sep  6 05:03:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep  6 05:03:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:03:11 nativespace-cdp sudo[2782297]: pam_unix(sudo:session): session closed for user root
Sep  6 05:03:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep  6 05:03:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:03:20 nativespace-cdp sudo[2782370]: pam_unix(sudo:session): session closed for user root
Sep  6 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  6 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 05:03:24 nativespace-cdp sudo[2782439]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  6 05:03:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  6 05:03:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  6 05:03:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 05:03:25 nativespace-cdp sudo[2782445]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 05:03:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  6 05:03:25 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  6 05:03:25 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  6 05:03:25 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:03:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 05:03:43 nativespace-cdp sudo[2782454]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  6 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 05:03:53 nativespace-cdp sudo[2782641]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  6 05:03:53 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  6 05:03:53 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  6 05:03:53 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 05:03:53 nativespace-cdp sudo[2782647]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  6 05:03:53 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  6 05:03:53 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  6 05:03:53 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  6 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 05:03:53 nativespace-cdp sudo[2782653]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 05:03:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  6 05:03:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:03:55 nativespace-cdp sudo[2782687]: pam_unix(sudo:session): session closed for user root
Sep  6 05:03:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep  6 05:03:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:03:58 nativespace-cdp sudo[2782691]: pam_unix(sudo:session): session closed for user root
Sep  6 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  6 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  6 05:04:49 nativespace-cdp sudo[2782845]: pam_unix(sudo:session): session closed for user fortunaz
Sep  6 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep  6 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:04:50 nativespace-cdp sudo[2782852]: pam_unix(sudo:session): session closed for user root
Sep  6 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep  6 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:04:51 nativespace-cdp sudo[2782858]: pam_unix(sudo:session): session closed for user root
Sep  6 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  6 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:04:51 nativespace-cdp sudo[2782863]: pam_unix(sudo:session): session closed for user root
Sep  6 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep  6 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:04:54 nativespace-cdp sudo[2782882]: pam_unix(sudo:session): session closed for user root
Sep  6 05:04:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  6 05:04:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:04:54 nativespace-cdp sudo[2782887]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep  6 05:05:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:00 nativespace-cdp sudo[2782954]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=martsblo WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "Advanced Form Integration" on ONE | OAR (https://oneoar.co.uk). Installed version: 1.64.0. Available version: 1.90.2.<br/><br/>2. Plugin "Category Order and Taxonomy Terms Order" on ONE | OAR (https://oneoar.co.uk). Installed version: 1.7.9. Available version: 1.8.5.<br/><br/>3. Plugin "Category Order and Taxonomy Terms Order" on Pinstripe Inventories (https://pinstripe.services). Installed version: 1.7.9. Available version: 1.8.5.<br/><br/>' installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website
Sep  6 05:05:16 nativespace-cdp sudo: wp-toolkit : (command continued) "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep  6 05:05:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:16 nativespace-cdp sudo[2783270]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep  6 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:52 nativespace-cdp sudo[2783571]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  6 05:05:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:53 nativespace-cdp sudo[2783576]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783583]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783586]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783589]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783593]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783596]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783599]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783602]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783605]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783608]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783612]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783615]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:54 nativespace-cdp sudo[2783618]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783622]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783625]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783628]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783631]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783634]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783637]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783640]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783643]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783646]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783649]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783652]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783655]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783658]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783661]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783664]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783667]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783670]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783673]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783677]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783680]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783683]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783686]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783689]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783692]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:55 nativespace-cdp sudo[2783695]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783699]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783702]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783705]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783708]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783712]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783715]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783718]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783721]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783725]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783728]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783731]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783734]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783737]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783740]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783743]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783746]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783749]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783752]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783755]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783758]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783761]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783764]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783767]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783770]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783773]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783776]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783779]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783782]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783785]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:56 nativespace-cdp sudo[2783788]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783792]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783795]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783798]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783801]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783804]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783807]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783810]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783813]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783816]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783819]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783822]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783825]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783828]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783831]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783834]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783837]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783840]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783843]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783846]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783849]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783852]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783855]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783858]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783861]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783864]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783867]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783870]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783873]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783876]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:05:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:57 nativespace-cdp sudo[2783879]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783883]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783886]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783889]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783892]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783895]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783898]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783901]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783907]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783910]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783913]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783916]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783919]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783922]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783925]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783929]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783932]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783935]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783938]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783941]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783944]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783947]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783950]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783953]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783956]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783959]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783962]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783965]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783969]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783972]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783975]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783978]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783981]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783984]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783987]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  6 05:05:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:58 nativespace-cdp sudo[2783990]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2783994]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2783997]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784000]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784003]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784006]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784009]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784012]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784015]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784018]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784021]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784024]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784027]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784030]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784033]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784036]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784040]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784043]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784046]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784049]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784052]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784055]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784058]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784061]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784064]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784067]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784070]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784073]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784076]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784079]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784082]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784085]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784088]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784091]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784094]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784097]: pam_unix(sudo:session): session closed for user root
Sep  6 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  6 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:05:59 nativespace-cdp sudo[2784100]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784104]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784107]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784110]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784113]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784116]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784119]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784122]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784125]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784128]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784131]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784134]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784137]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784140]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784143]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784146]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784149]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784152]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784155]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784158]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784161]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784164]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784167]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784170]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784173]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784176]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784179]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784182]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784185]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784188]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784191]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784194]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784197]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:00 nativespace-cdp sudo[2784200]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:06:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784203]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784207]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784210]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784213]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784216]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784220]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784231]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784234]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784237]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784240]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784243]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784246]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784249]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784252]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784255]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784258]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784261]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784264]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784267]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784270]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784273]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784276]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  6 05:06:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:06:01 nativespace-cdp sudo[2784279]: pam_unix(sudo:session): session closed for user root
Sep  6 05:06:35 nativespace-cdp sshd[2784360]: Connection closed by 159.100.136.21 port 59248 [preauth]
Sep  6 05:10:08 nativespace-cdp sshd[2785062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.199.224.52  user=root
Sep  6 05:10:08 nativespace-cdp sshd[2785062]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 05:10:09 nativespace-cdp sshd[2785062]: Failed password for root from 197.199.224.52 port 49736 ssh2
Sep  6 05:10:10 nativespace-cdp sshd[2785062]: Received disconnect from 197.199.224.52 port 49736:11: Bye Bye [preauth]
Sep  6 05:10:10 nativespace-cdp sshd[2785062]: Disconnected from 197.199.224.52 port 49736 [preauth]
Sep  6 05:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 05:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:25 nativespace-cdp sudo[2785336]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 05:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:25 nativespace-cdp sudo[2785341]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 05:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:28 nativespace-cdp sudo[2785348]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 05:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:28 nativespace-cdp sudo[2785360]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 05:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:39 nativespace-cdp sudo[2785364]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 05:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:39 nativespace-cdp sudo[2785415]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 05:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:39 nativespace-cdp sudo[2785418]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 05:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:39 nativespace-cdp sudo[2785421]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 05:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:39 nativespace-cdp sudo[2785424]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 05:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:39 nativespace-cdp sudo[2785427]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 05:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:40 nativespace-cdp sudo[2785430]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 05:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:42 nativespace-cdp sudo[2785442]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 05:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:47 nativespace-cdp sudo[2785446]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=david user-2=nbhavers user-3=careers user-4=chrisdal user-5=mcdermos user-6=jennimil user-7=tomandle user-8=romaldki user-9=hodgsonmail user-10=outdoorc user-11=ranxterc user-12=branko user-13=onlycont user-14=lucy user-15=attlebor user-16=bakery user-17=crrtipdl user-18=sosevalu user-19=boldover user-20=nove user-21=design user-22=stagingerris user-23=dancinggardener user-24=ladburyp user-25=kategilpin user-26=havantho user-27=sketchy user-28=cath user-29=nvihkvu user-30=oubpgvbx user-31=tstardom user-32=what user-33=steve user-34=bwppodcast user-35=zebrapho user-36=asandcoc user-37=sibtoncc user-38=dhyana user-39=beauty user-40=darkstar user-41=eatspam user-42=nsceres user-43=fawcettd user-44=burydropin user-45=nomistakes user-46=hidden user-47=tigerlet user-48=barbersh user-49=smrszyqg
Sep  6 05:10:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=isleofwi user-51=lkpier user-52=donnychicago user-53=firstre5 user-54=steakbridieme user-55=philmcph user-56=ctedorgu user-57=nscdp user-58=putterfc user-59=foods user-60=leftie user-61=fortunaz user-62=health2045 user-63=eugincou user-64=courseme user-65=hirefootballgame user-66=cwsocial user-67=pugwash user-68=paulmca1 user-69=howardon user-70=cathski user-71=cambria1 user-72=ninejimm user-73=reliable user-74=firstred user-75=highlegh user-76=southlon user-77=firstrel user-78=clarkass user-79=costestimatorco user-80=coursemc user-81=opaiscyx user-82=ultbcrra user-83=jonhartl user-84=seftvta user-85=firstres user-86=connectedshoppin user-87=thqkgnbz user-88=accooper user-89=ianrayne user-90=putterfi user-91=hubmaster user-92=fetch user-93=carsinyo user-94=gilpin user-95=milloyco user-96=elecleis user-97=newstoda user-98=ggaaorgu user-99=belle user-100=bemadonn user-101=bedfords user-102=vivienn1
Sep  6 05:10:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=firstre2 user-104=oneoarco user-105=battlere user-106=nstriton user-107=brighto1 user-108=nativene user-109=innovat1 user-110=askhform user-111=stuartge user-112=alexadmin user-113=skyfirec user-114=ulsukarm user-115=vantagep user-116=connect9 user-117=athenare user-118=lbscrmod user-119=maflemin user-120=foundation user-121=booff user-122=markward user-123=stephani user-124=leereyn1 user-125=agproduc user-126=still user-127=spectrum user-128=hodgesonweb user-129=theblack user-130=jarvisin user-131=megacards user-132=musorguk user-133=wilsonsw user-134=strathar user-135=atestord user-136=sarafoundation user-137=lakesan1 user-138=brmrjxl user-139=magichat user-140=hhdugcor user-141=lbhyisi user-142=dickemery123 user-143=ptkxhsbt user-144=martsblo feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 05:10:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 05:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:49 nativespace-cdp sudo[2785465]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 05:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:49 nativespace-cdp sudo[2785472]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SJDqMx70Eo0BmWnY.~
Sep  6 05:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:49 nativespace-cdp sudo[2785475]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SJDqMx70Eo0BmWnY.~'
Sep  6 05:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:49 nativespace-cdp sudo[2785478]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SJDqMx70Eo0BmWnY.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 05:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:49 nativespace-cdp sudo[2785482]: pam_unix(sudo:session): session closed for user root
Sep  6 05:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 05:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:10:49 nativespace-cdp sudo[2785485]: pam_unix(sudo:session): session closed for user root
Sep  6 05:11:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 05:11:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 05:11:02 nativespace-cdp sudo[2785539]: pam_unix(sudo:session): session closed for user root
Sep  6 05:11:33 nativespace-cdp sshd[2785600]: Connection closed by 159.100.136.21 port 40366 [preauth]
Sep  6 05:14:31 nativespace-cdp sshd[2786143]: Invalid user testserver from 40.127.173.225 port 45552
Sep  6 05:14:31 nativespace-cdp sshd[2786143]: input_userauth_request: invalid user testserver [preauth]
Sep  6 05:14:31 nativespace-cdp sshd[2786143]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 05:14:31 nativespace-cdp sshd[2786143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.173.225
Sep  6 05:14:33 nativespace-cdp sshd[2786143]: Failed password for invalid user testserver from 40.127.173.225 port 45552 ssh2
Sep  6 05:14:35 nativespace-cdp sshd[2786143]: Received disconnect from 40.127.173.225 port 45552:11: Bye Bye [preauth]
Sep  6 05:14:35 nativespace-cdp sshd[2786143]: Disconnected from 40.127.173.225 port 45552 [preauth]
Sep  6 05:15:38 nativespace-cdp sshd[2786615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.173.225  user=root
Sep  6 05:15:38 nativespace-cdp sshd[2786615]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 05:15:40 nativespace-cdp sshd[2786615]: Failed password for root from 40.127.173.225 port 39006 ssh2
Sep  6 05:15:40 nativespace-cdp sshd[2786615]: Received disconnect from 40.127.173.225 port 39006:11: Bye Bye [preauth]
Sep  6 05:15:40 nativespace-cdp sshd[2786615]: Disconnected from 40.127.173.225 port 39006 [preauth]
Sep  6 05:15:42 nativespace-cdp sshd[2786671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.199.224.52  user=root
Sep  6 05:15:42 nativespace-cdp sshd[2786671]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 05:15:44 nativespace-cdp sshd[2786671]: Failed password for root from 197.199.224.52 port 37780 ssh2
Sep  6 05:15:53 nativespace-cdp sshd[2786671]: Received disconnect from 197.199.224.52 port 37780:11: Bye Bye [preauth]
Sep  6 05:15:53 nativespace-cdp sshd[2786671]: Disconnected from 197.199.224.52 port 37780 [preauth]
Sep  6 05:16:21 nativespace-cdp sshd[2786867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.173.225  user=root
Sep  6 05:16:21 nativespace-cdp sshd[2786867]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 05:16:24 nativespace-cdp sshd[2786867]: Failed password for root from 40.127.173.225 port 38048 ssh2
Sep  6 05:16:27 nativespace-cdp sshd[2786867]: Received disconnect from 40.127.173.225 port 38048:11: Bye Bye [preauth]
Sep  6 05:16:27 nativespace-cdp sshd[2786867]: Disconnected from 40.127.173.225 port 38048 [preauth]
Sep  6 05:16:33 nativespace-cdp sshd[2786915]: Connection closed by 159.100.136.21 port 49096 [preauth]
Sep  6 05:16:43 nativespace-cdp sshd[2786956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.199.224.52  user=root
Sep  6 05:16:43 nativespace-cdp sshd[2786956]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 05:16:45 nativespace-cdp sshd[2786956]: Failed password for root from 197.199.224.52 port 53026 ssh2
Sep  6 05:21:36 nativespace-cdp sshd[2788021]: Connection closed by 159.100.136.21 port 57798 [preauth]
Sep  6 05:26:33 nativespace-cdp sshd[2789416]: Connection closed by 159.100.136.21 port 38838 [preauth]
Sep  6 05:31:34 nativespace-cdp sshd[2790455]: Connection closed by 159.100.136.21 port 48292 [preauth]
Sep  6 05:35:22 nativespace-cdp su: pam_unix(su:session): session opened for user gilpin by (uid=0)
Sep  6 05:35:24 nativespace-cdp su[2791206]: pam_unix(su:session): session closed for user gilpin
Sep  6 05:36:33 nativespace-cdp sshd[2791538]: Connection closed by 159.100.136.21 port 57098 [preauth]
Sep  6 05:41:37 nativespace-cdp sshd[2792703]: Connection closed by 159.100.136.21 port 38472 [preauth]
Sep  6 05:46:36 nativespace-cdp sshd[2793924]: Connection closed by 159.100.136.21 port 47804 [preauth]
Sep  6 05:51:38 nativespace-cdp sshd[2795347]: Connection closed by 159.100.136.21 port 56584 [preauth]
Sep  6 05:56:35 nativespace-cdp sshd[2796669]: Connection closed by 159.100.136.21 port 37276 [preauth]
Sep  6 06:01:33 nativespace-cdp sshd[2797937]: Connection closed by 159.100.136.21 port 46580 [preauth]
Sep  6 06:06:37 nativespace-cdp sshd[2799083]: Connection closed by 159.100.136.21 port 55566 [preauth]
Sep  6 06:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 06:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:20 nativespace-cdp sudo[2800266]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 06:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:20 nativespace-cdp sudo[2800269]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 06:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:23 nativespace-cdp sudo[2800272]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 06:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:23 nativespace-cdp sudo[2800281]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 06:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:35 nativespace-cdp sudo[2800284]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 06:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:35 nativespace-cdp sudo[2800400]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 06:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:35 nativespace-cdp sudo[2800404]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 06:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:35 nativespace-cdp sudo[2800407]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 06:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:35 nativespace-cdp sudo[2800410]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 06:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:35 nativespace-cdp sudo[2800413]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 06:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:35 nativespace-cdp sudo[2800416]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 06:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:38 nativespace-cdp sudo[2800452]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 06:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:43 nativespace-cdp sudo[2800466]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bakery user-2=crrtipdl user-3=sosevalu user-4=nove user-5=boldover user-6=dancinggardener user-7=stagingerris user-8=ladburyp user-9=kategilpin user-10=design user-11=oubpgvbx user-12=tstardom user-13=what user-14=havantho user-15=sketchy user-16=cath user-17=nvihkvu user-18=chrisdal user-19=mcdermos user-20=david user-21=careers user-22=nbhavers user-23=tomandle user-24=jennimil user-25=outdoorc user-26=ranxterc user-27=hodgsonmail user-28=branko user-29=romaldki user-30=lucy user-31=attlebor user-32=onlycont user-33=smrszyqg user-34=isleofwi user-35=nomistakes user-36=hidden user-37=barbersh user-38=tigerlet user-39=nscdp user-40=putterfc user-41=leftie user-42=foods user-43=fortunaz user-44=health2045 user-45=lkpier user-46=steakbridieme user-47=donnychicago user-48=firstre5 user-49=ctedorgu
Sep  6 06:10:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=philmcph user-51=hirefootballgame user-52=eugincou user-53=courseme user-54=cathski user-55=cambria1 user-56=reliable user-57=ninejimm user-58=cwsocial user-59=pugwash user-60=paulmca1 user-61=howardon user-62=bwppodcast user-63=zebrapho user-64=steve user-65=asandcoc user-66=sibtoncc user-67=beauty user-68=darkstar user-69=eatspam user-70=dhyana user-71=fawcettd user-72=burydropin user-73=nsceres user-74=bedfords user-75=newstoda user-76=belle user-77=ggaaorgu user-78=bemadonn user-79=nstriton user-80=brighto1 user-81=vivienn1 user-82=firstre2 user-83=oneoarco user-84=battlere user-85=innovat1 user-86=stuartge user-87=askhform user-88=nativene user-89=alexadmin user-90=skyfirec user-91=firstrel user-92=clarkass user-93=costestimatorco user-94=firstred user-95=highlegh user-96=southlon user-97=ultbcrra user-98=jonhartl user-99=seftvta user-100=firstres user-101=coursemc user-102=opaiscyx user-103=accooper
Sep  6 06:10:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=ianrayne user-105=connectedshoppin user-106=thqkgnbz user-107=gilpin user-108=milloyco user-109=elecleis user-110=hubmaster user-111=putterfi user-112=fetch user-113=carsinyo user-114=wilsonsw user-115=megacards user-116=musorguk user-117=lakesan1 user-118=brmrjxl user-119=strathar user-120=atestord user-121=sarafoundation user-122=hhdugcor user-123=lbhyisi user-124=magichat user-125=martsblo user-126=dickemery123 user-127=ptkxhsbt user-128=ulsukarm user-129=booff user-130=markward user-131=foundation user-132=vantagep user-133=athenare user-134=connect9 user-135=lbscrmod user-136=maflemin user-137=agproduc user-138=still user-139=stephani user-140=leereyn1 user-141=jarvisin user-142=spectrum user-143=theblack user-144=hodgesonweb feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains feature-9=webprotect
Sep  6 06:10:43 nativespace-cdp sudo: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 06:10:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:46 nativespace-cdp sudo[2800521]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 06:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:47 nativespace-cdp sudo[2800605]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-gdAsGSjogW45oAQL.~
Sep  6 06:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:47 nativespace-cdp sudo[2800612]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-gdAsGSjogW45oAQL.~'
Sep  6 06:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:47 nativespace-cdp sudo[2800616]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-gdAsGSjogW45oAQL.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 06:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:47 nativespace-cdp sudo[2800620]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 06:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:47 nativespace-cdp sudo[2800623]: pam_unix(sudo:session): session closed for user root
Sep  6 06:10:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 06:10:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 06:10:53 nativespace-cdp sudo[2800646]: pam_unix(sudo:session): session closed for user root
Sep  6 06:11:34 nativespace-cdp sshd[2800769]: Connection closed by 159.100.136.21 port 35804 [preauth]
Sep  6 06:16:33 nativespace-cdp sshd[2801886]: Connection closed by 159.100.136.21 port 45452 [preauth]
Sep  6 06:21:35 nativespace-cdp sshd[2802944]: Connection closed by 159.100.136.21 port 54812 [preauth]
Sep  6 06:26:35 nativespace-cdp sshd[2804059]: Connection closed by 159.100.136.21 port 36034 [preauth]
Sep  6 06:31:37 nativespace-cdp sshd[2805337]: Connection closed by 159.100.136.21 port 45296 [preauth]
Sep  6 06:36:33 nativespace-cdp sshd[2806466]: Connection closed by 159.100.136.21 port 54148 [preauth]
Sep  6 06:41:35 nativespace-cdp sshd[2808004]: Connection closed by 159.100.136.21 port 34972 [preauth]
Sep  6 06:46:33 nativespace-cdp sshd[2809028]: Connection closed by 159.100.136.21 port 44570 [preauth]
Sep  6 06:51:35 nativespace-cdp sshd[2809995]: Connection closed by 159.100.136.21 port 53398 [preauth]
Sep  6 06:56:33 nativespace-cdp sshd[2811122]: Connection closed by 159.100.136.21 port 34672 [preauth]
Sep  6 06:57:51 nativespace-cdp sshd[2811321]: Invalid user simin from 182.93.50.90 port 49156
Sep  6 06:57:51 nativespace-cdp sshd[2811321]: input_userauth_request: invalid user simin [preauth]
Sep  6 06:57:52 nativespace-cdp sshd[2811321]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 06:57:52 nativespace-cdp sshd[2811321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.93.50.90
Sep  6 06:57:53 nativespace-cdp sshd[2811321]: Failed password for invalid user simin from 182.93.50.90 port 49156 ssh2
Sep  6 06:57:54 nativespace-cdp sshd[2811321]: Received disconnect from 182.93.50.90 port 49156:11: Bye Bye [preauth]
Sep  6 06:57:54 nativespace-cdp sshd[2811321]: Disconnected from 182.93.50.90 port 49156 [preauth]
Sep  6 06:58:11 nativespace-cdp sshd[2811508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.52.17  user=root
Sep  6 06:58:11 nativespace-cdp sshd[2811508]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 06:58:13 nativespace-cdp sshd[2811508]: Failed password for root from 104.248.52.17 port 54842 ssh2
Sep  6 06:58:13 nativespace-cdp sshd[2811508]: Received disconnect from 104.248.52.17 port 54842:11: Bye Bye [preauth]
Sep  6 06:58:13 nativespace-cdp sshd[2811508]: Disconnected from 104.248.52.17 port 54842 [preauth]
Sep  6 06:59:40 nativespace-cdp sshd[2811809]: Invalid user nick from 156.254.115.235 port 5078
Sep  6 06:59:40 nativespace-cdp sshd[2811809]: input_userauth_request: invalid user nick [preauth]
Sep  6 06:59:40 nativespace-cdp sshd[2811809]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 06:59:40 nativespace-cdp sshd[2811809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.254.115.235
Sep  6 06:59:41 nativespace-cdp sshd[2811809]: Failed password for invalid user nick from 156.254.115.235 port 5078 ssh2
Sep  6 06:59:41 nativespace-cdp sshd[2811809]: Received disconnect from 156.254.115.235 port 5078:11: Bye Bye [preauth]
Sep  6 06:59:41 nativespace-cdp sshd[2811809]: Disconnected from 156.254.115.235 port 5078 [preauth]
Sep  6 07:01:12 nativespace-cdp sshd[2812330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.13.225.50  user=root
Sep  6 07:01:12 nativespace-cdp sshd[2812330]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:01:14 nativespace-cdp sshd[2812330]: Failed password for root from 191.13.225.50 port 55320 ssh2
Sep  6 07:01:18 nativespace-cdp sshd[2812330]: Received disconnect from 191.13.225.50 port 55320:11: Bye Bye [preauth]
Sep  6 07:01:18 nativespace-cdp sshd[2812330]: Disconnected from 191.13.225.50 port 55320 [preauth]
Sep  6 07:01:29 nativespace-cdp sshd[2812445]: Invalid user joe from 188.165.36.53 port 53706
Sep  6 07:01:29 nativespace-cdp sshd[2812445]: input_userauth_request: invalid user joe [preauth]
Sep  6 07:01:29 nativespace-cdp sshd[2812445]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:01:29 nativespace-cdp sshd[2812445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.165.36.53
Sep  6 07:01:30 nativespace-cdp sshd[2812445]: Failed password for invalid user joe from 188.165.36.53 port 53706 ssh2
Sep  6 07:01:32 nativespace-cdp sshd[2812445]: Received disconnect from 188.165.36.53 port 53706:11: Bye Bye [preauth]
Sep  6 07:01:32 nativespace-cdp sshd[2812445]: Disconnected from 188.165.36.53 port 53706 [preauth]
Sep  6 07:01:33 nativespace-cdp sshd[2812460]: Connection closed by 159.100.136.21 port 43650 [preauth]
Sep  6 07:02:15 nativespace-cdp sshd[2812619]: Invalid user js from 156.254.115.235 port 59716
Sep  6 07:02:15 nativespace-cdp sshd[2812619]: input_userauth_request: invalid user js [preauth]
Sep  6 07:02:15 nativespace-cdp sshd[2812619]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:02:15 nativespace-cdp sshd[2812619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.254.115.235
Sep  6 07:02:18 nativespace-cdp sshd[2812619]: Failed password for invalid user js from 156.254.115.235 port 59716 ssh2
Sep  6 07:02:18 nativespace-cdp sshd[2812619]: Received disconnect from 156.254.115.235 port 59716:11: Bye Bye [preauth]
Sep  6 07:02:18 nativespace-cdp sshd[2812619]: Disconnected from 156.254.115.235 port 59716 [preauth]
Sep  6 07:03:06 nativespace-cdp sshd[2812771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.254.115.235  user=zabbix
Sep  6 07:03:06 nativespace-cdp sshd[2812771]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "zabbix"
Sep  6 07:03:09 nativespace-cdp sshd[2812771]: Failed password for zabbix from 156.254.115.235 port 16646 ssh2
Sep  6 07:03:09 nativespace-cdp sshd[2812771]: Received disconnect from 156.254.115.235 port 16646:11: Bye Bye [preauth]
Sep  6 07:03:09 nativespace-cdp sshd[2812771]: Disconnected from 156.254.115.235 port 16646 [preauth]
Sep  6 07:04:59 nativespace-cdp sshd[2813152]: Invalid user test01 from 40.115.18.231 port 46974
Sep  6 07:04:59 nativespace-cdp sshd[2813152]: input_userauth_request: invalid user test01 [preauth]
Sep  6 07:04:59 nativespace-cdp sshd[2813152]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:04:59 nativespace-cdp sshd[2813152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.115.18.231
Sep  6 07:05:01 nativespace-cdp sshd[2813152]: Failed password for invalid user test01 from 40.115.18.231 port 46974 ssh2
Sep  6 07:05:01 nativespace-cdp sshd[2813152]: Received disconnect from 40.115.18.231 port 46974:11: Bye Bye [preauth]
Sep  6 07:05:01 nativespace-cdp sshd[2813152]: Disconnected from 40.115.18.231 port 46974 [preauth]
Sep  6 07:06:26 nativespace-cdp sshd[2813671]: Invalid user test2 from 104.248.52.17 port 40730
Sep  6 07:06:26 nativespace-cdp sshd[2813671]: input_userauth_request: invalid user test2 [preauth]
Sep  6 07:06:27 nativespace-cdp sshd[2813671]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:06:27 nativespace-cdp sshd[2813671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.52.17
Sep  6 07:06:29 nativespace-cdp sshd[2813671]: Failed password for invalid user test2 from 104.248.52.17 port 40730 ssh2
Sep  6 07:06:29 nativespace-cdp sshd[2813671]: Received disconnect from 104.248.52.17 port 40730:11: Bye Bye [preauth]
Sep  6 07:06:29 nativespace-cdp sshd[2813671]: Disconnected from 104.248.52.17 port 40730 [preauth]
Sep  6 07:06:36 nativespace-cdp sshd[2813723]: Connection closed by 159.100.136.21 port 52412 [preauth]
Sep  6 07:06:36 nativespace-cdp sshd[2813722]: Invalid user js from 188.165.36.53 port 53896
Sep  6 07:06:36 nativespace-cdp sshd[2813722]: input_userauth_request: invalid user js [preauth]
Sep  6 07:06:36 nativespace-cdp sshd[2813722]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:06:36 nativespace-cdp sshd[2813722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.165.36.53
Sep  6 07:06:38 nativespace-cdp sshd[2813722]: Failed password for invalid user js from 188.165.36.53 port 53896 ssh2
Sep  6 07:06:39 nativespace-cdp sshd[2813722]: Received disconnect from 188.165.36.53 port 53896:11: Bye Bye [preauth]
Sep  6 07:06:39 nativespace-cdp sshd[2813722]: Disconnected from 188.165.36.53 port 53896 [preauth]
Sep  6 07:07:08 nativespace-cdp sshd[2813832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.52.17  user=root
Sep  6 07:07:08 nativespace-cdp sshd[2813832]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:07:10 nativespace-cdp sshd[2813832]: Failed password for root from 104.248.52.17 port 45224 ssh2
Sep  6 07:07:13 nativespace-cdp sshd[2813832]: Received disconnect from 104.248.52.17 port 45224:11: Bye Bye [preauth]
Sep  6 07:07:13 nativespace-cdp sshd[2813832]: Disconnected from 104.248.52.17 port 45224 [preauth]
Sep  6 07:08:10 nativespace-cdp sshd[2814092]: Invalid user gameserver from 191.13.225.50 port 50704
Sep  6 07:08:10 nativespace-cdp sshd[2814092]: input_userauth_request: invalid user gameserver [preauth]
Sep  6 07:08:10 nativespace-cdp sshd[2814098]: Invalid user sonu from 188.165.36.53 port 53952
Sep  6 07:08:10 nativespace-cdp sshd[2814098]: input_userauth_request: invalid user sonu [preauth]
Sep  6 07:08:10 nativespace-cdp sshd[2814092]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:08:10 nativespace-cdp sshd[2814098]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:08:10 nativespace-cdp sshd[2814092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.13.225.50
Sep  6 07:08:10 nativespace-cdp sshd[2814098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.165.36.53
Sep  6 07:08:12 nativespace-cdp sshd[2814092]: Failed password for invalid user gameserver from 191.13.225.50 port 50704 ssh2
Sep  6 07:08:12 nativespace-cdp sshd[2814098]: Failed password for invalid user sonu from 188.165.36.53 port 53952 ssh2
Sep  6 07:08:12 nativespace-cdp sshd[2814098]: Received disconnect from 188.165.36.53 port 53952:11: Bye Bye [preauth]
Sep  6 07:08:12 nativespace-cdp sshd[2814098]: Disconnected from 188.165.36.53 port 53952 [preauth]
Sep  6 07:08:12 nativespace-cdp sshd[2814092]: Received disconnect from 191.13.225.50 port 50704:11: Bye Bye [preauth]
Sep  6 07:08:12 nativespace-cdp sshd[2814092]: Disconnected from 191.13.225.50 port 50704 [preauth]
Sep  6 07:08:40 nativespace-cdp sshd[2814230]: Invalid user test2 from 40.115.18.231 port 50036
Sep  6 07:08:40 nativespace-cdp sshd[2814230]: input_userauth_request: invalid user test2 [preauth]
Sep  6 07:08:40 nativespace-cdp sshd[2814230]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:08:40 nativespace-cdp sshd[2814230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.115.18.231
Sep  6 07:08:42 nativespace-cdp sshd[2814230]: Failed password for invalid user test2 from 40.115.18.231 port 50036 ssh2
Sep  6 07:08:44 nativespace-cdp sshd[2814230]: Received disconnect from 40.115.18.231 port 50036:11: Bye Bye [preauth]
Sep  6 07:08:44 nativespace-cdp sshd[2814230]: Disconnected from 40.115.18.231 port 50036 [preauth]
Sep  6 07:09:06 nativespace-cdp sshd[2814304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.13.225.50  user=root
Sep  6 07:09:06 nativespace-cdp sshd[2814304]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:09:07 nativespace-cdp sshd[2814304]: Failed password for root from 191.13.225.50 port 33520 ssh2
Sep  6 07:09:07 nativespace-cdp sshd[2814304]: Received disconnect from 191.13.225.50 port 33520:11: Bye Bye [preauth]
Sep  6 07:09:07 nativespace-cdp sshd[2814304]: Disconnected from 191.13.225.50 port 33520 [preauth]
Sep  6 07:09:17 nativespace-cdp sshd[2814358]: Invalid user service from 40.115.18.231 port 34868
Sep  6 07:09:17 nativespace-cdp sshd[2814358]: input_userauth_request: invalid user service [preauth]
Sep  6 07:09:17 nativespace-cdp sshd[2814358]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:09:17 nativespace-cdp sshd[2814358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.115.18.231
Sep  6 07:09:19 nativespace-cdp sshd[2814358]: Failed password for invalid user service from 40.115.18.231 port 34868 ssh2
Sep  6 07:09:20 nativespace-cdp sshd[2814358]: Received disconnect from 40.115.18.231 port 34868:11: Bye Bye [preauth]
Sep  6 07:09:20 nativespace-cdp sshd[2814358]: Disconnected from 40.115.18.231 port 34868 [preauth]
Sep  6 07:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 07:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:27 nativespace-cdp sudo[2814762]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 07:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:28 nativespace-cdp sudo[2814767]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 07:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:30 nativespace-cdp sudo[2814770]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 07:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:30 nativespace-cdp sudo[2814809]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 07:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:48 nativespace-cdp sudo[2814816]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 07:10:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:48 nativespace-cdp sudo[2814892]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 07:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:49 nativespace-cdp sudo[2814895]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 07:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:49 nativespace-cdp sudo[2814898]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 07:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:49 nativespace-cdp sudo[2814902]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 07:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:49 nativespace-cdp sudo[2814905]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 07:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:49 nativespace-cdp sudo[2814908]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 07:10:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:10:57 nativespace-cdp sudo[2814929]: pam_unix(sudo:session): session closed for user root
Sep  6 07:10:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 07:10:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:11:01 nativespace-cdp sudo[2814934]: pam_unix(sudo:session): session closed for user root
Sep  6 07:11:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hubmaster user-2=putterfi user-3=fetch user-4=carsinyo user-5=gilpin user-6=milloyco user-7=elecleis user-8=connectedshoppin user-9=thqkgnbz user-10=accooper user-11=ianrayne user-12=opaiscyx user-13=coursemc user-14=ultbcrra user-15=jonhartl user-16=seftvta user-17=firstres user-18=firstred user-19=highlegh user-20=southlon user-21=clarkass user-22=firstrel user-23=costestimatorco user-24=skyfirec user-25=alexadmin user-26=nativene user-27=innovat1 user-28=askhform user-29=stuartge user-30=vivienn1 user-31=firstre2 user-32=oneoarco user-33=battlere user-34=nstriton user-35=brighto1 user-36=newstoda user-37=belle user-38=ggaaorgu user-39=bemadonn user-40=bedfords user-41=spectrum user-42=hodgesonweb user-43=theblack user-44=jarvisin user-45=stephani user-46=leereyn1 user-47=agproduc
Sep  6 07:11:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=still user-49=vantagep user-50=athenare user-51=connect9 user-52=lbscrmod user-53=maflemin user-54=markward user-55=booff user-56=foundation user-57=ulsukarm user-58=dickemery123 user-59=ptkxhsbt user-60=martsblo user-61=magichat user-62=hhdugcor user-63=lbhyisi user-64=strathar user-65=atestord user-66=sarafoundation user-67=lakesan1 user-68=brmrjxl user-69=megacards user-70=musorguk user-71=wilsonsw user-72=onlycont user-73=lucy user-74=attlebor user-75=romaldki user-76=hodgsonmail user-77=ranxterc user-78=outdoorc user-79=branko user-80=jennimil user-81=tomandle user-82=david user-83=nbhavers user-84=careers user-85=chrisdal user-86=mcdermos user-87=havantho user-88=sketchy user-89=cath user-90=nvihkvu user-91=oubpgvbx user-92=tstardom user-93=what user-94=design user-95=dancinggardener user-96=stagingerris user-97=ladburyp user-98=kategilpin user-99=boldover user-100=nove user-101=bakery
Sep  6 07:11:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=crrtipdl user-103=sosevalu user-104=nsceres user-105=fawcettd user-106=burydropin user-107=dhyana user-108=beauty user-109=darkstar user-110=eatspam user-111=sibtoncc user-112=asandcoc user-113=steve user-114=bwppodcast user-115=zebrapho user-116=cwsocial user-117=paulmca1 user-118=pugwash user-119=howardon user-120=cathski user-121=cambria1 user-122=ninejimm user-123=reliable user-124=eugincou user-125=courseme user-126=hirefootballgame user-127=lkpier user-128=donnychicago user-129=firstre5 user-130=steakbridieme user-131=ctedorgu user-132=philmcph user-133=nscdp user-134=putterfc user-135=leftie user-136=foods user-137=fortunaz user-138=health2045 user-139=nomistakes user-140=hidden user-141=barbersh user-142=tigerlet user-143=isleofwi user-144=smrszyqg feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  6 07:11:01 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 07:11:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:11:04 nativespace-cdp sudo[2814950]: pam_unix(sudo:session): session closed for user root
Sep  6 07:11:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 07:11:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:11:06 nativespace-cdp sudo[2815026]: pam_unix(sudo:session): session closed for user root
Sep  6 07:11:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aGH0litZ3taF6ZJZ.~
Sep  6 07:11:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:11:06 nativespace-cdp sudo[2815037]: pam_unix(sudo:session): session closed for user root
Sep  6 07:11:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aGH0litZ3taF6ZJZ.~'
Sep  6 07:11:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:11:06 nativespace-cdp sudo[2815040]: pam_unix(sudo:session): session closed for user root
Sep  6 07:11:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aGH0litZ3taF6ZJZ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 07:11:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:11:06 nativespace-cdp sudo[2815045]: pam_unix(sudo:session): session closed for user root
Sep  6 07:11:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 07:11:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:11:06 nativespace-cdp sudo[2815051]: pam_unix(sudo:session): session closed for user root
Sep  6 07:11:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 07:11:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 07:11:13 nativespace-cdp sudo[2815140]: pam_unix(sudo:session): session closed for user root
Sep  6 07:11:34 nativespace-cdp sshd[2815192]: Connection closed by 159.100.136.21 port 33210 [preauth]
Sep  6 07:12:37 nativespace-cdp sshd[2815390]: Invalid user ict from 182.93.50.90 port 48126
Sep  6 07:12:37 nativespace-cdp sshd[2815390]: input_userauth_request: invalid user ict [preauth]
Sep  6 07:12:37 nativespace-cdp sshd[2815390]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:12:37 nativespace-cdp sshd[2815390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.93.50.90
Sep  6 07:12:40 nativespace-cdp sshd[2815390]: Failed password for invalid user ict from 182.93.50.90 port 48126 ssh2
Sep  6 07:12:40 nativespace-cdp sshd[2815390]: Received disconnect from 182.93.50.90 port 48126:11: Bye Bye [preauth]
Sep  6 07:12:40 nativespace-cdp sshd[2815390]: Disconnected from 182.93.50.90 port 48126 [preauth]
Sep  6 07:13:54 nativespace-cdp sshd[2815637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.93.50.90  user=root
Sep  6 07:13:54 nativespace-cdp sshd[2815637]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:13:55 nativespace-cdp sshd[2815637]: Failed password for root from 182.93.50.90 port 51994 ssh2
Sep  6 07:13:56 nativespace-cdp sshd[2815637]: Received disconnect from 182.93.50.90 port 51994:11: Bye Bye [preauth]
Sep  6 07:13:56 nativespace-cdp sshd[2815637]: Disconnected from 182.93.50.90 port 51994 [preauth]
Sep  6 07:16:33 nativespace-cdp sshd[2816436]: Connection closed by 159.100.136.21 port 42118 [preauth]
Sep  6 07:21:33 nativespace-cdp sshd[2817515]: Connection closed by 159.100.136.21 port 51646 [preauth]
Sep  6 07:26:37 nativespace-cdp sshd[2818934]: Connection closed by 159.100.136.21 port 59112 [preauth]
Sep  6 07:31:34 nativespace-cdp sshd[2820129]: Connection closed by 159.100.136.21 port 39560 [preauth]
Sep  6 07:36:36 nativespace-cdp sshd[2821076]: Connection closed by 159.100.136.21 port 48910 [preauth]
Sep  6 07:39:19 nativespace-cdp sshd[2821563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.88.196.117  user=root
Sep  6 07:39:19 nativespace-cdp sshd[2821563]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:39:21 nativespace-cdp sshd[2821563]: Failed password for root from 81.88.196.117 port 52230 ssh2
Sep  6 07:39:21 nativespace-cdp sshd[2821563]: Received disconnect from 81.88.196.117 port 52230:11: Bye Bye [preauth]
Sep  6 07:39:21 nativespace-cdp sshd[2821563]: Disconnected from 81.88.196.117 port 52230 [preauth]
Sep  6 07:40:40 nativespace-cdp sshd[2822014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.99.254.55  user=root
Sep  6 07:40:40 nativespace-cdp sshd[2822014]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:40:42 nativespace-cdp sshd[2822014]: Failed password for root from 140.99.254.55 port 33530 ssh2
Sep  6 07:40:42 nativespace-cdp sshd[2822014]: Received disconnect from 140.99.254.55 port 33530:11: Bye Bye [preauth]
Sep  6 07:40:42 nativespace-cdp sshd[2822014]: Disconnected from 140.99.254.55 port 33530 [preauth]
Sep  6 07:41:16 nativespace-cdp sshd[2822170]: Invalid user umberto from 165.154.20.68 port 20818
Sep  6 07:41:16 nativespace-cdp sshd[2822170]: input_userauth_request: invalid user umberto [preauth]
Sep  6 07:41:16 nativespace-cdp sshd[2822170]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:41:16 nativespace-cdp sshd[2822170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.20.68
Sep  6 07:41:18 nativespace-cdp sshd[2822170]: Failed password for invalid user umberto from 165.154.20.68 port 20818 ssh2
Sep  6 07:41:27 nativespace-cdp sshd[2822170]: Received disconnect from 165.154.20.68 port 20818:11: Bye Bye [preauth]
Sep  6 07:41:27 nativespace-cdp sshd[2822170]: Disconnected from 165.154.20.68 port 20818 [preauth]
Sep  6 07:41:33 nativespace-cdp sshd[2822291]: Invalid user user from 168.167.228.74 port 17047
Sep  6 07:41:33 nativespace-cdp sshd[2822291]: input_userauth_request: invalid user user [preauth]
Sep  6 07:41:33 nativespace-cdp sshd[2822291]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:41:33 nativespace-cdp sshd[2822291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.167.228.74
Sep  6 07:41:33 nativespace-cdp sshd[2822295]: Connection closed by 159.100.136.21 port 57578 [preauth]
Sep  6 07:41:35 nativespace-cdp sshd[2822291]: Failed password for invalid user user from 168.167.228.74 port 17047 ssh2
Sep  6 07:41:35 nativespace-cdp sshd[2822291]: Received disconnect from 168.167.228.74 port 17047:11: Bye Bye [preauth]
Sep  6 07:41:35 nativespace-cdp sshd[2822291]: Disconnected from 168.167.228.74 port 17047 [preauth]
Sep  6 07:43:50 nativespace-cdp sshd[2823041]: Invalid user tiewenbin from 103.181.143.24 port 49776
Sep  6 07:43:50 nativespace-cdp sshd[2823041]: input_userauth_request: invalid user tiewenbin [preauth]
Sep  6 07:43:50 nativespace-cdp sshd[2823041]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:43:50 nativespace-cdp sshd[2823041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.143.24
Sep  6 07:43:53 nativespace-cdp sshd[2823041]: Failed password for invalid user tiewenbin from 103.181.143.24 port 49776 ssh2
Sep  6 07:43:53 nativespace-cdp sshd[2823041]: Received disconnect from 103.181.143.24 port 49776:11: Bye Bye [preauth]
Sep  6 07:43:53 nativespace-cdp sshd[2823041]: Disconnected from 103.181.143.24 port 49776 [preauth]
Sep  6 07:44:53 nativespace-cdp sshd[2823192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.225.160.190  user=root
Sep  6 07:44:53 nativespace-cdp sshd[2823192]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:44:54 nativespace-cdp sshd[2823192]: Failed password for root from 60.225.160.190 port 51848 ssh2
Sep  6 07:44:55 nativespace-cdp sshd[2823192]: Received disconnect from 60.225.160.190 port 51848:11: Bye Bye [preauth]
Sep  6 07:44:55 nativespace-cdp sshd[2823192]: Disconnected from 60.225.160.190 port 51848 [preauth]
Sep  6 07:46:33 nativespace-cdp sshd[2823680]: Connection closed by 159.100.136.21 port 38066 [preauth]
Sep  6 07:47:05 nativespace-cdp sshd[2823759]: Invalid user julian from 81.88.196.117 port 33458
Sep  6 07:47:05 nativespace-cdp sshd[2823759]: input_userauth_request: invalid user julian [preauth]
Sep  6 07:47:05 nativespace-cdp sshd[2823759]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:47:05 nativespace-cdp sshd[2823759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.88.196.117
Sep  6 07:47:07 nativespace-cdp sshd[2823759]: Failed password for invalid user julian from 81.88.196.117 port 33458 ssh2
Sep  6 07:47:07 nativespace-cdp sshd[2823759]: Received disconnect from 81.88.196.117 port 33458:11: Bye Bye [preauth]
Sep  6 07:47:07 nativespace-cdp sshd[2823759]: Disconnected from 81.88.196.117 port 33458 [preauth]
Sep  6 07:47:42 nativespace-cdp sshd[2823843]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.29.85.13  user=root
Sep  6 07:47:42 nativespace-cdp sshd[2823843]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:47:44 nativespace-cdp sshd[2823843]: Failed password for root from 103.29.85.13 port 34860 ssh2
Sep  6 07:47:45 nativespace-cdp sshd[2823843]: Received disconnect from 103.29.85.13 port 34860:11: Bye Bye [preauth]
Sep  6 07:47:45 nativespace-cdp sshd[2823843]: Disconnected from 103.29.85.13 port 34860 [preauth]
Sep  6 07:47:55 nativespace-cdp sshd[2823889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.88.196.117  user=root
Sep  6 07:47:55 nativespace-cdp sshd[2823889]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:47:56 nativespace-cdp sshd[2823889]: Failed password for root from 81.88.196.117 port 59712 ssh2
Sep  6 07:48:32 nativespace-cdp sshd[2823996]: Connection closed by 165.154.20.68 port 18370 [preauth]
Sep  6 07:48:46 nativespace-cdp sshd[2824041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.167.228.74  user=root
Sep  6 07:48:46 nativespace-cdp sshd[2824041]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:48:48 nativespace-cdp sshd[2824041]: Failed password for root from 168.167.228.74 port 17048 ssh2
Sep  6 07:48:48 nativespace-cdp sshd[2824041]: Received disconnect from 168.167.228.74 port 17048:11: Bye Bye [preauth]
Sep  6 07:48:48 nativespace-cdp sshd[2824041]: Disconnected from 168.167.228.74 port 17048 [preauth]
Sep  6 07:49:13 nativespace-cdp sshd[2824110]: Invalid user hongli from 103.29.85.13 port 36810
Sep  6 07:49:13 nativespace-cdp sshd[2824110]: input_userauth_request: invalid user hongli [preauth]
Sep  6 07:49:13 nativespace-cdp sshd[2824110]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:49:13 nativespace-cdp sshd[2824110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.29.85.13
Sep  6 07:49:15 nativespace-cdp sshd[2824121]: Invalid user ryus from 60.225.160.190 port 39136
Sep  6 07:49:15 nativespace-cdp sshd[2824121]: input_userauth_request: invalid user ryus [preauth]
Sep  6 07:49:15 nativespace-cdp sshd[2824121]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:49:15 nativespace-cdp sshd[2824121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.225.160.190
Sep  6 07:49:16 nativespace-cdp sshd[2824110]: Failed password for invalid user hongli from 103.29.85.13 port 36810 ssh2
Sep  6 07:49:16 nativespace-cdp sshd[2824110]: Received disconnect from 103.29.85.13 port 36810:11: Bye Bye [preauth]
Sep  6 07:49:16 nativespace-cdp sshd[2824110]: Disconnected from 103.29.85.13 port 36810 [preauth]
Sep  6 07:49:17 nativespace-cdp sshd[2824121]: Failed password for invalid user ryus from 60.225.160.190 port 39136 ssh2
Sep  6 07:49:18 nativespace-cdp sshd[2824134]: Invalid user openfire from 165.154.20.68 port 31582
Sep  6 07:49:18 nativespace-cdp sshd[2824134]: input_userauth_request: invalid user openfire [preauth]
Sep  6 07:49:18 nativespace-cdp sshd[2824134]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:49:18 nativespace-cdp sshd[2824134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.20.68
Sep  6 07:49:18 nativespace-cdp sshd[2824121]: Received disconnect from 60.225.160.190 port 39136:11: Bye Bye [preauth]
Sep  6 07:49:18 nativespace-cdp sshd[2824121]: Disconnected from 60.225.160.190 port 39136 [preauth]
Sep  6 07:49:20 nativespace-cdp sshd[2824134]: Failed password for invalid user openfire from 165.154.20.68 port 31582 ssh2
Sep  6 07:49:22 nativespace-cdp sshd[2824134]: Received disconnect from 165.154.20.68 port 31582:11: Bye Bye [preauth]
Sep  6 07:49:22 nativespace-cdp sshd[2824134]: Disconnected from 165.154.20.68 port 31582 [preauth]
Sep  6 07:49:37 nativespace-cdp sshd[2824184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.167.228.74  user=root
Sep  6 07:49:37 nativespace-cdp sshd[2824184]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:49:39 nativespace-cdp sshd[2824184]: Failed password for root from 168.167.228.74 port 17049 ssh2
Sep  6 07:49:39 nativespace-cdp sshd[2824184]: Received disconnect from 168.167.228.74 port 17049:11: Bye Bye [preauth]
Sep  6 07:49:39 nativespace-cdp sshd[2824184]: Disconnected from 168.167.228.74 port 17049 [preauth]
Sep  6 07:50:09 nativespace-cdp sshd[2824374]: Invalid user hongwei from 103.29.85.13 port 37266
Sep  6 07:50:09 nativespace-cdp sshd[2824374]: input_userauth_request: invalid user hongwei [preauth]
Sep  6 07:50:09 nativespace-cdp sshd[2824374]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:50:09 nativespace-cdp sshd[2824374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.29.85.13
Sep  6 07:50:10 nativespace-cdp sshd[2824374]: Failed password for invalid user hongwei from 103.29.85.13 port 37266 ssh2
Sep  6 07:50:12 nativespace-cdp sshd[2824413]: Invalid user xzj from 165.154.20.68 port 44796
Sep  6 07:50:12 nativespace-cdp sshd[2824413]: input_userauth_request: invalid user xzj [preauth]
Sep  6 07:50:12 nativespace-cdp sshd[2824413]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:50:12 nativespace-cdp sshd[2824413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.20.68
Sep  6 07:50:13 nativespace-cdp sshd[2824421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.225.160.190  user=root
Sep  6 07:50:13 nativespace-cdp sshd[2824421]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:50:14 nativespace-cdp sshd[2824413]: Failed password for invalid user xzj from 165.154.20.68 port 44796 ssh2
Sep  6 07:50:14 nativespace-cdp sshd[2824413]: Received disconnect from 165.154.20.68 port 44796:11: Bye Bye [preauth]
Sep  6 07:50:14 nativespace-cdp sshd[2824413]: Disconnected from 165.154.20.68 port 44796 [preauth]
Sep  6 07:50:15 nativespace-cdp sshd[2824421]: Failed password for root from 60.225.160.190 port 55172 ssh2
Sep  6 07:50:15 nativespace-cdp sshd[2824421]: Received disconnect from 60.225.160.190 port 55172:11: Bye Bye [preauth]
Sep  6 07:50:15 nativespace-cdp sshd[2824421]: Disconnected from 60.225.160.190 port 55172 [preauth]
Sep  6 07:50:38 nativespace-cdp sshd[2824604]: Invalid user weiwei from 103.181.143.24 port 37710
Sep  6 07:50:38 nativespace-cdp sshd[2824604]: input_userauth_request: invalid user weiwei [preauth]
Sep  6 07:50:38 nativespace-cdp sshd[2824604]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:50:38 nativespace-cdp sshd[2824604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.143.24
Sep  6 07:50:41 nativespace-cdp sshd[2824604]: Failed password for invalid user weiwei from 103.181.143.24 port 37710 ssh2
Sep  6 07:50:43 nativespace-cdp sshd[2824604]: Received disconnect from 103.181.143.24 port 37710:11: Bye Bye [preauth]
Sep  6 07:50:43 nativespace-cdp sshd[2824604]: Disconnected from 103.181.143.24 port 37710 [preauth]
Sep  6 07:51:35 nativespace-cdp sshd[2824860]: Connection closed by 159.100.136.21 port 46474 [preauth]
Sep  6 07:51:40 nativespace-cdp sshd[2824847]: Received disconnect from 140.99.254.55 port 39726:11: Bye Bye [preauth]
Sep  6 07:51:40 nativespace-cdp sshd[2824847]: Disconnected from 140.99.254.55 port 39726 [preauth]
Sep  6 07:51:40 nativespace-cdp sshd[2824845]: Invalid user openfire from 103.181.143.24 port 51008
Sep  6 07:51:40 nativespace-cdp sshd[2824845]: input_userauth_request: invalid user openfire [preauth]
Sep  6 07:51:40 nativespace-cdp sshd[2824845]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:51:40 nativespace-cdp sshd[2824845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.143.24
Sep  6 07:51:42 nativespace-cdp sshd[2824845]: Failed password for invalid user openfire from 103.181.143.24 port 51008 ssh2
Sep  6 07:51:42 nativespace-cdp sshd[2824845]: Received disconnect from 103.181.143.24 port 51008:11: Bye Bye [preauth]
Sep  6 07:51:42 nativespace-cdp sshd[2824845]: Disconnected from 103.181.143.24 port 51008 [preauth]
Sep  6 07:51:48 nativespace-cdp sshd[2824885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.99.254.55  user=root
Sep  6 07:51:48 nativespace-cdp sshd[2824885]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 07:51:50 nativespace-cdp sshd[2824885]: Failed password for root from 140.99.254.55 port 35764 ssh2
Sep  6 07:51:50 nativespace-cdp sshd[2824885]: Received disconnect from 140.99.254.55 port 35764:11: Bye Bye [preauth]
Sep  6 07:51:50 nativespace-cdp sshd[2824885]: Disconnected from 140.99.254.55 port 35764 [preauth]
Sep  6 07:51:53 nativespace-cdp sshd[2824938]: Invalid user upload from 140.99.254.55 port 55850
Sep  6 07:51:53 nativespace-cdp sshd[2824938]: input_userauth_request: invalid user upload [preauth]
Sep  6 07:51:53 nativespace-cdp sshd[2824938]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 07:51:53 nativespace-cdp sshd[2824938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.99.254.55
Sep  6 07:51:54 nativespace-cdp sshd[2824938]: Failed password for invalid user upload from 140.99.254.55 port 55850 ssh2
Sep  6 07:51:54 nativespace-cdp sshd[2824938]: Received disconnect from 140.99.254.55 port 55850:11: Bye Bye [preauth]
Sep  6 07:51:54 nativespace-cdp sshd[2824938]: Disconnected from 140.99.254.55 port 55850 [preauth]
Sep  6 07:56:33 nativespace-cdp sshd[2825882]: Connection closed by 159.100.136.21 port 55556 [preauth]
Sep  6 08:01:33 nativespace-cdp sshd[2827113]: Connection closed by 159.100.136.21 port 35788 [preauth]
Sep  6 08:06:33 nativespace-cdp sshd[2828835]: Connection closed by 159.100.136.21 port 45730 [preauth]
Sep  6 08:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 08:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:14 nativespace-cdp sudo[2829711]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 08:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:14 nativespace-cdp sudo[2829724]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 08:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:17 nativespace-cdp sudo[2829728]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 08:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:17 nativespace-cdp sudo[2829796]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 08:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:22 nativespace-cdp sudo[2829806]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 08:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:22 nativespace-cdp sudo[2829867]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 08:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:22 nativespace-cdp sudo[2829870]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 08:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:22 nativespace-cdp sudo[2829873]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 08:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:22 nativespace-cdp sudo[2829877]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 08:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:22 nativespace-cdp sudo[2829880]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 08:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:22 nativespace-cdp sudo[2829883]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 08:10:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:29 nativespace-cdp sudo[2829908]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 08:10:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:35 nativespace-cdp sudo[2829912]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=boldover user-2=nove user-3=crrtipdl user-4=sosevalu user-5=bakery user-6=nvihkvu user-7=havantho user-8=sketchy user-9=cath user-10=what user-11=tstardom user-12=oubpgvbx user-13=design user-14=kategilpin user-15=dancinggardener user-16=stagingerris user-17=ladburyp user-18=jennimil user-19=tomandle user-20=david user-21=careers user-22=nbhavers user-23=mcdermos user-24=chrisdal user-25=onlycont user-26=lucy user-27=attlebor user-28=romaldki user-29=branko user-30=ranxterc user-31=hodgsonmail user-32=outdoorc user-33=firstre5 user-34=donnychicago user-35=steakbridieme user-36=philmcph user-37=ctedorgu user-38=lkpier user-39=foods user-40=leftie user-41=fortunaz user-42=health2045 user-43=nscdp user-44=putterfc user-45=tigerlet user-46=barbersh user-47=nomistakes user-48=hidden user-49=isleofwi
Sep  6 08:10:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=smrszyqg user-51=cwsocial user-52=paulmca1 user-53=howardon user-54=pugwash user-55=reliable user-56=ninejimm user-57=cambria1 user-58=cathski user-59=courseme user-60=eugincou user-61=hirefootballgame user-62=asandcoc user-63=sibtoncc user-64=steve user-65=zebrapho user-66=bwppodcast user-67=nsceres user-68=fawcettd user-69=burydropin user-70=dhyana user-71=darkstar user-72=eatspam user-73=beauty user-74=oneoarco user-75=battlere user-76=vivienn1 user-77=firstre2 user-78=nstriton user-79=brighto1 user-80=bemadonn user-81=newstoda user-82=ggaaorgu user-83=belle user-84=bedfords user-85=alexadmin user-86=skyfirec user-87=nativene user-88=askhform user-89=stuartge user-90=innovat1 user-91=opaiscyx user-92=coursemc user-93=firstres user-94=ultbcrra user-95=seftvta user-96=jonhartl user-97=highlegh user-98=southlon user-99=firstred user-100=costestimatorco user-101=clarkass user-102=firstrel user-103=fetch
Sep  6 08:10:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=carsinyo user-105=putterfi user-106=hubmaster user-107=elecleis user-108=gilpin user-109=milloyco user-110=thqkgnbz user-111=connectedshoppin user-112=ianrayne user-113=accooper user-114=atestord user-115=sarafoundation user-116=strathar user-117=lakesan1 user-118=brmrjxl user-119=megacards user-120=musorguk user-121=wilsonsw user-122=ptkxhsbt user-123=dickemery123 user-124=martsblo user-125=magichat user-126=hhdugcor user-127=lbhyisi user-128=lbscrmod user-129=maflemin user-130=vantagep user-131=connect9 user-132=athenare user-133=booff user-134=markward user-135=foundation user-136=ulsukarm user-137=hodgesonweb user-138=theblack user-139=spectrum user-140=jarvisin user-141=leereyn1 user-142=stephani user-143=agproduc user-144=still feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 08:10:35 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 08:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:37 nativespace-cdp sudo[2829923]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 08:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:37 nativespace-cdp sudo[2829929]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NH1IYaYMTPfI7Avb.~
Sep  6 08:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:37 nativespace-cdp sudo[2829933]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NH1IYaYMTPfI7Avb.~'
Sep  6 08:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:38 nativespace-cdp sudo[2829936]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NH1IYaYMTPfI7Avb.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 08:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:38 nativespace-cdp sudo[2829940]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 08:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:38 nativespace-cdp sudo[2829943]: pam_unix(sudo:session): session closed for user root
Sep  6 08:10:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 08:10:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 08:10:51 nativespace-cdp sudo[2829993]: pam_unix(sudo:session): session closed for user root
Sep  6 08:11:34 nativespace-cdp sshd[2830306]: Connection closed by 159.100.136.21 port 54694 [preauth]
Sep  6 08:16:34 nativespace-cdp sshd[2831740]: Connection closed by 159.100.136.21 port 35574 [preauth]
Sep  6 08:21:34 nativespace-cdp sshd[2832822]: Connection closed by 159.100.136.21 port 45150 [preauth]
Sep  6 08:26:35 nativespace-cdp sshd[2834218]: Connection closed by 159.100.136.21 port 54804 [preauth]
Sep  6 08:31:37 nativespace-cdp sshd[2835538]: Connection closed by 159.100.136.21 port 35118 [preauth]
Sep  6 08:36:35 nativespace-cdp sshd[2837397]: Connection closed by 159.100.136.21 port 43632 [preauth]
Sep  6 08:39:09 nativespace-cdp sshd[2839398]: Invalid user scp from 117.102.67.66 port 58218
Sep  6 08:39:09 nativespace-cdp sshd[2839398]: input_userauth_request: invalid user scp [preauth]
Sep  6 08:39:10 nativespace-cdp sshd[2839398]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 08:39:10 nativespace-cdp sshd[2839398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.102.67.66
Sep  6 08:39:12 nativespace-cdp sshd[2839398]: Failed password for invalid user scp from 117.102.67.66 port 58218 ssh2
Sep  6 08:39:12 nativespace-cdp sshd[2839398]: Received disconnect from 117.102.67.66 port 58218:11: Bye Bye [preauth]
Sep  6 08:39:12 nativespace-cdp sshd[2839398]: Disconnected from 117.102.67.66 port 58218 [preauth]
Sep  6 08:41:34 nativespace-cdp sshd[2840512]: Connection closed by 159.100.136.21 port 52310 [preauth]
Sep  6 08:45:40 nativespace-cdp sshd[2841460]: Invalid user qwerty from 117.102.67.66 port 48420
Sep  6 08:45:40 nativespace-cdp sshd[2841460]: input_userauth_request: invalid user qwerty [preauth]
Sep  6 08:45:41 nativespace-cdp sshd[2841460]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 08:45:41 nativespace-cdp sshd[2841460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.102.67.66
Sep  6 08:45:43 nativespace-cdp sshd[2841460]: Failed password for invalid user qwerty from 117.102.67.66 port 48420 ssh2
Sep  6 08:45:52 nativespace-cdp sshd[2841460]: Received disconnect from 117.102.67.66 port 48420:11: Bye Bye [preauth]
Sep  6 08:45:52 nativespace-cdp sshd[2841460]: Disconnected from 117.102.67.66 port 48420 [preauth]
Sep  6 08:46:14 nativespace-cdp sshd[2841616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.65.57.52  user=root
Sep  6 08:46:14 nativespace-cdp sshd[2841616]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 08:46:17 nativespace-cdp sshd[2841616]: Failed password for root from 27.65.57.52 port 54566 ssh2
Sep  6 08:46:17 nativespace-cdp sshd[2841616]: Received disconnect from 27.65.57.52 port 54566:11: Bye Bye [preauth]
Sep  6 08:46:17 nativespace-cdp sshd[2841616]: Disconnected from 27.65.57.52 port 54566 [preauth]
Sep  6 08:46:29 nativespace-cdp sshd[2841654]: Invalid user tan from 117.102.67.66 port 53500
Sep  6 08:46:29 nativespace-cdp sshd[2841654]: input_userauth_request: invalid user tan [preauth]
Sep  6 08:46:29 nativespace-cdp sshd[2841654]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 08:46:29 nativespace-cdp sshd[2841654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.102.67.66
Sep  6 08:46:32 nativespace-cdp sshd[2841654]: Failed password for invalid user tan from 117.102.67.66 port 53500 ssh2
Sep  6 08:46:32 nativespace-cdp sshd[2841654]: Received disconnect from 117.102.67.66 port 53500:11: Bye Bye [preauth]
Sep  6 08:46:32 nativespace-cdp sshd[2841654]: Disconnected from 117.102.67.66 port 53500 [preauth]
Sep  6 08:46:33 nativespace-cdp sshd[2841695]: Connection closed by 159.100.136.21 port 33396 [preauth]
Sep  6 08:49:37 nativespace-cdp sshd[2842373]: Invalid user backup from 27.65.57.52 port 56280
Sep  6 08:49:37 nativespace-cdp sshd[2842373]: input_userauth_request: invalid user backup [preauth]
Sep  6 08:49:37 nativespace-cdp sshd[2842373]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 08:49:37 nativespace-cdp sshd[2842373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.65.57.52
Sep  6 08:49:39 nativespace-cdp sshd[2842373]: Failed password for invalid user backup from 27.65.57.52 port 56280 ssh2
Sep  6 08:49:40 nativespace-cdp sshd[2842373]: Received disconnect from 27.65.57.52 port 56280:11: Bye Bye [preauth]
Sep  6 08:49:40 nativespace-cdp sshd[2842373]: Disconnected from 27.65.57.52 port 56280 [preauth]
Sep  6 08:51:00 nativespace-cdp sshd[2842729]: Connection closed by 27.65.57.52 port 40304 [preauth]
Sep  6 08:51:34 nativespace-cdp sshd[2842840]: Connection closed by 159.100.136.21 port 42516 [preauth]
Sep  6 08:53:33 nativespace-cdp sshd[2843302]: Invalid user noo from 27.65.57.52 port 36600
Sep  6 08:53:33 nativespace-cdp sshd[2843302]: input_userauth_request: invalid user noo [preauth]
Sep  6 08:53:34 nativespace-cdp sshd[2843302]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 08:53:34 nativespace-cdp sshd[2843302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.65.57.52
Sep  6 08:53:35 nativespace-cdp sshd[2843302]: Failed password for invalid user noo from 27.65.57.52 port 36600 ssh2
Sep  6 08:53:35 nativespace-cdp sshd[2843302]: Received disconnect from 27.65.57.52 port 36600:11: Bye Bye [preauth]
Sep  6 08:53:35 nativespace-cdp sshd[2843302]: Disconnected from 27.65.57.52 port 36600 [preauth]
Sep  6 08:56:33 nativespace-cdp sshd[2843993]: Connection closed by 159.100.136.21 port 52212 [preauth]
Sep  6 09:01:33 nativespace-cdp sshd[2845390]: Connection closed by 159.100.136.21 port 33312 [preauth]
Sep  6 09:06:35 nativespace-cdp sshd[2846861]: Connection closed by 159.100.136.21 port 42876 [preauth]
Sep  6 09:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 09:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:36 nativespace-cdp sudo[2848347]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 09:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:36 nativespace-cdp sudo[2848351]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 09:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:39 nativespace-cdp sudo[2848355]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 09:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:40 nativespace-cdp sudo[2848418]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 09:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:55 nativespace-cdp sudo[2848421]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 09:10:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:56 nativespace-cdp sudo[2848462]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 09:10:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:56 nativespace-cdp sudo[2848465]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 09:10:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:56 nativespace-cdp sudo[2848468]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 09:10:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:56 nativespace-cdp sudo[2848471]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 09:10:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:56 nativespace-cdp sudo[2848474]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 09:10:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:56 nativespace-cdp sudo[2848477]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 09:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:10:59 nativespace-cdp sudo[2848501]: pam_unix(sudo:session): session closed for user root
Sep  6 09:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 09:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:11:05 nativespace-cdp sudo[2848506]: pam_unix(sudo:session): session closed for user root
Sep  6 09:11:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nove user-2=boldover user-3=sosevalu user-4=crrtipdl user-5=bakery user-6=what user-7=oubpgvbx user-8=tstardom user-9=nvihkvu user-10=sketchy user-11=cath user-12=havantho user-13=kategilpin user-14=ladburyp user-15=dancinggardener user-16=stagingerris user-17=design user-18=tomandle user-19=jennimil user-20=mcdermos user-21=chrisdal user-22=careers user-23=nbhavers user-24=david user-25=attlebor user-26=lucy user-27=onlycont user-28=branko user-29=outdoorc user-30=ranxterc user-31=hodgsonmail user-32=romaldki user-33=health2045 user-34=fortunaz user-35=leftie user-36=foods user-37=putterfc user-38=nscdp user-39=ctedorgu user-40=philmcph user-41=steakbridieme user-42=firstre5 user-43=donnychicago user-44=lkpier user-45=smrszyqg user-46=isleofwi user-47=tigerlet user-48=barbersh user-49=hidden
Sep  6 09:11:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=nomistakes user-51=ninejimm user-52=reliable user-53=cambria1 user-54=cathski user-55=paulmca1 user-56=howardon user-57=pugwash user-58=cwsocial user-59=hirefootballgame user-60=courseme user-61=eugincou user-62=asandcoc user-63=sibtoncc user-64=zebrapho user-65=bwppodcast user-66=steve user-67=burydropin user-68=fawcettd user-69=nsceres user-70=eatspam user-71=darkstar user-72=beauty user-73=dhyana user-74=brighto1 user-75=nstriton user-76=battlere user-77=oneoarco user-78=firstre2 user-79=vivienn1 user-80=bedfords user-81=bemadonn user-82=belle user-83=ggaaorgu user-84=newstoda user-85=alexadmin user-86=skyfirec user-87=askhform user-88=stuartge user-89=innovat1 user-90=nativene user-91=firstres user-92=jonhartl user-93=seftvta user-94=ultbcrra user-95=coursemc user-96=opaiscyx user-97=costestimatorco user-98=firstrel user-99=clarkass user-100=southlon user-101=highlegh user-102=firstred
Sep  6 09:11:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=elecleis user-104=gilpin user-105=milloyco user-106=carsinyo user-107=fetch user-108=putterfi user-109=hubmaster user-110=ianrayne user-111=accooper user-112=thqkgnbz user-113=connectedshoppin user-114=lakesan1 user-115=brmrjxl user-116=sarafoundation user-117=atestord user-118=strathar user-119=wilsonsw user-120=musorguk user-121=megacards user-122=martsblo user-123=ptkxhsbt user-124=dickemery123 user-125=lbhyisi user-126=hhdugcor user-127=magichat user-128=foundation user-129=booff user-130=markward user-131=maflemin user-132=lbscrmod user-133=athenare user-134=connect9 user-135=vantagep user-136=ulsukarm user-137=jarvisin user-138=hodgesonweb user-139=theblack user-140=spectrum user-141=still user-142=agproduc user-143=leereyn1 user-144=stephani feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 09:11:05 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 09:11:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:11:08 nativespace-cdp sudo[2848538]: pam_unix(sudo:session): session closed for user root
Sep  6 09:11:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 09:11:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:11:09 nativespace-cdp sudo[2848560]: pam_unix(sudo:session): session closed for user root
Sep  6 09:11:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Fi00JwQyQBgjy1Jv.~
Sep  6 09:11:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:11:09 nativespace-cdp sudo[2848564]: pam_unix(sudo:session): session closed for user root
Sep  6 09:11:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Fi00JwQyQBgjy1Jv.~'
Sep  6 09:11:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:11:09 nativespace-cdp sudo[2848568]: pam_unix(sudo:session): session closed for user root
Sep  6 09:11:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Fi00JwQyQBgjy1Jv.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 09:11:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:11:09 nativespace-cdp sudo[2848572]: pam_unix(sudo:session): session closed for user root
Sep  6 09:11:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 09:11:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:11:09 nativespace-cdp sudo[2848575]: pam_unix(sudo:session): session closed for user root
Sep  6 09:11:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 09:11:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 09:11:29 nativespace-cdp sudo[2848642]: pam_unix(sudo:session): session closed for user root
Sep  6 09:11:34 nativespace-cdp sshd[2848666]: Connection closed by 159.100.136.21 port 51420 [preauth]
Sep  6 09:16:34 nativespace-cdp sshd[2849909]: Connection closed by 159.100.136.21 port 60406 [preauth]
Sep  6 09:21:37 nativespace-cdp sshd[2851019]: Connection closed by 159.100.136.21 port 41584 [preauth]
Sep  6 09:26:36 nativespace-cdp sshd[2852404]: Connection closed by 159.100.136.21 port 50964 [preauth]
Sep  6 09:31:36 nativespace-cdp sshd[2853823]: Connection closed by 159.100.136.21 port 60462 [preauth]
Sep  6 09:36:34 nativespace-cdp sshd[2855075]: Connection closed by 159.100.136.21 port 41854 [preauth]
Sep  6 09:41:33 nativespace-cdp sshd[2856313]: Connection closed by 159.100.136.21 port 50984 [preauth]
Sep  6 09:46:34 nativespace-cdp sshd[2858000]: Connection closed by 159.100.136.21 port 60622 [preauth]
Sep  6 09:51:33 nativespace-cdp sshd[2859095]: Connection closed by 159.100.136.21 port 41670 [preauth]
Sep  6 09:56:33 nativespace-cdp sshd[2860364]: Connection closed by 159.100.136.21 port 49632 [preauth]
Sep  6 10:01:35 nativespace-cdp sshd[2861869]: Connection closed by 159.100.136.21 port 58712 [preauth]
Sep  6 10:06:35 nativespace-cdp sshd[2863486]: Connection closed by 159.100.136.21 port 40116 [preauth]
Sep  6 10:11:21 nativespace-cdp crond[2864263]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864272]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864270]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864262]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864266]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864267]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864265]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864259]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864256]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864268]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864261]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864269]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864271]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864264]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864257]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864258]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864260]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:11:21 nativespace-cdp crond[2864255]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 10:12:33 nativespace-cdp crond[2864351]: pam_systemd(crond:session): Failed to create session: Input/output error
Sep  6 10:12:36 nativespace-cdp sshd[2864417]: Did not receive identification string from 159.100.136.21 port 49448
Sep  6 10:14:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 10:14:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:14:44 nativespace-cdp sudo[2865113]: pam_unix(sudo:session): session closed for user root
Sep  6 10:14:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 10:14:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:14:44 nativespace-cdp sudo[2865118]: pam_unix(sudo:session): session closed for user root
Sep  6 10:14:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 10:14:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:11 nativespace-cdp sudo[2865121]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 10:15:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:11 nativespace-cdp sudo[2865311]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 10:15:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:33 nativespace-cdp sudo[2865314]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 10:15:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:33 nativespace-cdp sudo[2865382]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 10:15:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:33 nativespace-cdp sudo[2865386]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 10:15:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:34 nativespace-cdp sudo[2865389]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 10:15:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:34 nativespace-cdp sudo[2865395]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 10:15:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:34 nativespace-cdp sudo[2865398]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 10:15:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:34 nativespace-cdp sudo[2865401]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 10:15:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:43 nativespace-cdp sudo[2865444]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 10:15:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:47 nativespace-cdp sudo[2865450]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tstardom user-2=oubpgvbx user-3=what user-4=havantho user-5=sketchy user-6=cath user-7=nvihkvu user-8=stagingerris user-9=dancinggardener user-10=ladburyp user-11=kategilpin user-12=design user-13=nove user-14=boldover user-15=bakery user-16=crrtipdl user-17=sosevalu user-18=lucy user-19=attlebor user-20=onlycont user-21=hodgsonmail user-22=ranxterc user-23=outdoorc user-24=branko user-25=romaldki user-26=tomandle user-27=jennimil user-28=chrisdal user-29=mcdermos user-30=david user-31=careers user-32=nbhavers user-33=cathski user-34=cambria1 user-35=ninejimm user-36=reliable user-37=cwsocial user-38=paulmca1 user-39=howardon user-40=pugwash user-41=hirefootballgame user-42=eugincou user-43=courseme user-44=nscdp user-45=putterfc user-46=foods user-47=leftie user-48=fortunaz user-49=health2045
Sep  6 10:15:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=lkpier user-51=steakbridieme user-52=donnychicago user-53=firstre5 user-54=philmcph user-55=ctedorgu user-56=isleofwi user-57=smrszyqg user-58=nomistakes user-59=hidden user-60=tigerlet user-61=barbersh user-62=fawcettd user-63=burydropin user-64=nsceres user-65=beauty user-66=darkstar user-67=eatspam user-68=dhyana user-69=asandcoc user-70=sibtoncc user-71=bwppodcast user-72=zebrapho user-73=steve user-74=skyfirec user-75=alexadmin user-76=innovat1 user-77=stuartge user-78=askhform user-79=nativene user-80=nstriton user-81=brighto1 user-82=vivienn1 user-83=firstre2 user-84=oneoarco user-85=battlere user-86=bedfords user-87=newstoda user-88=ggaaorgu user-89=belle user-90=bemadonn user-91=gilpin user-92=milloyco user-93=elecleis user-94=hubmaster user-95=putterfi user-96=fetch user-97=carsinyo user-98=accooper user-99=ianrayne user-100=connectedshoppin user-101=thqkgnbz user-102=ultbcrra user-103=seftvta
Sep  6 10:15:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=jonhartl user-105=firstres user-106=opaiscyx user-107=coursemc user-108=firstrel user-109=clarkass user-110=costestimatorco user-111=firstred user-112=highlegh user-113=southlon user-114=martsblo user-115=dickemery123 user-116=ptkxhsbt user-117=hhdugcor user-118=lbhyisi user-119=magichat user-120=lakesan1 user-121=brmrjxl user-122=strathar user-123=atestord user-124=sarafoundation user-125=wilsonsw user-126=megacards user-127=musorguk user-128=jarvisin user-129=spectrum user-130=hodgesonweb user-131=theblack user-132=agproduc user-133=still user-134=stephani user-135=leereyn1 user-136=booff user-137=markward user-138=foundation user-139=vantagep user-140=athenare user-141=connect9 user-142=lbscrmod user-143=maflemin user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 10:15:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 10:15:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:50 nativespace-cdp sudo[2865466]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 10:15:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:51 nativespace-cdp sudo[2865480]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-eSHlfuOumfffQMDm.~
Sep  6 10:15:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:51 nativespace-cdp sudo[2865483]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-eSHlfuOumfffQMDm.~'
Sep  6 10:15:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:52 nativespace-cdp sudo[2865486]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-eSHlfuOumfffQMDm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 10:15:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:52 nativespace-cdp sudo[2865490]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 10:15:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:52 nativespace-cdp sudo[2865493]: pam_unix(sudo:session): session closed for user root
Sep  6 10:15:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 10:15:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 10:15:55 nativespace-cdp sudo[2865519]: pam_unix(sudo:session): session closed for user root
Sep  6 10:16:34 nativespace-cdp sshd[2865740]: Connection closed by 159.100.136.21 port 58904 [preauth]
Sep  6 10:20:30 nativespace-cdp sshd[2866883]: Invalid user boy from 47.236.107.69 port 45692
Sep  6 10:20:30 nativespace-cdp sshd[2866883]: input_userauth_request: invalid user boy [preauth]
Sep  6 10:20:30 nativespace-cdp sshd[2866883]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 10:20:30 nativespace-cdp sshd[2866883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.107.69
Sep  6 10:20:32 nativespace-cdp sshd[2866883]: Failed password for invalid user boy from 47.236.107.69 port 45692 ssh2
Sep  6 10:20:33 nativespace-cdp sshd[2866883]: Received disconnect from 47.236.107.69 port 45692:11: Bye Bye [preauth]
Sep  6 10:20:33 nativespace-cdp sshd[2866883]: Disconnected from 47.236.107.69 port 45692 [preauth]
Sep  6 10:20:42 nativespace-cdp sshd[2866981]: Invalid user njs from 196.0.120.211 port 42234
Sep  6 10:20:42 nativespace-cdp sshd[2866981]: input_userauth_request: invalid user njs [preauth]
Sep  6 10:20:42 nativespace-cdp sshd[2866981]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 10:20:42 nativespace-cdp sshd[2866981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.0.120.211
Sep  6 10:20:44 nativespace-cdp sshd[2866981]: Failed password for invalid user njs from 196.0.120.211 port 42234 ssh2
Sep  6 10:20:44 nativespace-cdp sshd[2866981]: Received disconnect from 196.0.120.211 port 42234:11: Bye Bye [preauth]
Sep  6 10:20:44 nativespace-cdp sshd[2866981]: Disconnected from 196.0.120.211 port 42234 [preauth]
Sep  6 10:21:34 nativespace-cdp sshd[2867377]: Connection closed by 159.100.136.21 port 40010 [preauth]
Sep  6 10:23:04 nativespace-cdp sshd[2867859]: Invalid user shivam from 159.65.147.20 port 60516
Sep  6 10:23:04 nativespace-cdp sshd[2867859]: input_userauth_request: invalid user shivam [preauth]
Sep  6 10:23:04 nativespace-cdp sshd[2867859]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 10:23:04 nativespace-cdp sshd[2867859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.147.20
Sep  6 10:23:05 nativespace-cdp sshd[2867859]: Failed password for invalid user shivam from 159.65.147.20 port 60516 ssh2
Sep  6 10:23:06 nativespace-cdp sshd[2867859]: Received disconnect from 159.65.147.20 port 60516:11: Bye Bye [preauth]
Sep  6 10:23:06 nativespace-cdp sshd[2867859]: Disconnected from 159.65.147.20 port 60516 [preauth]
Sep  6 10:23:53 nativespace-cdp sshd[2868059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.55.55.160  user=root
Sep  6 10:23:53 nativespace-cdp sshd[2868059]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 10:23:56 nativespace-cdp sshd[2868059]: Failed password for root from 191.55.55.160 port 8706 ssh2
Sep  6 10:23:56 nativespace-cdp sshd[2868059]: Received disconnect from 191.55.55.160 port 8706:11: Bye Bye [preauth]
Sep  6 10:23:56 nativespace-cdp sshd[2868059]: Disconnected from 191.55.55.160 port 8706 [preauth]
Sep  6 10:24:51 nativespace-cdp sshd[2868329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.107.69  user=root
Sep  6 10:24:51 nativespace-cdp sshd[2868329]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 10:24:54 nativespace-cdp sshd[2868329]: Failed password for root from 47.236.107.69 port 60580 ssh2
Sep  6 10:24:58 nativespace-cdp sshd[2868329]: Received disconnect from 47.236.107.69 port 60580:11: Bye Bye [preauth]
Sep  6 10:24:58 nativespace-cdp sshd[2868329]: Disconnected from 47.236.107.69 port 60580 [preauth]
Sep  6 10:25:14 nativespace-cdp sshd[2868527]: Invalid user lm from 47.236.107.69 port 53140
Sep  6 10:25:14 nativespace-cdp sshd[2868527]: input_userauth_request: invalid user lm [preauth]
Sep  6 10:25:14 nativespace-cdp sshd[2868527]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 10:25:14 nativespace-cdp sshd[2868527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.107.69
Sep  6 10:25:16 nativespace-cdp sshd[2868527]: Failed password for invalid user lm from 47.236.107.69 port 53140 ssh2
Sep  6 10:25:18 nativespace-cdp sshd[2868527]: Received disconnect from 47.236.107.69 port 53140:11: Bye Bye [preauth]
Sep  6 10:25:18 nativespace-cdp sshd[2868527]: Disconnected from 47.236.107.69 port 53140 [preauth]
Sep  6 10:25:58 nativespace-cdp sshd[2869163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.0.120.211  user=root
Sep  6 10:25:58 nativespace-cdp sshd[2869163]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 10:26:00 nativespace-cdp sshd[2869163]: Failed password for root from 196.0.120.211 port 55892 ssh2
Sep  6 10:26:00 nativespace-cdp sshd[2869163]: Received disconnect from 196.0.120.211 port 55892:11: Bye Bye [preauth]
Sep  6 10:26:00 nativespace-cdp sshd[2869163]: Disconnected from 196.0.120.211 port 55892 [preauth]
Sep  6 10:26:15 nativespace-cdp sshd[2869241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.147.20  user=root
Sep  6 10:26:15 nativespace-cdp sshd[2869241]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 10:26:17 nativespace-cdp sshd[2869241]: Failed password for root from 159.65.147.20 port 47202 ssh2
Sep  6 10:26:17 nativespace-cdp sshd[2869241]: Received disconnect from 159.65.147.20 port 47202:11: Bye Bye [preauth]
Sep  6 10:26:17 nativespace-cdp sshd[2869241]: Disconnected from 159.65.147.20 port 47202 [preauth]
Sep  6 10:26:33 nativespace-cdp sshd[2869355]: Connection closed by 159.100.136.21 port 47928 [preauth]
Sep  6 10:26:55 nativespace-cdp sshd[2869427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.0.120.211  user=root
Sep  6 10:26:55 nativespace-cdp sshd[2869427]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 10:26:57 nativespace-cdp sshd[2869427]: Failed password for root from 196.0.120.211 port 43082 ssh2
Sep  6 10:26:57 nativespace-cdp sshd[2869427]: Received disconnect from 196.0.120.211 port 43082:11: Bye Bye [preauth]
Sep  6 10:26:57 nativespace-cdp sshd[2869427]: Disconnected from 196.0.120.211 port 43082 [preauth]
Sep  6 10:27:05 nativespace-cdp sshd[2869476]: Invalid user security from 159.65.147.20 port 45870
Sep  6 10:27:05 nativespace-cdp sshd[2869476]: input_userauth_request: invalid user security [preauth]
Sep  6 10:27:05 nativespace-cdp sshd[2869476]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 10:27:05 nativespace-cdp sshd[2869476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.147.20
Sep  6 10:27:06 nativespace-cdp sshd[2869480]: Invalid user dietpi from 191.55.25.99 port 9816
Sep  6 10:27:06 nativespace-cdp sshd[2869480]: input_userauth_request: invalid user dietpi [preauth]
Sep  6 10:27:06 nativespace-cdp sshd[2869480]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 10:27:06 nativespace-cdp sshd[2869480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.55.25.99
Sep  6 10:27:07 nativespace-cdp sshd[2869476]: Failed password for invalid user security from 159.65.147.20 port 45870 ssh2
Sep  6 10:27:07 nativespace-cdp sshd[2869476]: Received disconnect from 159.65.147.20 port 45870:11: Bye Bye [preauth]
Sep  6 10:27:07 nativespace-cdp sshd[2869476]: Disconnected from 159.65.147.20 port 45870 [preauth]
Sep  6 10:27:08 nativespace-cdp sshd[2869480]: Failed password for invalid user dietpi from 191.55.25.99 port 9816 ssh2
Sep  6 10:27:08 nativespace-cdp sshd[2869480]: Received disconnect from 191.55.25.99 port 9816:11: Bye Bye [preauth]
Sep  6 10:27:08 nativespace-cdp sshd[2869480]: Disconnected from 191.55.25.99 port 9816 [preauth]
Sep  6 10:28:00 nativespace-cdp sshd[2869780]: Invalid user router from 191.55.25.99 port 53681
Sep  6 10:28:00 nativespace-cdp sshd[2869780]: input_userauth_request: invalid user router [preauth]
Sep  6 10:28:00 nativespace-cdp sshd[2869780]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 10:28:00 nativespace-cdp sshd[2869780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.55.25.99
Sep  6 10:28:02 nativespace-cdp sshd[2869780]: Failed password for invalid user router from 191.55.25.99 port 53681 ssh2
Sep  6 10:28:02 nativespace-cdp sshd[2869780]: Received disconnect from 191.55.25.99 port 53681:11: Bye Bye [preauth]
Sep  6 10:28:02 nativespace-cdp sshd[2869780]: Disconnected from 191.55.25.99 port 53681 [preauth]
Sep  6 10:28:57 nativespace-cdp sshd[2870021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.55.25.99  user=root
Sep  6 10:28:57 nativespace-cdp sshd[2870021]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 10:28:59 nativespace-cdp sshd[2870021]: Failed password for root from 191.55.25.99 port 62048 ssh2
Sep  6 10:28:59 nativespace-cdp sshd[2870021]: Received disconnect from 191.55.25.99 port 62048:11: Bye Bye [preauth]
Sep  6 10:28:59 nativespace-cdp sshd[2870021]: Disconnected from 191.55.25.99 port 62048 [preauth]
Sep  6 10:31:34 nativespace-cdp sshd[2870805]: Connection closed by 159.100.136.21 port 57398 [preauth]
Sep  6 10:36:35 nativespace-cdp sshd[2872174]: Connection closed by 159.100.136.21 port 38326 [preauth]
Sep  6 10:41:34 nativespace-cdp sshd[2873489]: Connection closed by 159.100.136.21 port 47410 [preauth]
Sep  6 10:46:35 nativespace-cdp sshd[2874951]: Connection closed by 159.100.136.21 port 57430 [preauth]
Sep  6 10:51:33 nativespace-cdp sshd[2876216]: Connection closed by 159.100.136.21 port 38790 [preauth]
Sep  6 10:56:37 nativespace-cdp sshd[2877691]: Connection closed by 159.100.136.21 port 48412 [preauth]
Sep  6 11:01:33 nativespace-cdp sshd[2879440]: Connection closed by 159.100.136.21 port 57982 [preauth]
Sep  6 11:06:34 nativespace-cdp sshd[2880715]: Connection closed by 159.100.136.21 port 39808 [preauth]
Sep  6 11:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 11:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:01 nativespace-cdp sudo[2881459]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 11:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:01 nativespace-cdp sudo[2881528]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 11:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:13 nativespace-cdp sudo[2881535]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 11:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:13 nativespace-cdp sudo[2881653]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 11:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:20 nativespace-cdp sudo[2881658]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:20 nativespace-cdp sudo[2881696]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:20 nativespace-cdp sudo[2881716]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:20 nativespace-cdp sudo[2881731]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:20 nativespace-cdp sudo[2881742]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:20 nativespace-cdp sudo[2881745]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:20 nativespace-cdp sudo[2881748]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 11:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:28 nativespace-cdp sudo[2881769]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 11:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:34 nativespace-cdp sudo[2881774]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=barbersh user-2=tigerlet user-3=nomistakes user-4=hidden user-5=isleofwi user-6=smrszyqg user-7=donnychicago user-8=steakbridieme user-9=firstre5 user-10=philmcph user-11=ctedorgu user-12=lkpier user-13=leftie user-14=foods user-15=fortunaz user-16=health2045 user-17=nscdp user-18=putterfc user-19=courseme user-20=eugincou user-21=hirefootballgame user-22=cwsocial user-23=paulmca1 user-24=howardon user-25=pugwash user-26=ninejimm user-27=reliable user-28=cathski user-29=cambria1 user-30=steve user-31=zebrapho user-32=bwppodcast user-33=asandcoc user-34=sibtoncc user-35=dhyana user-36=darkstar user-37=eatspam user-38=beauty user-39=nsceres user-40=fawcettd user-41=burydropin user-42=crrtipdl user-43=sosevalu user-44=bakery user-45=boldover user-46=nove user-47=design user-48=kategilpin
Sep  6 11:10:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=stagingerris user-50=dancinggardener user-51=ladburyp user-52=nvihkvu user-53=havantho user-54=sketchy user-55=cath user-56=what user-57=oubpgvbx user-58=tstardom user-59=david user-60=nbhavers user-61=careers user-62=mcdermos user-63=chrisdal user-64=jennimil user-65=tomandle user-66=romaldki user-67=branko user-68=ranxterc user-69=hodgsonmail user-70=outdoorc user-71=onlycont user-72=lucy user-73=attlebor user-74=megacards user-75=musorguk user-76=wilsonsw user-77=atestord user-78=sarafoundation user-79=strathar user-80=lakesan1 user-81=brmrjxl user-82=magichat user-83=hhdugcor user-84=lbhyisi user-85=ptkxhsbt user-86=dickemery123 user-87=martsblo user-88=ulsukarm user-89=lbscrmod user-90=maflemin user-91=vantagep user-92=connect9 user-93=athenare user-94=booff user-95=markward user-96=foundation user-97=leereyn1 user-98=stephani user-99=agproduc user-100=still user-101=hodgesonweb user-102=theblack
Sep  6 11:10:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=spectrum user-104=jarvisin user-105=bemadonn user-106=newstoda user-107=belle user-108=ggaaorgu user-109=bedfords user-110=oneoarco user-111=battlere user-112=vivienn1 user-113=firstre2 user-114=nstriton user-115=brighto1 user-116=nativene user-117=stuartge user-118=askhform user-119=innovat1 user-120=skyfirec user-121=alexadmin user-122=highlegh user-123=southlon user-124=firstred user-125=costestimatorco user-126=clarkass user-127=firstrel user-128=opaiscyx user-129=coursemc user-130=firstres user-131=ultbcrra user-132=jonhartl user-133=seftvta user-134=thqkgnbz user-135=connectedshoppin user-136=ianrayne user-137=accooper user-138=fetch user-139=carsinyo user-140=putterfi user-141=hubmaster user-142=elecleis user-143=milloyco user-144=gilpin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 11:10:34 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 11:10:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:35 nativespace-cdp sudo[2881792]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  6 11:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:37 nativespace-cdp sudo[2881804]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep  6 11:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  6 11:10:37 nativespace-cdp sudo[2881810]: pam_unix(sudo:session): session closed for user onlycont
Sep  6 11:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  6 11:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:38 nativespace-cdp sudo[2881821]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  6 11:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 11:10:38 nativespace-cdp sudo[2881824]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 11:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  6 11:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:40 nativespace-cdp sudo[2881844]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep  6 11:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  6 11:10:41 nativespace-cdp sudo[2881848]: pam_unix(sudo:session): session closed for user lkpier
Sep  6 11:10:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  6 11:10:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:41 nativespace-cdp sudo[2881860]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep  6 11:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  6 11:10:42 nativespace-cdp sudo[2881865]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  6 11:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  6 11:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  6 11:10:42 nativespace-cdp sudo[2881876]: pam_unix(sudo:session): session closed for user oneoarco
Sep  6 11:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  6 11:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:42 nativespace-cdp sudo[2881887]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep  6 11:10:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  6 11:10:43 nativespace-cdp sudo[2881891]: pam_unix(sudo:session): session closed for user fortunaz
Sep  6 11:10:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep  6 11:10:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:46 nativespace-cdp sudo[2881925]: pam_unix(sudo:session): session closed for user root
Sep  6 11:10:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 11:10:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:10:46 nativespace-cdp sudo[2881929]: pam_unix(sudo:session): session closed for user root
Sep  6 11:11:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep  6 11:11:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:11:06 nativespace-cdp sudo[2882888]: pam_unix(sudo:session): session closed for user root
Sep  6 11:11:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep  6 11:11:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:11:06 nativespace-cdp sudo[2882894]: pam_unix(sudo:session): session closed for user root
Sep  6 11:11:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 11:11:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:11:08 nativespace-cdp sudo[2882953]: pam_unix(sudo:session): session closed for user root
Sep  6 11:11:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FFMUJWa1raESlsKr.~
Sep  6 11:11:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:11:08 nativespace-cdp sudo[2882956]: pam_unix(sudo:session): session closed for user root
Sep  6 11:11:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FFMUJWa1raESlsKr.~'
Sep  6 11:11:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:11:08 nativespace-cdp sudo[2882959]: pam_unix(sudo:session): session closed for user root
Sep  6 11:11:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FFMUJWa1raESlsKr.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 11:11:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:11:08 nativespace-cdp sudo[2882963]: pam_unix(sudo:session): session closed for user root
Sep  6 11:11:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 11:11:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:11:08 nativespace-cdp sudo[2882966]: pam_unix(sudo:session): session closed for user root
Sep  6 11:11:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 11:11:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 11:11:10 nativespace-cdp sudo[2882980]: pam_unix(sudo:session): session closed for user root
Sep  6 11:11:34 nativespace-cdp sshd[2883044]: Connection closed by 159.100.136.21 port 49356 [preauth]
Sep  6 11:16:34 nativespace-cdp sshd[2884590]: Connection closed by 159.100.136.21 port 59216 [preauth]
Sep  6 11:21:35 nativespace-cdp sshd[2886075]: Connection closed by 159.100.136.21 port 40182 [preauth]
Sep  6 11:26:35 nativespace-cdp sshd[2887448]: Connection closed by 159.100.136.21 port 49564 [preauth]
Sep  6 11:31:36 nativespace-cdp sshd[2888979]: Connection closed by 159.100.136.21 port 58914 [preauth]
Sep  6 11:36:36 nativespace-cdp sshd[2890193]: Connection closed by 159.100.136.21 port 39980 [preauth]
Sep  6 11:41:35 nativespace-cdp sshd[2891571]: Connection closed by 159.100.136.21 port 49048 [preauth]
Sep  6 11:46:34 nativespace-cdp sshd[2893210]: Connection closed by 159.100.136.21 port 57866 [preauth]
Sep  6 11:51:34 nativespace-cdp sshd[2894322]: Connection closed by 159.100.136.21 port 39290 [preauth]
Sep  6 11:56:33 nativespace-cdp sshd[2895356]: Connection closed by 159.100.136.21 port 48632 [preauth]
Sep  6 12:01:36 nativespace-cdp sshd[2897015]: Connection closed by 159.100.136.21 port 58104 [preauth]
Sep  6 12:06:33 nativespace-cdp sshd[2898274]: Connection closed by 159.100.136.21 port 39444 [preauth]
Sep  6 12:10:13 nativespace-cdp sshd[2899201]: Connection closed by 213.225.3.177 port 5064 [preauth]
Sep  6 12:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 12:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:14 nativespace-cdp sudo[2899220]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 12:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:14 nativespace-cdp sudo[2899226]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 12:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:23 nativespace-cdp sudo[2899229]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 12:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:23 nativespace-cdp sudo[2899294]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 12:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:35 nativespace-cdp sudo[2899299]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 12:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:35 nativespace-cdp sudo[2899455]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 12:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:35 nativespace-cdp sudo[2899459]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 12:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:35 nativespace-cdp sudo[2899462]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 12:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:35 nativespace-cdp sudo[2899465]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 12:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:35 nativespace-cdp sudo[2899468]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 12:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:35 nativespace-cdp sudo[2899471]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 12:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:38 nativespace-cdp sudo[2899564]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 12:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:44 nativespace-cdp sudo[2899588]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=romaldki user-2=branko user-3=ranxterc user-4=hodgsonmail user-5=outdoorc user-6=onlycont user-7=lucy user-8=attlebor user-9=david user-10=nbhavers user-11=careers user-12=mcdermos user-13=chrisdal user-14=jennimil user-15=tomandle user-16=design user-17=kategilpin user-18=stagingerris user-19=dancinggardener user-20=ladburyp user-21=nvihkvu user-22=havantho user-23=cath user-24=sketchy user-25=what user-26=oubpgvbx user-27=tstardom user-28=crrtipdl user-29=sosevalu user-30=bakery user-31=boldover user-32=nove user-33=dhyana user-34=darkstar user-35=eatspam user-36=beauty user-37=nsceres user-38=fawcettd user-39=burydropin user-40=steve user-41=zebrapho user-42=bwppodcast user-43=asandcoc user-44=sibtoncc user-45=courseme user-46=eugincou user-47=hirefootballgame user-48=cwsocial user-49=pugwash
Sep  6 12:10:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=howardon user-51=paulmca1 user-52=reliable user-53=ninejimm user-54=cambria1 user-55=cathski user-56=barbersh user-57=tigerlet user-58=nomistakes user-59=hidden user-60=smrszyqg user-61=isleofwi user-62=firstre5 user-63=donnychicago user-64=steakbridieme user-65=philmcph user-66=ctedorgu user-67=lkpier user-68=leftie user-69=foods user-70=fortunaz user-71=health2045 user-72=nscdp user-73=putterfc user-74=thqkgnbz user-75=connectedshoppin user-76=ianrayne user-77=accooper user-78=fetch user-79=carsinyo user-80=putterfi user-81=hubmaster user-82=elecleis user-83=milloyco user-84=gilpin user-85=highlegh user-86=southlon user-87=firstred user-88=costestimatorco user-89=firstrel user-90=clarkass user-91=opaiscyx user-92=coursemc user-93=firstres user-94=ultbcrra user-95=seftvta user-96=jonhartl user-97=nativene user-98=stuartge user-99=askhform user-100=innovat1 user-101=alexadmin user-102=skyfirec
Sep  6 12:10:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bemadonn user-104=newstoda user-105=ggaaorgu user-106=belle user-107=bedfords user-108=oneoarco user-109=battlere user-110=vivienn1 user-111=firstre2 user-112=nstriton user-113=brighto1 user-114=leereyn1 user-115=stephani user-116=agproduc user-117=still user-118=theblack user-119=hodgesonweb user-120=spectrum user-121=jarvisin user-122=ulsukarm user-123=lbscrmod user-124=maflemin user-125=vantagep user-126=connect9 user-127=athenare user-128=markward user-129=booff user-130=foundation user-131=magichat user-132=hhdugcor user-133=lbhyisi user-134=ptkxhsbt user-135=dickemery123 user-136=martsblo user-137=megacards user-138=musorguk user-139=wilsonsw user-140=atestord user-141=sarafoundation user-142=strathar user-143=lakesan1 user-144=brmrjxl feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 12:10:44 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 12:10:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:46 nativespace-cdp sudo[2899669]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 12:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:47 nativespace-cdp sudo[2899680]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dgV0d2y26a3cwzfp.~
Sep  6 12:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:47 nativespace-cdp sudo[2899683]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dgV0d2y26a3cwzfp.~'
Sep  6 12:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:47 nativespace-cdp sudo[2899687]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dgV0d2y26a3cwzfp.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 12:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:47 nativespace-cdp sudo[2899691]: pam_unix(sudo:session): session closed for user root
Sep  6 12:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 12:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:10:48 nativespace-cdp sudo[2899694]: pam_unix(sudo:session): session closed for user root
Sep  6 12:11:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 12:11:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 12:11:05 nativespace-cdp sudo[2899781]: pam_unix(sudo:session): session closed for user root
Sep  6 12:11:33 nativespace-cdp sshd[2899877]: Connection closed by 159.100.136.21 port 48590 [preauth]
Sep  6 12:15:44 nativespace-cdp sshd[2901094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.161.0.196  user=root
Sep  6 12:15:44 nativespace-cdp sshd[2901094]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 12:15:46 nativespace-cdp sshd[2901094]: Failed password for root from 86.161.0.196 port 50248 ssh2
Sep  6 12:15:46 nativespace-cdp sshd[2901094]: Received disconnect from 86.161.0.196 port 50248:11: Bye Bye [preauth]
Sep  6 12:15:46 nativespace-cdp sshd[2901094]: Disconnected from 86.161.0.196 port 50248 [preauth]
Sep  6 12:16:34 nativespace-cdp sshd[2901263]: Connection closed by 159.100.136.21 port 58392 [preauth]
Sep  6 12:17:40 nativespace-cdp sshd[2901490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.161.0.196  user=root
Sep  6 12:17:40 nativespace-cdp sshd[2901490]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 12:17:42 nativespace-cdp sshd[2901490]: Failed password for root from 86.161.0.196 port 60365 ssh2
Sep  6 12:17:42 nativespace-cdp sshd[2901490]: Received disconnect from 86.161.0.196 port 60365:11: Bye Bye [preauth]
Sep  6 12:17:42 nativespace-cdp sshd[2901490]: Disconnected from 86.161.0.196 port 60365 [preauth]
Sep  6 12:18:22 nativespace-cdp sshd[2901648]: Invalid user root2 from 86.161.0.196 port 38614
Sep  6 12:18:22 nativespace-cdp sshd[2901648]: input_userauth_request: invalid user root2 [preauth]
Sep  6 12:18:22 nativespace-cdp sshd[2901648]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 12:18:22 nativespace-cdp sshd[2901648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.161.0.196
Sep  6 12:18:24 nativespace-cdp sshd[2901648]: Failed password for invalid user root2 from 86.161.0.196 port 38614 ssh2
Sep  6 12:18:24 nativespace-cdp sshd[2901648]: Received disconnect from 86.161.0.196 port 38614:11: Bye Bye [preauth]
Sep  6 12:18:24 nativespace-cdp sshd[2901648]: Disconnected from 86.161.0.196 port 38614 [preauth]
Sep  6 12:21:33 nativespace-cdp sshd[2902455]: Connection closed by 159.100.136.21 port 39594 [preauth]
Sep  6 12:26:34 nativespace-cdp sshd[2903848]: Connection closed by 159.100.136.21 port 49276 [preauth]
Sep  6 12:31:37 nativespace-cdp sshd[2905484]: Connection closed by 159.100.136.21 port 58722 [preauth]
Sep  6 12:36:33 nativespace-cdp sshd[2906592]: Connection closed by 159.100.136.21 port 40450 [preauth]
Sep  6 12:41:33 nativespace-cdp sshd[2908224]: Connection closed by 159.100.136.21 port 49154 [preauth]
Sep  6 12:46:33 nativespace-cdp sshd[2909324]: Connection closed by 159.100.136.21 port 58270 [preauth]
Sep  6 12:50:55 nativespace-cdp sshd[2910528]: Did not receive identification string from 167.94.146.57 port 60780
Sep  6 12:51:13 nativespace-cdp sshd[2910550]: Connection closed by 167.94.146.57 port 60896 [preauth]
Sep  6 12:51:38 nativespace-cdp sshd[2910731]: Connection closed by 159.100.136.21 port 39006 [preauth]
Sep  6 12:56:35 nativespace-cdp sshd[2912104]: Connection closed by 159.100.136.21 port 48902 [preauth]
Sep  6 13:01:34 nativespace-cdp sshd[2913705]: Connection closed by 159.100.136.21 port 58522 [preauth]
Sep  6 13:03:18 nativespace-cdp crond[2913863]: pam_systemd(crond:session): Failed to create session: Input/output error
Sep  6 13:04:46 nativespace-cdp crond[2914904]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915007]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915002]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915000]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2914995]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2914999]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915006]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915011]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915005]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915009]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2914996]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2914997]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915004]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915003]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915010]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915001]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2915008]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:07:20 nativespace-cdp crond[2914998]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:08:19 nativespace-cdp crond[2915072]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:08:55 nativespace-cdp sshd[2915109]: Did not receive identification string from 159.100.136.21 port 39260
Sep  6 13:11:38 nativespace-cdp sshd[2916411]: Connection closed by 159.100.136.21 port 48398 [preauth]
Sep  6 13:11:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 13:11:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:11:43 nativespace-cdp sudo[2916524]: pam_unix(sudo:session): session closed for user root
Sep  6 13:11:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 13:11:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:11:43 nativespace-cdp sudo[2916530]: pam_unix(sudo:session): session closed for user root
Sep  6 13:11:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 13:11:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:11:47 nativespace-cdp sudo[2916535]: pam_unix(sudo:session): session closed for user root
Sep  6 13:11:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 13:11:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:11:47 nativespace-cdp sudo[2916552]: pam_unix(sudo:session): session closed for user root
Sep  6 13:11:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 13:11:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:28 nativespace-cdp sudo[2916556]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 13:12:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:28 nativespace-cdp sudo[2916755]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 13:12:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:28 nativespace-cdp sudo[2916761]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 13:12:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:28 nativespace-cdp sudo[2916764]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 13:12:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:28 nativespace-cdp sudo[2916767]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 13:12:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:29 nativespace-cdp sudo[2916770]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 13:12:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:29 nativespace-cdp sudo[2916776]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 13:12:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:37 nativespace-cdp sudo[2916824]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 13:12:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:41 nativespace-cdp sudo[2916833]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=fawcettd user-2=burydropin user-3=nsceres user-4=darkstar user-5=eatspam user-6=beauty user-7=dhyana user-8=asandcoc user-9=sibtoncc user-10=zebrapho user-11=bwppodcast user-12=steve user-13=reliable user-14=ninejimm user-15=cambria1 user-16=cathski user-17=cwsocial user-18=paulmca1 user-19=howardon user-20=pugwash user-21=hirefootballgame user-22=courseme user-23=eugincou user-24=leftie user-25=foods user-26=fortunaz user-27=health2045 user-28=nscdp user-29=putterfc user-30=steakbridieme user-31=donnychicago user-32=firstre5 user-33=ctedorgu user-34=philmcph user-35=lkpier user-36=smrszyqg user-37=isleofwi user-38=tigerlet user-39=barbersh user-40=nomistakes user-41=hidden user-42=lucy user-43=attlebor user-44=onlycont user-45=branko user-46=hodgsonmail user-47=outdoorc user-48=ranxterc
Sep  6 13:12:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=tomandle user-51=jennimil user-52=mcdermos user-53=chrisdal user-54=david user-55=nbhavers user-56=careers user-57=what user-58=oubpgvbx user-59=tstardom user-60=nvihkvu user-61=havantho user-62=cath user-63=sketchy user-64=kategilpin user-65=dancinggardener user-66=stagingerris user-67=ladburyp user-68=design user-69=nove user-70=boldover user-71=crrtipdl user-72=sosevalu user-73=bakery user-74=jarvisin user-75=hodgesonweb user-76=theblack user-77=spectrum user-78=agproduc user-79=still user-80=leereyn1 user-81=stephani user-82=booff user-83=markward user-84=foundation user-85=lbscrmod user-86=maflemin user-87=vantagep user-88=athenare user-89=connect9 user-90=ulsukarm user-91=martsblo user-92=ptkxhsbt user-93=dickemery123 user-94=hhdugcor user-95=lbhyisi user-96=magichat user-97=lakesan1 user-98=brmrjxl user-99=atestord user-100=sarafoundation user-101=strathar user-102=wilsonsw
Sep  6 13:12:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=megacards user-104=musorguk user-105=elecleis user-106=milloyco user-107=gilpin user-108=fetch user-109=carsinyo user-110=putterfi user-111=hubmaster user-112=ianrayne user-113=accooper user-114=thqkgnbz user-115=connectedshoppin user-116=firstres user-117=ultbcrra user-118=seftvta user-119=jonhartl user-120=opaiscyx user-121=coursemc user-122=costestimatorco user-123=firstrel user-124=clarkass user-125=highlegh user-126=southlon user-127=firstred user-128=alexadmin user-129=skyfirec user-130=askhform user-131=stuartge user-132=innovat1 user-133=nativene user-134=nstriton user-135=brighto1 user-136=oneoarco user-137=battlere user-138=vivienn1 user-139=firstre2 user-140=bedfords user-141=bemadonn user-142=newstoda user-143=ggaaorgu user-144=belle feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 13:12:41 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 13:12:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:43 nativespace-cdp sudo[2916845]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 13:12:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:44 nativespace-cdp sudo[2916857]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-LQ9m7PzWdLbqnMdl.~
Sep  6 13:12:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:44 nativespace-cdp sudo[2916860]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-LQ9m7PzWdLbqnMdl.~'
Sep  6 13:12:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:44 nativespace-cdp sudo[2916863]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-LQ9m7PzWdLbqnMdl.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 13:12:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:44 nativespace-cdp sudo[2916868]: pam_unix(sudo:session): session closed for user root
Sep  6 13:12:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 13:12:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:12:44 nativespace-cdp sudo[2916871]: pam_unix(sudo:session): session closed for user root
Sep  6 13:16:03 nativespace-cdp crond[2917215]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917208]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917207]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917214]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917201]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917217]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917203]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917212]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917206]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917202]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917216]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917205]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917204]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917209]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917210]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917211]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:03 nativespace-cdp crond[2917213]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:40 nativespace-cdp crond[2918459]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 13:16:43 nativespace-cdp sshd[2918539]: Did not receive identification string from 159.100.136.21 port 58352
Sep  6 13:19:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 13:19:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 13:19:52 nativespace-cdp sudo[2918883]: pam_unix(sudo:session): session closed for user root
Sep  6 13:21:33 nativespace-cdp sshd[2919546]: Connection closed by 159.100.136.21 port 39482 [preauth]
Sep  6 13:26:34 nativespace-cdp sshd[2921568]: Connection closed by 159.100.136.21 port 48672 [preauth]
Sep  6 13:31:33 nativespace-cdp sshd[2924256]: Connection closed by 159.100.136.21 port 58258 [preauth]
Sep  6 13:36:33 nativespace-cdp sshd[2926365]: Connection closed by 159.100.136.21 port 39466 [preauth]
Sep  6 13:41:36 nativespace-cdp sshd[2929563]: Connection closed by 159.100.136.21 port 49110 [preauth]
Sep  6 13:46:34 nativespace-cdp sshd[2931963]: Connection closed by 159.100.136.21 port 58148 [preauth]
Sep  6 13:51:34 nativespace-cdp sshd[2934397]: Connection closed by 159.100.136.21 port 38978 [preauth]
Sep  6 13:56:34 nativespace-cdp sshd[2935713]: Connection closed by 159.100.136.21 port 48036 [preauth]
Sep  6 14:01:33 nativespace-cdp sshd[2937163]: Connection closed by 159.100.136.21 port 56788 [preauth]
Sep  6 14:06:35 nativespace-cdp sshd[2938380]: Connection closed by 159.100.136.21 port 37592 [preauth]
Sep  6 14:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 14:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:33 nativespace-cdp sudo[2939569]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 14:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:33 nativespace-cdp sudo[2939581]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 14:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:35 nativespace-cdp sudo[2939585]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 14:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:35 nativespace-cdp sudo[2939592]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 14:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:48 nativespace-cdp sudo[2939595]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 14:10:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:48 nativespace-cdp sudo[2939651]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 14:10:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:48 nativespace-cdp sudo[2939654]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 14:10:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:48 nativespace-cdp sudo[2939657]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 14:10:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:48 nativespace-cdp sudo[2939661]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 14:10:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:48 nativespace-cdp sudo[2939664]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 14:10:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:48 nativespace-cdp sudo[2939667]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 14:10:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:57 nativespace-cdp sudo[2939693]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 14:10:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:10:59 nativespace-cdp sudo[2939697]: pam_unix(sudo:session): session closed for user root
Sep  6 14:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bakery user-2=sosevalu user-3=crrtipdl user-4=boldover user-5=nove user-6=design user-7=ladburyp user-8=stagingerris user-9=dancinggardener user-10=kategilpin user-11=sketchy user-12=cath user-13=havantho user-14=nvihkvu user-15=oubpgvbx user-16=tstardom user-17=what user-18=careers user-19=nbhavers user-20=david user-21=chrisdal user-22=mcdermos user-23=jennimil user-24=tomandle user-25=romaldki user-26=outdoorc user-27=hodgsonmail user-28=ranxterc user-29=branko user-30=onlycont user-31=attlebor user-32=lucy user-33=hidden user-34=nomistakes user-35=barbersh user-36=tigerlet user-37=isleofwi user-38=smrszyqg user-39=lkpier user-40=ctedorgu user-41=philmcph user-42=firstre5 user-43=donnychicago user-44=steakbridieme user-45=putterfc user-46=nscdp user-47=fortunaz user-48=health2045
Sep  6 14:10:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=leftie user-50=foods user-51=eugincou user-52=courseme user-53=hirefootballgame user-54=howardon user-55=paulmca1 user-56=pugwash user-57=cwsocial user-58=cambria1 user-59=cathski user-60=reliable user-61=ninejimm user-62=steve user-63=bwppodcast user-64=zebrapho user-65=asandcoc user-66=sibtoncc user-67=dhyana user-68=beauty user-69=eatspam user-70=darkstar user-71=nsceres user-72=burydropin user-73=fawcettd user-74=ggaaorgu user-75=belle user-76=newstoda user-77=bemadonn user-78=bedfords user-79=firstre2 user-80=vivienn1 user-81=battlere user-82=oneoarco user-83=brighto1 user-84=nstriton user-85=nativene user-86=innovat1 user-87=stuartge user-88=askhform user-89=skyfirec user-90=alexadmin user-91=firstred user-92=southlon user-93=highlegh user-94=firstrel user-95=clarkass user-96=costestimatorco user-97=opaiscyx user-98=coursemc user-99=seftvta user-100=jonhartl user-101=ultbcrra user-102=firstres
Sep  6 14:10:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=connectedshoppin user-104=thqkgnbz user-105=accooper user-106=ianrayne user-107=hubmaster user-108=putterfi user-109=carsinyo user-110=fetch user-111=gilpin user-112=milloyco user-113=elecleis user-114=musorguk user-115=megacards user-116=wilsonsw user-117=strathar user-118=sarafoundation user-119=atestord user-120=lakesan1 user-121=brmrjxl user-122=magichat user-123=lbhyisi user-124=hhdugcor user-125=dickemery123 user-126=ptkxhsbt user-127=martsblo user-128=ulsukarm user-129=connect9 user-130=athenare user-131=vantagep user-132=maflemin user-133=lbscrmod user-134=foundation user-135=booff user-136=markward user-137=stephani user-138=leereyn1 user-139=still user-140=agproduc user-141=spectrum user-142=theblack user-143=hodgesonweb user-144=jarvisin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 14:10:59 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 14:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:11:01 nativespace-cdp sudo[2939708]: pam_unix(sudo:session): session closed for user root
Sep  6 14:11:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 14:11:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:11:01 nativespace-cdp sudo[2939723]: pam_unix(sudo:session): session closed for user root
Sep  6 14:11:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Fg1pJfBEyLUfLo0z.~
Sep  6 14:11:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:11:02 nativespace-cdp sudo[2939726]: pam_unix(sudo:session): session closed for user root
Sep  6 14:11:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Fg1pJfBEyLUfLo0z.~'
Sep  6 14:11:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:11:02 nativespace-cdp sudo[2939729]: pam_unix(sudo:session): session closed for user root
Sep  6 14:11:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Fg1pJfBEyLUfLo0z.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 14:11:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:11:02 nativespace-cdp sudo[2939733]: pam_unix(sudo:session): session closed for user root
Sep  6 14:11:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 14:11:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:11:02 nativespace-cdp sudo[2939736]: pam_unix(sudo:session): session closed for user root
Sep  6 14:11:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 14:11:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 14:11:15 nativespace-cdp sudo[2939781]: pam_unix(sudo:session): session closed for user root
Sep  6 14:11:33 nativespace-cdp sshd[2939821]: Connection closed by 159.100.136.21 port 46928 [preauth]
Sep  6 14:12:11 nativespace-cdp sshd[2939927]: Accepted publickey for root from 185.67.178.249 port 47166 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  6 14:12:11 nativespace-cdp sshd[2939927]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  6 14:16:34 nativespace-cdp sshd[2941711]: Connection closed by 159.100.136.21 port 56840 [preauth]
Sep  6 14:21:35 nativespace-cdp sshd[2942881]: Connection closed by 159.100.136.21 port 37742 [preauth]
Sep  6 14:26:37 nativespace-cdp sshd[2944046]: Connection closed by 159.100.136.21 port 46816 [preauth]
Sep  6 14:31:33 nativespace-cdp sshd[2945187]: Connection closed by 159.100.136.21 port 55690 [preauth]
Sep  6 14:36:34 nativespace-cdp sshd[2946325]: Connection closed by 159.100.136.21 port 36304 [preauth]
Sep  6 14:41:34 nativespace-cdp sshd[2947512]: Connection closed by 159.100.136.21 port 45724 [preauth]
Sep  6 14:46:36 nativespace-cdp sshd[2948684]: Connection closed by 159.100.136.21 port 55548 [preauth]
Sep  6 14:51:33 nativespace-cdp sshd[2949764]: Connection closed by 159.100.136.21 port 36358 [preauth]
Sep  6 14:56:34 nativespace-cdp sshd[2951031]: Connection closed by 159.100.136.21 port 45926 [preauth]
Sep  6 15:01:35 nativespace-cdp sshd[2952378]: Connection closed by 159.100.136.21 port 55184 [preauth]
Sep  6 15:06:33 nativespace-cdp sshd[2953601]: Connection closed by 159.100.136.21 port 35622 [preauth]
Sep  6 15:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 15:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:30 nativespace-cdp sudo[2954416]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 15:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:30 nativespace-cdp sudo[2954420]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 15:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:33 nativespace-cdp sudo[2954423]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 15:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:33 nativespace-cdp sudo[2954463]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 15:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:44 nativespace-cdp sudo[2954466]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 15:10:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:44 nativespace-cdp sudo[2954548]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 15:10:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:44 nativespace-cdp sudo[2954551]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 15:10:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:44 nativespace-cdp sudo[2954554]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 15:10:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:44 nativespace-cdp sudo[2954557]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 15:10:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:44 nativespace-cdp sudo[2954560]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 15:10:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:44 nativespace-cdp sudo[2954563]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 15:10:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:52 nativespace-cdp sudo[2954582]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 15:10:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:55 nativespace-cdp sudo[2954588]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jennimil user-2=tomandle user-3=nbhavers user-4=careers user-5=david user-6=chrisdal user-7=mcdermos user-8=onlycont user-9=attlebor user-10=lucy user-11=romaldki user-12=outdoorc user-13=hodgsonmail user-14=ranxterc user-15=branko user-16=boldover user-17=nove user-18=bakery user-19=sosevalu user-20=crrtipdl user-21=sketchy user-22=cath user-23=havantho user-24=nvihkvu user-25=tstardom user-26=oubpgvbx user-27=what user-28=design user-29=ladburyp user-30=stagingerris user-31=dancinggardener user-32=kategilpin user-33=sibtoncc user-34=asandcoc user-35=steve user-36=bwppodcast user-37=zebrapho user-38=nsceres user-39=burydropin user-40=fawcettd user-41=dhyana user-42=beauty user-43=eatspam user-44=darkstar user-45=lkpier user-46=ctedorgu user-47=philmcph user-48=firstre5 user-49=donnychicago
Sep  6 15:10:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=steakbridieme user-51=putterfc user-52=nscdp user-53=fortunaz user-54=health2045 user-55=leftie user-56=foods user-57=hidden user-58=nomistakes user-59=tigerlet user-60=barbersh user-61=isleofwi user-62=smrszyqg user-63=paulmca1 user-64=howardon user-65=pugwash user-66=cwsocial user-67=cathski user-68=cambria1 user-69=reliable user-70=ninejimm user-71=eugincou user-72=courseme user-73=hirefootballgame user-74=coursemc user-75=opaiscyx user-76=seftvta user-77=jonhartl user-78=ultbcrra user-79=firstres user-80=firstred user-81=southlon user-82=highlegh user-83=firstrel user-84=clarkass user-85=costestimatorco user-86=putterfi user-87=hubmaster user-88=carsinyo user-89=fetch user-90=milloyco user-91=gilpin user-92=elecleis user-93=connectedshoppin user-94=thqkgnbz user-95=accooper user-96=ianrayne user-97=firstre2 user-98=vivienn1 user-99=battlere user-100=oneoarco user-101=brighto1 user-102=nstriton
Sep  6 15:10:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ggaaorgu user-104=belle user-105=newstoda user-106=bemadonn user-107=bedfords user-108=skyfirec user-109=alexadmin user-110=nativene user-111=innovat1 user-112=stuartge user-113=askhform user-114=connect9 user-115=athenare user-116=vantagep user-117=maflemin user-118=lbscrmod user-119=booff user-120=markward user-121=foundation user-122=ulsukarm user-123=spectrum user-124=theblack user-125=hodgesonweb user-126=jarvisin user-127=stephani user-128=leereyn1 user-129=still user-130=agproduc user-131=strathar user-132=sarafoundation user-133=atestord user-134=lakesan1 user-135=brmrjxl user-136=musorguk user-137=megacards user-138=wilsonsw user-139=dickemery123 user-140=ptkxhsbt user-141=martsblo user-142=magichat user-143=lbhyisi user-144=hhdugcor feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 15:10:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 15:10:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:56 nativespace-cdp sudo[2954595]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 15:10:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:57 nativespace-cdp sudo[2954605]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-0cu4KFKZSfyuHk5y.~
Sep  6 15:10:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:57 nativespace-cdp sudo[2954609]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-0cu4KFKZSfyuHk5y.~'
Sep  6 15:10:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:57 nativespace-cdp sudo[2954612]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-0cu4KFKZSfyuHk5y.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 15:10:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:57 nativespace-cdp sudo[2954616]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 15:10:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:10:57 nativespace-cdp sudo[2954619]: pam_unix(sudo:session): session closed for user root
Sep  6 15:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 15:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 15:11:00 nativespace-cdp sudo[2954638]: pam_unix(sudo:session): session closed for user root
Sep  6 15:11:33 nativespace-cdp sshd[2954743]: Connection closed by 159.100.136.21 port 45248 [preauth]
Sep  6 15:16:33 nativespace-cdp sshd[2955830]: Connection closed by 159.100.136.21 port 54840 [preauth]
Sep  6 15:16:44 nativespace-cdp sshd[2955881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.211.7  user=root
Sep  6 15:16:44 nativespace-cdp sshd[2955881]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 15:16:46 nativespace-cdp sshd[2955881]: Failed password for root from 188.166.211.7 port 41518 ssh2
Sep  6 15:16:46 nativespace-cdp sshd[2955881]: Received disconnect from 188.166.211.7 port 41518:11: Bye Bye [preauth]
Sep  6 15:16:46 nativespace-cdp sshd[2955881]: Disconnected from 188.166.211.7 port 41518 [preauth]
Sep  6 15:17:50 nativespace-cdp sshd[2956170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.86.29.35  user=root
Sep  6 15:17:50 nativespace-cdp sshd[2956170]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 15:17:51 nativespace-cdp sshd[2956170]: Failed password for root from 220.86.29.35 port 13928 ssh2
Sep  6 15:17:52 nativespace-cdp sshd[2956170]: Received disconnect from 220.86.29.35 port 13928:11: Bye Bye [preauth]
Sep  6 15:17:52 nativespace-cdp sshd[2956170]: Disconnected from 220.86.29.35 port 13928 [preauth]
Sep  6 15:18:02 nativespace-cdp sshd[2956275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.242.218.162  user=root
Sep  6 15:18:02 nativespace-cdp sshd[2956275]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 15:18:04 nativespace-cdp sshd[2956275]: Failed password for root from 38.242.218.162 port 43850 ssh2
Sep  6 15:18:04 nativespace-cdp sshd[2956275]: Received disconnect from 38.242.218.162 port 43850:11: Bye Bye [preauth]
Sep  6 15:18:04 nativespace-cdp sshd[2956275]: Disconnected from 38.242.218.162 port 43850 [preauth]
Sep  6 15:18:45 nativespace-cdp sshd[2956380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.160.148.170  user=root
Sep  6 15:18:45 nativespace-cdp sshd[2956380]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 15:18:47 nativespace-cdp sshd[2956380]: Failed password for root from 103.160.148.170 port 51932 ssh2
Sep  6 15:18:49 nativespace-cdp sshd[2956380]: Received disconnect from 103.160.148.170 port 51932:11: Bye Bye [preauth]
Sep  6 15:18:49 nativespace-cdp sshd[2956380]: Disconnected from 103.160.148.170 port 51932 [preauth]
Sep  6 15:19:53 nativespace-cdp sshd[2956573]: Invalid user rustserver from 103.160.148.170 port 36110
Sep  6 15:19:53 nativespace-cdp sshd[2956573]: input_userauth_request: invalid user rustserver [preauth]
Sep  6 15:19:53 nativespace-cdp sshd[2956573]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 15:19:53 nativespace-cdp sshd[2956573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.160.148.170
Sep  6 15:19:55 nativespace-cdp sshd[2956573]: Failed password for invalid user rustserver from 103.160.148.170 port 36110 ssh2
Sep  6 15:20:00 nativespace-cdp sshd[2956643]: Invalid user hdoop from 38.242.218.162 port 58492
Sep  6 15:20:00 nativespace-cdp sshd[2956643]: input_userauth_request: invalid user hdoop [preauth]
Sep  6 15:20:00 nativespace-cdp sshd[2956643]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 15:20:00 nativespace-cdp sshd[2956643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.242.218.162
Sep  6 15:20:01 nativespace-cdp sshd[2956573]: Received disconnect from 103.160.148.170 port 36110:11: Bye Bye [preauth]
Sep  6 15:20:01 nativespace-cdp sshd[2956573]: Disconnected from 103.160.148.170 port 36110 [preauth]
Sep  6 15:20:01 nativespace-cdp sshd[2956643]: Failed password for invalid user hdoop from 38.242.218.162 port 58492 ssh2
Sep  6 15:20:01 nativespace-cdp sshd[2956643]: Received disconnect from 38.242.218.162 port 58492:11: Bye Bye [preauth]
Sep  6 15:20:01 nativespace-cdp sshd[2956643]: Disconnected from 38.242.218.162 port 58492 [preauth]
Sep  6 15:20:34 nativespace-cdp sshd[2956962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.211.7  user=root
Sep  6 15:20:34 nativespace-cdp sshd[2956962]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 15:20:37 nativespace-cdp sshd[2956962]: Failed password for root from 188.166.211.7 port 43538 ssh2
Sep  6 15:20:37 nativespace-cdp sshd[2956962]: Received disconnect from 188.166.211.7 port 43538:11: Bye Bye [preauth]
Sep  6 15:20:37 nativespace-cdp sshd[2956962]: Disconnected from 188.166.211.7 port 43538 [preauth]
Sep  6 15:20:41 nativespace-cdp sshd[2957048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.160.148.170  user=root
Sep  6 15:20:41 nativespace-cdp sshd[2957048]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 15:20:42 nativespace-cdp sshd[2956631]: Connection closed by 220.86.29.35 port 24619 [preauth]
Sep  6 15:20:43 nativespace-cdp sshd[2957048]: Failed password for root from 103.160.148.170 port 55376 ssh2
Sep  6 15:20:43 nativespace-cdp sshd[2957077]: Invalid user jake from 38.242.218.162 port 38830
Sep  6 15:20:43 nativespace-cdp sshd[2957077]: input_userauth_request: invalid user jake [preauth]
Sep  6 15:20:43 nativespace-cdp sshd[2957077]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 15:20:43 nativespace-cdp sshd[2957077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.242.218.162
Sep  6 15:20:43 nativespace-cdp sshd[2957048]: Received disconnect from 103.160.148.170 port 55376:11: Bye Bye [preauth]
Sep  6 15:20:43 nativespace-cdp sshd[2957048]: Disconnected from 103.160.148.170 port 55376 [preauth]
Sep  6 15:20:45 nativespace-cdp sshd[2957077]: Failed password for invalid user jake from 38.242.218.162 port 38830 ssh2
Sep  6 15:20:45 nativespace-cdp sshd[2957077]: Received disconnect from 38.242.218.162 port 38830:11: Bye Bye [preauth]
Sep  6 15:20:45 nativespace-cdp sshd[2957077]: Disconnected from 38.242.218.162 port 38830 [preauth]
Sep  6 15:20:51 nativespace-cdp sshd[2957122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.86.29.35  user=root
Sep  6 15:20:51 nativespace-cdp sshd[2957122]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 15:20:54 nativespace-cdp sshd[2957122]: Failed password for root from 220.86.29.35 port 31145 ssh2
Sep  6 15:20:54 nativespace-cdp sshd[2957122]: Received disconnect from 220.86.29.35 port 31145:11: Bye Bye [preauth]
Sep  6 15:20:54 nativespace-cdp sshd[2957122]: Disconnected from 220.86.29.35 port 31145 [preauth]
Sep  6 15:21:32 nativespace-cdp sshd[2957253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.211.7  user=root
Sep  6 15:21:32 nativespace-cdp sshd[2957253]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 15:21:34 nativespace-cdp sshd[2957262]: Connection closed by 159.100.136.21 port 35840 [preauth]
Sep  6 15:21:34 nativespace-cdp sshd[2957253]: Failed password for root from 188.166.211.7 port 56476 ssh2
Sep  6 15:21:34 nativespace-cdp sshd[2957253]: Received disconnect from 188.166.211.7 port 56476:11: Bye Bye [preauth]
Sep  6 15:21:34 nativespace-cdp sshd[2957253]: Disconnected from 188.166.211.7 port 56476 [preauth]
Sep  6 15:21:42 nativespace-cdp sshd[2957271]: Invalid user arnaldo from 220.86.29.35 port 37673
Sep  6 15:21:42 nativespace-cdp sshd[2957271]: input_userauth_request: invalid user arnaldo [preauth]
Sep  6 15:21:42 nativespace-cdp sshd[2957271]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 15:21:42 nativespace-cdp sshd[2957271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.86.29.35
Sep  6 15:21:43 nativespace-cdp sshd[2957271]: Failed password for invalid user arnaldo from 220.86.29.35 port 37673 ssh2
Sep  6 15:21:44 nativespace-cdp sshd[2957271]: Received disconnect from 220.86.29.35 port 37673:11: Bye Bye [preauth]
Sep  6 15:21:44 nativespace-cdp sshd[2957271]: Disconnected from 220.86.29.35 port 37673 [preauth]
Sep  6 15:26:34 nativespace-cdp sshd[2958573]: Connection closed by 159.100.136.21 port 45172 [preauth]
Sep  6 15:31:33 nativespace-cdp sshd[2959748]: Connection closed by 159.100.136.21 port 54506 [preauth]
Sep  6 15:36:37 nativespace-cdp sshd[2960832]: Connection closed by 159.100.136.21 port 35450 [preauth]
Sep  6 15:41:33 nativespace-cdp sshd[2961851]: Connection closed by 159.100.136.21 port 44322 [preauth]
Sep  6 15:46:35 nativespace-cdp sshd[2962999]: Connection closed by 159.100.136.21 port 52896 [preauth]
Sep  6 15:51:34 nativespace-cdp sshd[2964111]: Connection closed by 159.100.136.21 port 34030 [preauth]
Sep  6 15:56:34 nativespace-cdp sshd[2965271]: Connection closed by 159.100.136.21 port 43184 [preauth]
Sep  6 16:01:03 nativespace-cdp CROND[2965686]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep  6 16:01:41 nativespace-cdp sshd[2965969]: Did not receive identification string from 159.100.136.21 port 52534
Sep  6 16:03:49 nativespace-cdp CROND[2966250]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep  6 16:04:53 nativespace-cdp crond[2966370]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 16:07:08 nativespace-cdp sshd[2966650]: Did not receive identification string from 159.100.136.21 port 60306
Sep  6 16:07:18 nativespace-cdp crond[2966627]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 16:07:57 nativespace-cdp CROND[2966446]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep  6 16:08:01 nativespace-cdp crond[2966697]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 16:13:03 nativespace-cdp crond[2967210]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 16:13:09 nativespace-cdp sshd[2967254]: Did not receive identification string from 159.100.136.21 port 41236
Sep  6 16:14:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 16:14:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:14 nativespace-cdp sudo[2967819]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 16:14:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:14 nativespace-cdp sudo[2967823]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 16:14:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:21 nativespace-cdp sudo[2967826]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 16:14:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:21 nativespace-cdp sudo[2967848]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 16:14:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:56 nativespace-cdp sudo[2967851]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 16:14:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:58 nativespace-cdp sudo[2968015]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 16:14:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:58 nativespace-cdp sudo[2968020]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 16:14:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:58 nativespace-cdp sudo[2968024]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 16:14:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:58 nativespace-cdp sudo[2968027]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 16:14:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:58 nativespace-cdp sudo[2968030]: pam_unix(sudo:session): session closed for user root
Sep  6 16:14:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 16:14:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:14:59 nativespace-cdp sudo[2968033]: pam_unix(sudo:session): session closed for user root
Sep  6 16:15:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 16:15:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:15:17 nativespace-cdp sudo[2968146]: pam_unix(sudo:session): session closed for user root
Sep  6 16:15:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 16:15:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:15:27 nativespace-cdp sudo[2968188]: pam_unix(sudo:session): session closed for user root
Sep  6 16:15:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=booff user-3=markward user-4=foundation user-5=lbscrmod user-6=maflemin user-7=vantagep user-8=connect9 user-9=athenare user-10=agproduc user-11=still user-12=leereyn1 user-13=stephani user-14=jarvisin user-15=theblack user-16=hodgesonweb user-17=spectrum user-18=wilsonsw user-19=megacards user-20=musorguk user-21=brmrjxl user-22=lakesan1 user-23=atestord user-24=sarafoundation user-25=strathar user-26=hhdugcor user-27=lbhyisi user-28=magichat user-29=martsblo user-30=ptkxhsbt user-31=dickemery123 user-32=costestimatorco user-33=clarkass user-34=firstrel user-35=highlegh user-36=southlon user-37=firstred user-38=firstres user-39=ultbcrra user-40=seftvta user-41=jonhartl user-42=opaiscyx user-43=coursemc user-44=ianrayne user-45=accooper user-46=thqkgnbz user-47=connectedshoppin
Sep  6 16:15:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=elecleis user-49=gilpin user-50=milloyco user-51=fetch user-52=carsinyo user-53=hubmaster user-54=putterfi user-55=bedfords user-56=bemadonn user-57=newstoda user-58=ggaaorgu user-59=belle user-60=nstriton user-61=brighto1 user-62=oneoarco user-63=battlere user-64=vivienn1 user-65=firstre2 user-66=askhform user-67=stuartge user-68=innovat1 user-69=nativene user-70=skyfirec user-71=alexadmin user-72=zebrapho user-73=bwppodcast user-74=steve user-75=sibtoncc user-76=asandcoc user-77=darkstar user-78=eatspam user-79=beauty user-80=dhyana user-81=fawcettd user-82=burydropin user-83=nsceres user-84=smrszyqg user-85=isleofwi user-86=barbersh user-87=tigerlet user-88=nomistakes user-89=hidden user-90=leftie user-91=foods user-92=fortunaz user-93=health2045 user-94=nscdp user-95=putterfc user-96=donnychicago user-97=firstre5 user-98=steakbridieme user-99=ctedorgu user-100=philmcph user-101=lkpier
Sep  6 16:15:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hirefootballgame user-103=courseme user-104=eugincou user-105=reliable user-106=ninejimm user-107=cambria1 user-108=cathski user-109=cwsocial user-110=howardon user-111=paulmca1 user-112=pugwash user-113=mcdermos user-114=chrisdal user-115=david user-116=careers user-117=nbhavers user-118=tomandle user-119=jennimil user-120=branko user-121=ranxterc user-122=outdoorc user-123=hodgsonmail user-124=romaldki user-125=lucy user-126=attlebor user-127=onlycont user-128=crrtipdl user-129=sosevalu user-130=bakery user-131=nove user-132=boldover user-133=kategilpin user-134=dancinggardener user-135=stagingerris user-136=ladburyp user-137=design user-138=what user-139=oubpgvbx user-140=tstardom user-141=nvihkvu user-142=havantho user-143=sketchy user-144=cath feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 16:15:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 16:15:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:15:35 nativespace-cdp sudo[2968225]: pam_unix(sudo:session): session closed for user root
Sep  6 16:15:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 16:15:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:15:37 nativespace-cdp sudo[2968284]: pam_unix(sudo:session): session closed for user root
Sep  6 16:15:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-IxZezxya3hKroogs.~
Sep  6 16:15:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:15:37 nativespace-cdp sudo[2968287]: pam_unix(sudo:session): session closed for user root
Sep  6 16:15:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-IxZezxya3hKroogs.~'
Sep  6 16:15:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:15:37 nativespace-cdp sudo[2968290]: pam_unix(sudo:session): session closed for user root
Sep  6 16:15:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-IxZezxya3hKroogs.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 16:15:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:15:37 nativespace-cdp sudo[2968294]: pam_unix(sudo:session): session closed for user root
Sep  6 16:15:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 16:15:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:15:37 nativespace-cdp sudo[2968298]: pam_unix(sudo:session): session closed for user root
Sep  6 16:16:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 16:16:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 16:16:32 nativespace-cdp sudo[2968530]: pam_unix(sudo:session): session closed for user root
Sep  6 16:16:37 nativespace-cdp sshd[2968543]: Connection closed by 159.100.136.21 port 49592 [preauth]
Sep  6 16:21:33 nativespace-cdp sshd[2969645]: Connection closed by 159.100.136.21 port 58012 [preauth]
Sep  6 16:26:37 nativespace-cdp sshd[2970804]: Connection closed by 159.100.136.21 port 39466 [preauth]
Sep  6 16:31:35 nativespace-cdp sshd[2971967]: Connection closed by 159.100.136.21 port 48842 [preauth]
Sep  6 16:36:33 nativespace-cdp sshd[2973228]: Connection closed by 159.100.136.21 port 58528 [preauth]
Sep  6 16:41:33 nativespace-cdp sshd[2974397]: Connection closed by 159.100.136.21 port 39050 [preauth]
Sep  6 16:46:33 nativespace-cdp sshd[2975534]: Connection closed by 159.100.136.21 port 48564 [preauth]
Sep  6 16:51:34 nativespace-cdp sshd[2976659]: Connection closed by 159.100.136.21 port 58046 [preauth]
Sep  6 16:56:33 nativespace-cdp sshd[2977859]: Connection closed by 159.100.136.21 port 39018 [preauth]
Sep  6 17:01:36 nativespace-cdp sshd[2979113]: Connection closed by 159.100.136.21 port 47906 [preauth]
Sep  6 17:06:33 nativespace-cdp sshd[2980195]: Connection closed by 159.100.136.21 port 57376 [preauth]
Sep  6 17:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 17:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:16 nativespace-cdp sudo[2980946]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 17:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:16 nativespace-cdp sudo[2980949]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 17:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:18 nativespace-cdp sudo[2980952]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 17:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:18 nativespace-cdp sudo[2980961]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 17:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:42 nativespace-cdp sudo[2980964]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 17:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:43 nativespace-cdp sudo[2981039]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 17:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:43 nativespace-cdp sudo[2981043]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 17:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:43 nativespace-cdp sudo[2981046]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 17:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:43 nativespace-cdp sudo[2981049]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 17:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:43 nativespace-cdp sudo[2981053]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 17:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:44 nativespace-cdp sudo[2981057]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 17:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:09:55 nativespace-cdp sudo[2981091]: pam_unix(sudo:session): session closed for user root
Sep  6 17:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 17:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:10:03 nativespace-cdp sudo[2981112]: pam_unix(sudo:session): session closed for user root
Sep  6 17:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=seftvta user-2=jonhartl user-3=ultbcrra user-4=firstres user-5=opaiscyx user-6=coursemc user-7=firstrel user-8=clarkass user-9=costestimatorco user-10=firstred user-11=southlon user-12=highlegh user-13=milloyco user-14=gilpin user-15=elecleis user-16=hubmaster user-17=putterfi user-18=carsinyo user-19=fetch user-20=accooper user-21=ianrayne user-22=connectedshoppin user-23=thqkgnbz user-24=brighto1 user-25=nstriton user-26=firstre2 user-27=vivienn1 user-28=battlere user-29=oneoarco user-30=bedfords user-31=belle user-32=ggaaorgu user-33=newstoda user-34=bemadonn user-35=skyfirec user-36=alexadmin user-37=innovat1 user-38=stuartge user-39=askhform user-40=nativene user-41=foundation user-42=booff user-43=markward user-44=athenare user-45=connect9 user-46=vantagep user-47=maflemin user-48=lbscrmod
Sep  6 17:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=jarvisin user-51=spectrum user-52=theblack user-53=hodgesonweb user-54=still user-55=agproduc user-56=stephani user-57=leereyn1 user-58=lakesan1 user-59=brmrjxl user-60=strathar user-61=sarafoundation user-62=atestord user-63=wilsonsw user-64=musorguk user-65=megacards user-66=martsblo user-67=dickemery123 user-68=ptkxhsbt user-69=lbhyisi user-70=hhdugcor user-71=magichat user-72=tomandle user-73=jennimil user-74=chrisdal user-75=mcdermos user-76=careers user-77=nbhavers user-78=david user-79=attlebor user-80=lucy user-81=onlycont user-82=hodgsonmail user-83=ranxterc user-84=outdoorc user-85=branko user-86=romaldki user-87=nove user-88=boldover user-89=bakery user-90=sosevalu user-91=crrtipdl user-92=oubpgvbx user-93=tstardom user-94=what user-95=cath user-96=sketchy user-97=havantho user-98=nvihkvu user-99=ladburyp user-100=stagingerris user-101=dancinggardener user-102=kategilpin
Sep  6 17:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=design user-104=asandcoc user-105=sibtoncc user-106=bwppodcast user-107=zebrapho user-108=steve user-109=burydropin user-110=fawcettd user-111=nsceres user-112=beauty user-113=eatspam user-114=darkstar user-115=dhyana user-116=putterfc user-117=nscdp user-118=fortunaz user-119=health2045 user-120=leftie user-121=foods user-122=lkpier user-123=philmcph user-124=ctedorgu user-125=steakbridieme user-126=firstre5 user-127=donnychicago user-128=isleofwi user-129=smrszyqg user-130=hidden user-131=nomistakes user-132=barbersh user-133=tigerlet user-134=cathski user-135=cambria1 user-136=ninejimm user-137=reliable user-138=pugwash user-139=paulmca1 user-140=howardon user-141=cwsocial user-142=hirefootballgame user-143=eugincou user-144=courseme feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 17:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 17:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:10:08 nativespace-cdp sudo[2981214]: pam_unix(sudo:session): session closed for user root
Sep  6 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:10:09 nativespace-cdp sudo[2981262]: pam_unix(sudo:session): session closed for user root
Sep  6 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Rpl6zn4d5ODDmAqA.~
Sep  6 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:10:09 nativespace-cdp sudo[2981265]: pam_unix(sudo:session): session closed for user root
Sep  6 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Rpl6zn4d5ODDmAqA.~'
Sep  6 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:10:09 nativespace-cdp sudo[2981269]: pam_unix(sudo:session): session closed for user root
Sep  6 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Rpl6zn4d5ODDmAqA.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:10:09 nativespace-cdp sudo[2981273]: pam_unix(sudo:session): session closed for user root
Sep  6 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:10:09 nativespace-cdp sudo[2981277]: pam_unix(sudo:session): session closed for user root
Sep  6 17:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 17:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 17:10:24 nativespace-cdp sudo[2981326]: pam_unix(sudo:session): session closed for user root
Sep  6 17:11:34 nativespace-cdp sshd[2981560]: Connection closed by 159.100.136.21 port 36492 [preauth]
Sep  6 17:16:33 nativespace-cdp sshd[2982727]: Connection closed by 159.100.136.21 port 45692 [preauth]
Sep  6 17:21:34 nativespace-cdp sshd[2983915]: Connection closed by 159.100.136.21 port 55092 [preauth]
Sep  6 17:26:33 nativespace-cdp sshd[2984956]: Connection closed by 159.100.136.21 port 36070 [preauth]
Sep  6 17:31:36 nativespace-cdp sshd[2986120]: Connection closed by 159.100.136.21 port 45524 [preauth]
Sep  6 17:36:35 nativespace-cdp sshd[2987410]: Connection closed by 159.100.136.21 port 55330 [preauth]
Sep  6 17:40:30 nativespace-cdp sshd[2988301]: Invalid user deb from 142.4.2.25 port 40068
Sep  6 17:40:30 nativespace-cdp sshd[2988301]: input_userauth_request: invalid user deb [preauth]
Sep  6 17:40:30 nativespace-cdp sshd[2988301]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 17:40:30 nativespace-cdp sshd[2988301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.2.25
Sep  6 17:40:32 nativespace-cdp sshd[2988301]: Failed password for invalid user deb from 142.4.2.25 port 40068 ssh2
Sep  6 17:40:34 nativespace-cdp sshd[2988301]: Received disconnect from 142.4.2.25 port 40068:11: Bye Bye [preauth]
Sep  6 17:40:34 nativespace-cdp sshd[2988301]: Disconnected from 142.4.2.25 port 40068 [preauth]
Sep  6 17:41:32 nativespace-cdp sshd[2988494]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.212.249.122  user=root
Sep  6 17:41:32 nativespace-cdp sshd[2988494]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 17:41:33 nativespace-cdp sshd[2988498]: Connection closed by 159.100.136.21 port 35386 [preauth]
Sep  6 17:41:34 nativespace-cdp sshd[2988494]: Failed password for root from 173.212.249.122 port 47382 ssh2
Sep  6 17:41:34 nativespace-cdp sshd[2988494]: Received disconnect from 173.212.249.122 port 47382:11: Bye Bye [preauth]
Sep  6 17:41:34 nativespace-cdp sshd[2988494]: Disconnected from 173.212.249.122 port 47382 [preauth]
Sep  6 17:42:24 nativespace-cdp sshd[2988668]: Invalid user guy from 177.116.151.5 port 40650
Sep  6 17:42:24 nativespace-cdp sshd[2988668]: input_userauth_request: invalid user guy [preauth]
Sep  6 17:42:24 nativespace-cdp sshd[2988668]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 17:42:24 nativespace-cdp sshd[2988668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.116.151.5
Sep  6 17:42:26 nativespace-cdp sshd[2988668]: Failed password for invalid user guy from 177.116.151.5 port 40650 ssh2
Sep  6 17:42:28 nativespace-cdp sshd[2988668]: Received disconnect from 177.116.151.5 port 40650:11: Bye Bye [preauth]
Sep  6 17:42:28 nativespace-cdp sshd[2988668]: Disconnected from 177.116.151.5 port 40650 [preauth]
Sep  6 17:44:11 nativespace-cdp sshd[2989128]: Invalid user tiansiyuan from 122.54.18.220 port 44993
Sep  6 17:44:11 nativespace-cdp sshd[2989128]: input_userauth_request: invalid user tiansiyuan [preauth]
Sep  6 17:44:11 nativespace-cdp sshd[2989128]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 17:44:11 nativespace-cdp sshd[2989128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220
Sep  6 17:44:14 nativespace-cdp sshd[2989128]: Failed password for invalid user tiansiyuan from 122.54.18.220 port 44993 ssh2
Sep  6 17:44:14 nativespace-cdp sshd[2989128]: Received disconnect from 122.54.18.220 port 44993:11: Bye Bye [preauth]
Sep  6 17:44:14 nativespace-cdp sshd[2989128]: Disconnected from 122.54.18.220 port 44993 [preauth]
Sep  6 17:46:32 nativespace-cdp crond[2989970]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 17:46:45 nativespace-cdp sshd[2990000]: Did not receive identification string from 159.100.136.21 port 45048
Sep  6 17:47:59 nativespace-cdp sshd[2990160]: Connection closed by 202.70.65.229 port 34308 [preauth]
Sep  6 17:49:21 nativespace-cdp CROND[2990061]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep  6 17:50:58 nativespace-cdp sshd[2990243]: ssh_dispatch_run_fatal: Connection from 122.54.18.220 port 47938: Broken pipe [preauth]
Sep  6 17:50:58 nativespace-cdp sshd[2990222]: Connection closed by 173.212.249.122 port 57062 [preauth]
Sep  6 17:50:58 nativespace-cdp sshd[2990284]: ssh_dispatch_run_fatal: Connection from 173.212.249.122 port 59612: Broken pipe [preauth]
Sep  6 17:50:58 nativespace-cdp sshd[2990240]: Connection closed by 142.4.2.25 port 55544 [preauth]
Sep  6 17:50:58 nativespace-cdp sshd[2990210]: Connection closed by 122.54.18.220 port 33277 [preauth]
Sep  6 17:50:58 nativespace-cdp sshd[2990231]: Connection closed by 122.54.18.220 port 32274 [preauth]
Sep  6 17:50:58 nativespace-cdp sshd[2990235]: Connection closed by 173.212.249.122 port 44206 [preauth]
Sep  6 17:50:58 nativespace-cdp sshd[2990285]: ssh_dispatch_run_fatal: Connection from 142.4.2.25 port 36384: Broken pipe [preauth]
Sep  6 17:50:58 nativespace-cdp sshd[2990208]: Connection closed by 142.4.2.25 port 45650 [preauth]
Sep  6 17:50:58 nativespace-cdp sshd[2990224]: Connection closed by 142.4.2.25 port 54462 [preauth]
Sep  6 17:51:00 nativespace-cdp sshd[2990356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.212.249.122  user=root
Sep  6 17:51:00 nativespace-cdp sshd[2990356]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 17:51:01 nativespace-cdp sshd[2990378]: Invalid user zm from 142.4.2.25 port 38344
Sep  6 17:51:01 nativespace-cdp sshd[2990378]: input_userauth_request: invalid user zm [preauth]
Sep  6 17:51:01 nativespace-cdp sshd[2990378]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 17:51:01 nativespace-cdp sshd[2990378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.2.25
Sep  6 17:51:03 nativespace-cdp sshd[2990356]: Failed password for root from 173.212.249.122 port 46754 ssh2
Sep  6 17:51:03 nativespace-cdp sshd[2990378]: Failed password for invalid user zm from 142.4.2.25 port 38344 ssh2
Sep  6 17:51:05 nativespace-cdp sshd[2990378]: Received disconnect from 142.4.2.25 port 38344:11: Bye Bye [preauth]
Sep  6 17:51:05 nativespace-cdp sshd[2990378]: Disconnected from 142.4.2.25 port 38344 [preauth]
Sep  6 17:51:11 nativespace-cdp sshd[2990356]: Received disconnect from 173.212.249.122 port 46754:11: Bye Bye [preauth]
Sep  6 17:51:11 nativespace-cdp sshd[2990356]: Disconnected from 173.212.249.122 port 46754 [preauth]
Sep  6 17:51:36 nativespace-cdp sshd[2990621]: Connection closed by 159.100.136.21 port 54122 [preauth]
Sep  6 17:51:38 nativespace-cdp sshd[2990610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220  user=root
Sep  6 17:51:38 nativespace-cdp sshd[2990610]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 17:51:40 nativespace-cdp sshd[2990610]: Failed password for root from 122.54.18.220 port 22762 ssh2
Sep  6 17:51:40 nativespace-cdp sshd[2990610]: Received disconnect from 122.54.18.220 port 22762:11: Bye Bye [preauth]
Sep  6 17:51:40 nativespace-cdp sshd[2990610]: Disconnected from 122.54.18.220 port 22762 [preauth]
Sep  6 17:51:42 nativespace-cdp sshd[2990670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.2.25  user=root
Sep  6 17:51:42 nativespace-cdp sshd[2990670]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 17:51:44 nativespace-cdp sshd[2990670]: Failed password for root from 142.4.2.25 port 53444 ssh2
Sep  6 17:51:47 nativespace-cdp sshd[2990670]: Received disconnect from 142.4.2.25 port 53444:11: Bye Bye [preauth]
Sep  6 17:51:47 nativespace-cdp sshd[2990670]: Disconnected from 142.4.2.25 port 53444 [preauth]
Sep  6 17:52:23 nativespace-cdp sshd[2991030]: Invalid user naemon from 122.54.18.220 port 10159
Sep  6 17:52:24 nativespace-cdp sshd[2991030]: input_userauth_request: invalid user naemon [preauth]
Sep  6 17:53:16 nativespace-cdp sshd[2991030]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 17:53:16 nativespace-cdp sshd[2991030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220
Sep  6 17:53:18 nativespace-cdp sshd[2991030]: Failed password for invalid user naemon from 122.54.18.220 port 10159 ssh2
Sep  6 17:53:19 nativespace-cdp sshd[2991030]: Received disconnect from 122.54.18.220 port 10159:11: Bye Bye [preauth]
Sep  6 17:53:19 nativespace-cdp sshd[2991030]: Disconnected from 122.54.18.220 port 10159 [preauth]
Sep  6 17:53:51 nativespace-cdp crond[2991094]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  6 17:57:23 nativespace-cdp sshd[2991310]: Did not receive identification string from 159.100.136.21 port 35440
Sep  6 17:58:14 nativespace-cdp sshd[2991206]: Connection closed by 173.212.249.122 port 36486 [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991312]: ssh_dispatch_run_fatal: Connection from 173.212.249.122 port 54404: Broken pipe [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991231]: Connection closed by 122.54.18.220 port 47753 [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991327]: ssh_dispatch_run_fatal: Connection from 122.54.18.220 port 24144: Broken pipe [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991356]: ssh_dispatch_run_fatal: Connection from 177.116.151.5 port 36574: Broken pipe [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991250]: Connection closed by 177.116.151.5 port 37622 [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991233]: Connection closed by 173.212.249.122 port 51886 [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991160]: Connection closed by 173.212.249.122 port 49344 [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991181]: Connection closed by 177.116.151.5 port 40228 [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991279]: Connection closed by 173.212.249.122 port 39032 [preauth]
Sep  6 17:58:14 nativespace-cdp sshd[2991164]: Connection closed by 122.54.18.220 port 42730 [preauth]
Sep  6 17:58:17 nativespace-cdp sshd[2991430]: Connection closed by 122.54.18.220 port 39934 [preauth]
Sep  6 17:58:20 nativespace-cdp sshd[2991465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.212.249.122  user=root
Sep  6 17:58:20 nativespace-cdp sshd[2991465]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 17:58:22 nativespace-cdp sshd[2991465]: Failed password for root from 173.212.249.122 port 56926 ssh2
Sep  6 17:58:22 nativespace-cdp sshd[2991465]: Received disconnect from 173.212.249.122 port 56926:11: Bye Bye [preauth]
Sep  6 17:58:22 nativespace-cdp sshd[2991465]: Disconnected from 173.212.249.122 port 56926 [preauth]
Sep  6 17:58:22 nativespace-cdp sshd[2991581]: Invalid user guy from 122.54.18.220 port 48957
Sep  6 17:58:22 nativespace-cdp sshd[2991581]: input_userauth_request: invalid user guy [preauth]
Sep  6 17:58:22 nativespace-cdp sshd[2991581]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 17:58:22 nativespace-cdp sshd[2991581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220
Sep  6 17:58:24 nativespace-cdp sshd[2991581]: Failed password for invalid user guy from 122.54.18.220 port 48957 ssh2
Sep  6 17:58:24 nativespace-cdp sshd[2991581]: Received disconnect from 122.54.18.220 port 48957:11: Bye Bye [preauth]
Sep  6 17:58:24 nativespace-cdp sshd[2991581]: Disconnected from 122.54.18.220 port 48957 [preauth]
Sep  6 17:58:40 nativespace-cdp sshd[2991823]: Invalid user selim from 177.116.151.5 port 44476
Sep  6 17:58:40 nativespace-cdp sshd[2991823]: input_userauth_request: invalid user selim [preauth]
Sep  6 17:58:40 nativespace-cdp sshd[2991823]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 17:58:40 nativespace-cdp sshd[2991823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.116.151.5
Sep  6 17:58:42 nativespace-cdp sshd[2991823]: Failed password for invalid user selim from 177.116.151.5 port 44476 ssh2
Sep  6 17:58:46 nativespace-cdp sshd[2991823]: Received disconnect from 177.116.151.5 port 44476:11: Bye Bye [preauth]
Sep  6 17:58:46 nativespace-cdp sshd[2991823]: Disconnected from 177.116.151.5 port 44476 [preauth]
Sep  6 18:00:22 nativespace-cdp sshd[2992352]: Invalid user kim from 177.116.151.5 port 35440
Sep  6 18:00:22 nativespace-cdp sshd[2992352]: input_userauth_request: invalid user kim [preauth]
Sep  6 18:00:24 nativespace-cdp sshd[2992352]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:00:24 nativespace-cdp sshd[2992352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.116.151.5
Sep  6 18:00:26 nativespace-cdp sshd[2992352]: Failed password for invalid user kim from 177.116.151.5 port 35440 ssh2
Sep  6 18:00:26 nativespace-cdp sshd[2992352]: Received disconnect from 177.116.151.5 port 35440:11: Bye Bye [preauth]
Sep  6 18:00:26 nativespace-cdp sshd[2992352]: Disconnected from 177.116.151.5 port 35440 [preauth]
Sep  6 18:01:36 nativespace-cdp sshd[2992755]: Connection closed by 159.100.136.21 port 45110 [preauth]
Sep  6 18:02:18 nativespace-cdp polkitd[1948347]: Registered Authentication Agent for unix-process:2992923:495080885 (system bus name :1.1115665 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Sep  6 18:03:04 nativespace-cdp polkitd[1948347]: Unregistered Authentication Agent for unix-process:2992923:495080885 (system bus name :1.1115665, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Sep  6 18:04:54 nativespace-cdp polkitd[1948347]: Registered Authentication Agent for unix-process:2993626:495097041 (system bus name :1.1115670 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Sep  6 18:06:32 nativespace-cdp polkitd[1948347]: Unregistered Authentication Agent for unix-process:2993626:495097041 (system bus name :1.1115670, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Sep  6 18:06:33 nativespace-cdp sshd[2994132]: Connection closed by 159.100.136.21 port 54980 [preauth]
Sep  6 18:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 18:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:31 nativespace-cdp sudo[2994699]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 18:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:31 nativespace-cdp sudo[2994702]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 18:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:33 nativespace-cdp sudo[2994705]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 18:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:34 nativespace-cdp sudo[2994714]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 18:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:39 nativespace-cdp sudo[2994717]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:39 nativespace-cdp sudo[2994739]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:39 nativespace-cdp sudo[2994742]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:39 nativespace-cdp sudo[2994745]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:39 nativespace-cdp sudo[2994748]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:39 nativespace-cdp sudo[2994751]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:39 nativespace-cdp sudo[2994754]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:41 nativespace-cdp sudo[2994772]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:43 nativespace-cdp sudo[2994777]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=sibtoncc user-2=asandcoc user-3=zebrapho user-4=bwppodcast user-5=steve user-6=fawcettd user-7=burydropin user-8=nsceres user-9=darkstar user-10=eatspam user-11=beauty user-12=dhyana user-13=foods user-14=leftie user-15=fortunaz user-16=health2045 user-17=nscdp user-18=putterfc user-19=steakbridieme user-20=donnychicago user-21=firstre5 user-22=philmcph user-23=ctedorgu user-24=lkpier user-25=smrszyqg user-26=isleofwi user-27=barbersh user-28=tigerlet user-29=nomistakes user-30=hidden user-31=ninejimm user-32=reliable user-33=cambria1 user-34=cathski user-35=cwsocial user-36=howardon user-37=paulmca1 user-38=pugwash user-39=hirefootballgame user-40=courseme user-41=eugincou user-42=tomandle user-43=jennimil user-44=mcdermos user-45=chrisdal user-46=david user-47=careers user-48=nbhavers
Sep  6 18:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=lucy user-50=attlebor user-51=onlycont user-52=branko user-53=outdoorc user-54=ranxterc user-55=hodgsonmail user-56=romaldki user-57=nove user-58=boldover user-59=crrtipdl user-60=sosevalu user-61=bakery user-62=what user-63=tstardom user-64=oubpgvbx user-65=nvihkvu user-66=havantho user-67=cath user-68=sketchy user-69=kategilpin user-70=dancinggardener user-71=stagingerris user-72=ladburyp user-73=design user-74=booff user-75=foundation user-76=markward user-77=lbscrmod user-78=maflemin user-79=vantagep user-80=connect9 user-81=athenare user-82=ulsukarm user-83=jarvisin user-84=hodgesonweb user-85=theblack user-86=spectrum user-87=agproduc user-88=still user-89=leereyn1 user-90=stephani user-91=brmrjxl user-92=lakesan1 user-93=atestord user-94=sarafoundation user-95=strathar user-96=wilsonsw user-97=megacards user-98=musorguk user-99=martsblo user-100=ptkxhsbt user-101=dickemery123 user-102=hhdugcor
Sep  6 18:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=lbhyisi user-104=magichat user-105=firstres user-106=ultbcrra user-107=jonhartl user-108=seftvta user-109=coursemc user-110=opaiscyx user-111=costestimatorco user-112=clarkass user-113=firstrel user-114=highlegh user-115=southlon user-116=firstred user-117=elecleis user-118=milloyco user-119=gilpin user-120=fetch user-121=carsinyo user-122=hubmaster user-123=putterfi user-124=ianrayne user-125=accooper user-126=thqkgnbz user-127=connectedshoppin user-128=nstriton user-129=brighto1 user-130=oneoarco user-131=battlere user-132=vivienn1 user-133=firstre2 user-134=bedfords user-135=bemadonn user-136=newstoda user-137=ggaaorgu user-138=belle user-139=skyfirec user-140=alexadmin user-141=askhform user-142=stuartge user-143=innovat1 user-144=nativene feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 18:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:44 nativespace-cdp sudo[2994783]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 18:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:45 nativespace-cdp sudo[2994788]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wR3vVRxitMLKWwZJ.~
Sep  6 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:45 nativespace-cdp sudo[2994791]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wR3vVRxitMLKWwZJ.~'
Sep  6 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:45 nativespace-cdp sudo[2994795]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wR3vVRxitMLKWwZJ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:45 nativespace-cdp sudo[2994799]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:45 nativespace-cdp sudo[2994802]: pam_unix(sudo:session): session closed for user root
Sep  6 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 18:09:58 nativespace-cdp sudo[2994848]: pam_unix(sudo:session): session closed for user root
Sep  6 18:11:35 nativespace-cdp sshd[2995295]: Connection closed by 159.100.136.21 port 36286 [preauth]
Sep  6 18:13:12 nativespace-cdp sshd[2995587]: Invalid user mmm from 177.116.104.13 port 49828
Sep  6 18:13:12 nativespace-cdp sshd[2995587]: input_userauth_request: invalid user mmm [preauth]
Sep  6 18:13:12 nativespace-cdp sshd[2995587]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:13:12 nativespace-cdp sshd[2995587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.116.104.13
Sep  6 18:13:14 nativespace-cdp sshd[2995587]: Failed password for invalid user mmm from 177.116.104.13 port 49828 ssh2
Sep  6 18:13:19 nativespace-cdp sshd[2995587]: Received disconnect from 177.116.104.13 port 49828:11: Bye Bye [preauth]
Sep  6 18:13:19 nativespace-cdp sshd[2995587]: Disconnected from 177.116.104.13 port 49828 [preauth]
Sep  6 18:14:40 nativespace-cdp sshd[2995892]: Invalid user vpn from 177.116.104.13 port 56822
Sep  6 18:14:40 nativespace-cdp sshd[2995892]: input_userauth_request: invalid user vpn [preauth]
Sep  6 18:14:40 nativespace-cdp sshd[2995892]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:14:40 nativespace-cdp sshd[2995892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.116.104.13
Sep  6 18:14:42 nativespace-cdp sshd[2995892]: Failed password for invalid user vpn from 177.116.104.13 port 56822 ssh2
Sep  6 18:14:44 nativespace-cdp sshd[2995892]: Received disconnect from 177.116.104.13 port 56822:11: Bye Bye [preauth]
Sep  6 18:14:44 nativespace-cdp sshd[2995892]: Disconnected from 177.116.104.13 port 56822 [preauth]
Sep  6 18:16:07 nativespace-cdp sshd[2996333]: Invalid user naemon from 177.116.104.13 port 37252
Sep  6 18:16:07 nativespace-cdp sshd[2996333]: input_userauth_request: invalid user naemon [preauth]
Sep  6 18:16:07 nativespace-cdp sshd[2996333]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:16:07 nativespace-cdp sshd[2996333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.116.104.13
Sep  6 18:16:09 nativespace-cdp sshd[2996333]: Failed password for invalid user naemon from 177.116.104.13 port 37252 ssh2
Sep  6 18:16:11 nativespace-cdp sshd[2996333]: Received disconnect from 177.116.104.13 port 37252:11: Bye Bye [preauth]
Sep  6 18:16:11 nativespace-cdp sshd[2996333]: Disconnected from 177.116.104.13 port 37252 [preauth]
Sep  6 18:16:34 nativespace-cdp sshd[2996454]: Connection closed by 159.100.136.21 port 45478 [preauth]
Sep  6 18:21:34 nativespace-cdp sshd[2997460]: Connection closed by 159.100.136.21 port 55002 [preauth]
Sep  6 18:24:22 nativespace-cdp sshd[2939927]: pam_unix(sshd:session): session closed for user root
Sep  6 18:26:36 nativespace-cdp sshd[2998532]: Connection closed by 159.100.136.21 port 36480 [preauth]
Sep  6 18:31:33 nativespace-cdp sshd[2999598]: Connection closed by 159.100.136.21 port 46038 [preauth]
Sep  6 18:36:33 nativespace-cdp sshd[3000519]: Connection closed by 159.100.136.21 port 55230 [preauth]
Sep  6 18:39:36 nativespace-cdp sshd[3001082]: Invalid user vbox from 185.17.229.65 port 36554
Sep  6 18:39:36 nativespace-cdp sshd[3001082]: input_userauth_request: invalid user vbox [preauth]
Sep  6 18:39:37 nativespace-cdp sshd[3001082]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:39:37 nativespace-cdp sshd[3001082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.17.229.65
Sep  6 18:39:39 nativespace-cdp sshd[3001082]: Failed password for invalid user vbox from 185.17.229.65 port 36554 ssh2
Sep  6 18:39:39 nativespace-cdp sshd[3001082]: Received disconnect from 185.17.229.65 port 36554:11: Bye Bye [preauth]
Sep  6 18:39:39 nativespace-cdp sshd[3001082]: Disconnected from 185.17.229.65 port 36554 [preauth]
Sep  6 18:41:36 nativespace-cdp sshd[3001624]: Connection closed by 159.100.136.21 port 35752 [preauth]
Sep  6 18:42:24 nativespace-cdp sshd[3001761]: Invalid user deployer from 64.227.114.107 port 44730
Sep  6 18:42:24 nativespace-cdp sshd[3001761]: input_userauth_request: invalid user deployer [preauth]
Sep  6 18:42:24 nativespace-cdp sshd[3001761]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:42:24 nativespace-cdp sshd[3001761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.114.107
Sep  6 18:42:26 nativespace-cdp sshd[3001761]: Failed password for invalid user deployer from 64.227.114.107 port 44730 ssh2
Sep  6 18:42:26 nativespace-cdp sshd[3001761]: Received disconnect from 64.227.114.107 port 44730:11: Bye Bye [preauth]
Sep  6 18:42:26 nativespace-cdp sshd[3001761]: Disconnected from 64.227.114.107 port 44730 [preauth]
Sep  6 18:42:39 nativespace-cdp sshd[3001799]: Invalid user samp from 161.35.216.181 port 54072
Sep  6 18:42:39 nativespace-cdp sshd[3001799]: input_userauth_request: invalid user samp [preauth]
Sep  6 18:42:39 nativespace-cdp sshd[3001799]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:42:39 nativespace-cdp sshd[3001799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.216.181
Sep  6 18:42:40 nativespace-cdp sshd[3001799]: Failed password for invalid user samp from 161.35.216.181 port 54072 ssh2
Sep  6 18:42:40 nativespace-cdp sshd[3001799]: Received disconnect from 161.35.216.181 port 54072:11: Bye Bye [preauth]
Sep  6 18:42:40 nativespace-cdp sshd[3001799]: Disconnected from 161.35.216.181 port 54072 [preauth]
Sep  6 18:46:35 nativespace-cdp sshd[3002864]: Connection closed by 159.100.136.21 port 44464 [preauth]
Sep  6 18:46:48 nativespace-cdp sshd[3002905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.77.117.10  user=root
Sep  6 18:46:48 nativespace-cdp sshd[3002905]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 18:46:51 nativespace-cdp sshd[3002905]: Failed password for root from 164.77.117.10 port 47818 ssh2
Sep  6 18:46:51 nativespace-cdp sshd[3002905]: Received disconnect from 164.77.117.10 port 47818:11: Bye Bye [preauth]
Sep  6 18:46:51 nativespace-cdp sshd[3002905]: Disconnected from 164.77.117.10 port 47818 [preauth]
Sep  6 18:47:01 nativespace-cdp sshd[3002939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.17.229.65  user=root
Sep  6 18:47:01 nativespace-cdp sshd[3002939]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 18:47:03 nativespace-cdp sshd[3002939]: Failed password for root from 185.17.229.65 port 43655 ssh2
Sep  6 18:47:03 nativespace-cdp sshd[3002939]: Received disconnect from 185.17.229.65 port 43655:11: Bye Bye [preauth]
Sep  6 18:47:03 nativespace-cdp sshd[3002939]: Disconnected from 185.17.229.65 port 43655 [preauth]
Sep  6 18:47:40 nativespace-cdp sshd[3003088]: Invalid user notify from 161.35.216.181 port 52254
Sep  6 18:47:40 nativespace-cdp sshd[3003088]: input_userauth_request: invalid user notify [preauth]
Sep  6 18:47:40 nativespace-cdp sshd[3003088]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:47:40 nativespace-cdp sshd[3003088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.216.181
Sep  6 18:47:42 nativespace-cdp sshd[3003088]: Failed password for invalid user notify from 161.35.216.181 port 52254 ssh2
Sep  6 18:47:42 nativespace-cdp sshd[3003088]: Received disconnect from 161.35.216.181 port 52254:11: Bye Bye [preauth]
Sep  6 18:47:42 nativespace-cdp sshd[3003088]: Disconnected from 161.35.216.181 port 52254 [preauth]
Sep  6 18:47:44 nativespace-cdp sshd[3003103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.17.229.65  user=root
Sep  6 18:47:44 nativespace-cdp sshd[3003103]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 18:47:46 nativespace-cdp sshd[3003103]: Failed password for root from 185.17.229.65 port 11550 ssh2
Sep  6 18:47:46 nativespace-cdp sshd[3003103]: Received disconnect from 185.17.229.65 port 11550:11: Bye Bye [preauth]
Sep  6 18:47:46 nativespace-cdp sshd[3003103]: Disconnected from 185.17.229.65 port 11550 [preauth]
Sep  6 18:47:52 nativespace-cdp sshd[3003165]: Invalid user ejbca from 64.227.114.107 port 37066
Sep  6 18:47:52 nativespace-cdp sshd[3003165]: input_userauth_request: invalid user ejbca [preauth]
Sep  6 18:47:52 nativespace-cdp sshd[3003165]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:47:52 nativespace-cdp sshd[3003165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.114.107
Sep  6 18:47:53 nativespace-cdp sshd[3003165]: Failed password for invalid user ejbca from 64.227.114.107 port 37066 ssh2
Sep  6 18:47:53 nativespace-cdp sshd[3003165]: Received disconnect from 64.227.114.107 port 37066:11: Bye Bye [preauth]
Sep  6 18:47:53 nativespace-cdp sshd[3003165]: Disconnected from 64.227.114.107 port 37066 [preauth]
Sep  6 18:48:22 nativespace-cdp sshd[3003256]: Invalid user abas from 161.35.216.181 port 37662
Sep  6 18:48:22 nativespace-cdp sshd[3003256]: input_userauth_request: invalid user abas [preauth]
Sep  6 18:48:22 nativespace-cdp sshd[3003256]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:48:22 nativespace-cdp sshd[3003256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.216.181
Sep  6 18:48:24 nativespace-cdp sshd[3003256]: Failed password for invalid user abas from 161.35.216.181 port 37662 ssh2
Sep  6 18:48:24 nativespace-cdp sshd[3003256]: Received disconnect from 161.35.216.181 port 37662:11: Bye Bye [preauth]
Sep  6 18:48:24 nativespace-cdp sshd[3003256]: Disconnected from 161.35.216.181 port 37662 [preauth]
Sep  6 18:48:32 nativespace-cdp sshd[3003309]: Invalid user sakurai from 64.227.114.107 port 54950
Sep  6 18:48:32 nativespace-cdp sshd[3003309]: input_userauth_request: invalid user sakurai [preauth]
Sep  6 18:48:32 nativespace-cdp sshd[3003309]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:48:32 nativespace-cdp sshd[3003309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.114.107
Sep  6 18:48:33 nativespace-cdp sshd[3003309]: Failed password for invalid user sakurai from 64.227.114.107 port 54950 ssh2
Sep  6 18:48:33 nativespace-cdp sshd[3003309]: Received disconnect from 64.227.114.107 port 54950:11: Bye Bye [preauth]
Sep  6 18:48:33 nativespace-cdp sshd[3003309]: Disconnected from 64.227.114.107 port 54950 [preauth]
Sep  6 18:49:06 nativespace-cdp sshd[3003406]: Invalid user shlee from 164.77.117.10 port 41010
Sep  6 18:49:06 nativespace-cdp sshd[3003406]: input_userauth_request: invalid user shlee [preauth]
Sep  6 18:49:06 nativespace-cdp sshd[3003406]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:49:06 nativespace-cdp sshd[3003406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.77.117.10
Sep  6 18:49:09 nativespace-cdp sshd[3003406]: Failed password for invalid user shlee from 164.77.117.10 port 41010 ssh2
Sep  6 18:49:10 nativespace-cdp sshd[3003406]: Received disconnect from 164.77.117.10 port 41010:11: Bye Bye [preauth]
Sep  6 18:49:10 nativespace-cdp sshd[3003406]: Disconnected from 164.77.117.10 port 41010 [preauth]
Sep  6 18:50:07 nativespace-cdp sshd[3003645]: Invalid user brs from 164.77.117.10 port 53912
Sep  6 18:50:07 nativespace-cdp sshd[3003645]: input_userauth_request: invalid user brs [preauth]
Sep  6 18:50:07 nativespace-cdp sshd[3003645]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 18:50:07 nativespace-cdp sshd[3003645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.77.117.10
Sep  6 18:50:09 nativespace-cdp sshd[3003645]: Failed password for invalid user brs from 164.77.117.10 port 53912 ssh2
Sep  6 18:50:09 nativespace-cdp sshd[3003645]: Received disconnect from 164.77.117.10 port 53912:11: Bye Bye [preauth]
Sep  6 18:50:09 nativespace-cdp sshd[3003645]: Disconnected from 164.77.117.10 port 53912 [preauth]
Sep  6 18:51:33 nativespace-cdp sshd[3004117]: Connection closed by 159.100.136.21 port 52996 [preauth]
Sep  6 18:56:33 nativespace-cdp sshd[3005210]: Connection closed by 159.100.136.21 port 33542 [preauth]
Sep  6 19:01:33 nativespace-cdp sshd[3006384]: Connection closed by 159.100.136.21 port 41922 [preauth]
Sep  6 19:06:33 nativespace-cdp sshd[3007449]: Connection closed by 159.100.136.21 port 51690 [preauth]
Sep  6 19:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 19:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:31 nativespace-cdp sudo[3007974]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 19:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:31 nativespace-cdp sudo[3007978]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 19:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:33 nativespace-cdp sudo[3007981]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 19:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:33 nativespace-cdp sudo[3007986]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 19:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:37 nativespace-cdp sudo[3007989]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:37 nativespace-cdp sudo[3008009]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:37 nativespace-cdp sudo[3008015]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:37 nativespace-cdp sudo[3008018]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:37 nativespace-cdp sudo[3008021]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:37 nativespace-cdp sudo[3008024]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:37 nativespace-cdp sudo[3008027]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:40 nativespace-cdp sudo[3008047]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:46 nativespace-cdp sudo[3008052]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hhdugcor user-2=lbhyisi user-3=magichat user-4=martsblo user-5=ptkxhsbt user-6=dickemery123 user-7=wilsonsw user-8=megacards user-9=musorguk user-10=lakesan1 user-11=brmrjxl user-12=atestord user-13=sarafoundation user-14=strathar user-15=agproduc user-16=still user-17=leereyn1 user-18=stephani user-19=jarvisin user-20=hodgesonweb user-21=theblack user-22=spectrum user-23=ulsukarm user-24=booff user-25=foundation user-26=markward user-27=lbscrmod user-28=maflemin user-29=vantagep user-30=connect9 user-31=athenare user-32=stuartge user-33=askhform user-34=innovat1 user-35=nativene user-36=skyfirec user-37=alexadmin user-38=bedfords user-39=bemadonn user-40=newstoda user-41=belle user-42=ggaaorgu user-43=nstriton user-44=brighto1 user-45=oneoarco user-46=battlere user-47=vivienn1 user-48=firstre2
Sep  6 19:09:46 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ianrayne user-50=accooper user-51=thqkgnbz user-52=connectedshoppin user-53=elecleis user-54=milloyco user-55=gilpin user-56=fetch user-57=carsinyo user-58=hubmaster user-59=putterfi user-60=costestimatorco user-61=clarkass user-62=firstrel user-63=highlegh user-64=southlon user-65=firstred user-66=firstres user-67=ultbcrra user-68=jonhartl user-69=seftvta user-70=coursemc user-71=opaiscyx user-72=hirefootballgame user-73=courseme user-74=eugincou user-75=reliable user-76=ninejimm user-77=cathski user-78=cambria1 user-79=cwsocial user-80=howardon user-81=paulmca1 user-82=pugwash user-83=smrszyqg user-84=isleofwi user-85=barbersh user-86=tigerlet user-87=nomistakes user-88=hidden user-89=foods user-90=leftie user-91=health2045 user-92=fortunaz user-93=nscdp user-94=putterfc user-95=firstre5 user-96=donnychicago user-97=steakbridieme user-98=philmcph user-99=ctedorgu user-100=lkpier user-101=darkstar
Sep  6 19:09:46 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=eatspam user-103=beauty user-104=dhyana user-105=fawcettd user-106=burydropin user-107=nsceres user-108=zebrapho user-109=bwppodcast user-110=steve user-111=sibtoncc user-112=asandcoc user-113=kategilpin user-114=stagingerris user-115=dancinggardener user-116=ladburyp user-117=design user-118=what user-119=oubpgvbx user-120=tstardom user-121=nvihkvu user-122=havantho user-123=sketchy user-124=cath user-125=crrtipdl user-126=sosevalu user-127=bakery user-128=nove user-129=boldover user-130=branko user-131=ranxterc user-132=outdoorc user-133=hodgsonmail user-134=romaldki user-135=lucy user-136=attlebor user-137=onlycont user-138=mcdermos user-139=chrisdal user-140=david user-141=nbhavers user-142=careers user-143=tomandle user-144=jennimil feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 19:09:46 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 19:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:47 nativespace-cdp sudo[3008072]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:48 nativespace-cdp sudo[3008078]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qutYANl48emfPm5U.~
Sep  6 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:48 nativespace-cdp sudo[3008081]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qutYANl48emfPm5U.~'
Sep  6 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:48 nativespace-cdp sudo[3008084]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qutYANl48emfPm5U.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:48 nativespace-cdp sudo[3008088]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:48 nativespace-cdp sudo[3008091]: pam_unix(sudo:session): session closed for user root
Sep  6 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep  6 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:09:54 nativespace-cdp sudo[3008094]: pam_unix(sudo:session): session closed for user root
Sep  6 19:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 19:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 19:10:13 nativespace-cdp sudo[3008320]: pam_unix(sudo:session): session closed for user root
Sep  6 19:11:35 nativespace-cdp sshd[3008671]: Connection closed by 159.100.136.21 port 59692 [preauth]
Sep  6 19:15:22 nativespace-cdp sshd[3009514]: Invalid user mattermost from 196.221.205.121 port 52456
Sep  6 19:15:22 nativespace-cdp sshd[3009514]: input_userauth_request: invalid user mattermost [preauth]
Sep  6 19:15:22 nativespace-cdp sshd[3009514]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 19:15:22 nativespace-cdp sshd[3009514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.221.205.121
Sep  6 19:15:24 nativespace-cdp sshd[3009514]: Failed password for invalid user mattermost from 196.221.205.121 port 52456 ssh2
Sep  6 19:15:27 nativespace-cdp sshd[3009514]: Received disconnect from 196.221.205.121 port 52456:11: Bye Bye [preauth]
Sep  6 19:15:27 nativespace-cdp sshd[3009514]: Disconnected from 196.221.205.121 port 52456 [preauth]
Sep  6 19:16:33 nativespace-cdp sshd[3009854]: Connection closed by 159.100.136.21 port 40922 [preauth]
Sep  6 19:17:33 nativespace-cdp sshd[3010025]: Invalid user user from 196.20.68.81 port 35838
Sep  6 19:17:33 nativespace-cdp sshd[3010025]: input_userauth_request: invalid user user [preauth]
Sep  6 19:17:33 nativespace-cdp sshd[3010025]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 19:17:33 nativespace-cdp sshd[3010025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.20.68.81
Sep  6 19:17:34 nativespace-cdp sshd[3010025]: Failed password for invalid user user from 196.20.68.81 port 35838 ssh2
Sep  6 19:17:34 nativespace-cdp sshd[3010025]: Received disconnect from 196.20.68.81 port 35838:11: Bye Bye [preauth]
Sep  6 19:17:34 nativespace-cdp sshd[3010025]: Disconnected from 196.20.68.81 port 35838 [preauth]
Sep  6 19:18:57 nativespace-cdp sshd[3010261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.20.68.81  user=root
Sep  6 19:18:57 nativespace-cdp sshd[3010261]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 19:18:58 nativespace-cdp sshd[3010261]: Failed password for root from 196.20.68.81 port 53590 ssh2
Sep  6 19:19:06 nativespace-cdp sshd[3010261]: Received disconnect from 196.20.68.81 port 53590:11: Bye Bye [preauth]
Sep  6 19:19:06 nativespace-cdp sshd[3010261]: Disconnected from 196.20.68.81 port 53590 [preauth]
Sep  6 19:19:36 nativespace-cdp sshd[3010444]: Invalid user jyp from 196.20.68.81 port 38194
Sep  6 19:19:36 nativespace-cdp sshd[3010444]: input_userauth_request: invalid user jyp [preauth]
Sep  6 19:19:36 nativespace-cdp sshd[3010444]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 19:19:36 nativespace-cdp sshd[3010444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.20.68.81
Sep  6 19:19:38 nativespace-cdp sshd[3010444]: Failed password for invalid user jyp from 196.20.68.81 port 38194 ssh2
Sep  6 19:19:38 nativespace-cdp sshd[3010444]: Received disconnect from 196.20.68.81 port 38194:11: Bye Bye [preauth]
Sep  6 19:19:38 nativespace-cdp sshd[3010444]: Disconnected from 196.20.68.81 port 38194 [preauth]
Sep  6 19:21:33 nativespace-cdp sshd[3010963]: Connection closed by 159.100.136.21 port 50510 [preauth]
Sep  6 19:24:38 nativespace-cdp sshd[3011514]: Did not receive identification string from 196.221.205.121 port 55270
Sep  6 19:26:34 nativespace-cdp sshd[3012027]: Connection closed by 159.100.136.21 port 59914 [preauth]
Sep  6 19:29:03 nativespace-cdp sshd[3012435]: Did not receive identification string from 196.221.205.121 port 57194
Sep  6 19:30:32 nativespace-cdp sshd[3012903]: Connection reset by 196.221.205.121 port 38944 [preauth]
Sep  6 19:31:33 nativespace-cdp sshd[3013120]: Connection closed by 159.100.136.21 port 39900 [preauth]
Sep  6 19:31:59 nativespace-cdp sshd[3013178]: Connection closed by 196.221.205.121 port 48924 [preauth]
Sep  6 19:36:33 nativespace-cdp sshd[3014209]: Connection closed by 159.100.136.21 port 49364 [preauth]
Sep  6 19:41:35 nativespace-cdp sshd[3015381]: Connection closed by 159.100.136.21 port 57460 [preauth]
Sep  6 19:43:45 nativespace-cdp sshd[3015676]: Connection closed by 196.221.205.121 port 44076 [preauth]
Sep  6 19:46:34 nativespace-cdp sshd[3016478]: Connection closed by 159.100.136.21 port 38520 [preauth]
Sep  6 19:47:25 nativespace-cdp sshd[3016448]: Connection closed by 196.221.205.121 port 35768 [preauth]
Sep  6 19:51:33 nativespace-cdp sshd[3017547]: Connection closed by 159.100.136.21 port 47862 [preauth]
Sep  6 19:52:20 nativespace-cdp sshd[3017703]: Connection reset by 196.221.205.121 port 47444 [preauth]
Sep  6 19:54:42 nativespace-cdp sshd[3017941]: Connection closed by 196.221.205.121 port 57416 [preauth]
Sep  6 19:55:58 nativespace-cdp sshd[3018366]: Connection closed by 196.221.205.121 port 39186 [preauth]
Sep  6 19:56:33 nativespace-cdp sshd[3018853]: Connection closed by 196.221.205.121 port 49126 [preauth]
Sep  6 19:56:35 nativespace-cdp sshd[3018889]: Connection closed by 159.100.136.21 port 57092 [preauth]
Sep  6 20:01:33 nativespace-cdp sshd[3020017]: Connection closed by 159.100.136.21 port 37490 [preauth]
Sep  6 20:06:33 nativespace-cdp sshd[3021265]: Connection closed by 159.100.136.21 port 46602 [preauth]
Sep  6 20:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 20:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:32 nativespace-cdp sudo[3021939]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 20:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:32 nativespace-cdp sudo[3021943]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 20:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:35 nativespace-cdp sudo[3021946]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:35 nativespace-cdp sudo[3021956]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:39 nativespace-cdp sudo[3021960]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 20:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:39 nativespace-cdp sudo[3021993]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 20:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:39 nativespace-cdp sudo[3021996]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 20:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:39 nativespace-cdp sudo[3021999]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 20:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:39 nativespace-cdp sudo[3022002]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 20:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:39 nativespace-cdp sudo[3022005]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 20:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:39 nativespace-cdp sudo[3022009]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:41 nativespace-cdp sudo[3022033]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:45 nativespace-cdp sudo[3022038]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=reliable user-2=ninejimm user-3=cambria1 user-4=cathski user-5=cwsocial user-6=paulmca1 user-7=pugwash user-8=howardon user-9=hirefootballgame user-10=courseme user-11=eugincou user-12=leftie user-13=foods user-14=fortunaz user-15=health2045 user-16=nscdp user-17=putterfc user-18=steakbridieme user-19=donnychicago user-20=firstre5 user-21=ctedorgu user-22=philmcph user-23=lkpier user-24=smrszyqg user-25=isleofwi user-26=barbersh user-27=tigerlet user-28=nomistakes user-29=hidden user-30=fawcettd user-31=burydropin user-32=nsceres user-33=darkstar user-34=eatspam user-35=beauty user-36=dhyana user-37=asandcoc user-38=sibtoncc user-39=zebrapho user-40=bwppodcast user-41=steve user-42=what user-43=tstardom user-44=oubpgvbx user-45=nvihkvu user-46=havantho user-47=sketchy user-48=cath
Sep  6 20:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=kategilpin user-50=stagingerris user-51=dancinggardener user-52=ladburyp user-53=design user-54=nove user-55=boldover user-56=crrtipdl user-57=sosevalu user-58=bakery user-59=lucy user-60=attlebor user-61=onlycont user-62=branko user-63=outdoorc user-64=ranxterc user-65=hodgsonmail user-66=romaldki user-67=tomandle user-68=jennimil user-69=mcdermos user-70=chrisdal user-71=david user-72=careers user-73=nbhavers user-74=martsblo user-75=ptkxhsbt user-76=dickemery123 user-77=hhdugcor user-78=lbhyisi user-79=magichat user-80=lakesan1 user-81=brmrjxl user-82=atestord user-83=sarafoundation user-84=strathar user-85=wilsonsw user-86=megacards user-87=musorguk user-88=jarvisin user-89=theblack user-90=hodgesonweb user-91=spectrum user-92=agproduc user-93=still user-94=leereyn1 user-95=stephani user-96=markward user-97=booff user-98=foundation user-99=lbscrmod user-100=maflemin user-101=vantagep user-102=connect9
Sep  6 20:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=athenare user-104=ulsukarm user-105=skyfirec user-106=alexadmin user-107=askhform user-108=stuartge user-109=innovat1 user-110=nativene user-111=nstriton user-112=brighto1 user-113=oneoarco user-114=battlere user-115=vivienn1 user-116=firstre2 user-117=bedfords user-118=bemadonn user-119=newstoda user-120=ggaaorgu user-121=belle user-122=elecleis user-123=milloyco user-124=gilpin user-125=fetch user-126=carsinyo user-127=hubmaster user-128=putterfi user-129=ianrayne user-130=accooper user-131=thqkgnbz user-132=connectedshoppin user-133=firstres user-134=ultbcrra user-135=jonhartl user-136=seftvta user-137=opaiscyx user-138=coursemc user-139=costestimatorco user-140=clarkass user-141=firstrel user-142=highlegh user-143=southlon user-144=firstred feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 20:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 20:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:46 nativespace-cdp sudo[3022050]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:47 nativespace-cdp sudo[3022062]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-htTsKSHe0Y6t3nLm.~
Sep  6 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:47 nativespace-cdp sudo[3022068]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-htTsKSHe0Y6t3nLm.~'
Sep  6 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:47 nativespace-cdp sudo[3022071]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-htTsKSHe0Y6t3nLm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:47 nativespace-cdp sudo[3022075]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:47 nativespace-cdp sudo[3022079]: pam_unix(sudo:session): session closed for user root
Sep  6 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 20:09:50 nativespace-cdp sudo[3022106]: pam_unix(sudo:session): session closed for user root
Sep  6 20:11:36 nativespace-cdp sshd[3022756]: Connection closed by 159.100.136.21 port 55568 [preauth]
Sep  6 20:16:33 nativespace-cdp sshd[3023738]: Connection closed by 159.100.136.21 port 37106 [preauth]
Sep  6 20:21:35 nativespace-cdp sshd[3025270]: Connection closed by 159.100.136.21 port 45366 [preauth]
Sep  6 20:26:33 nativespace-cdp sshd[3026391]: Connection closed by 159.100.136.21 port 54564 [preauth]
Sep  6 20:31:34 nativespace-cdp sshd[3027528]: Connection closed by 159.100.136.21 port 34774 [preauth]
Sep  6 20:36:34 nativespace-cdp sshd[3029454]: Connection closed by 159.100.136.21 port 43350 [preauth]
Sep  6 20:41:33 nativespace-cdp sshd[3030776]: Connection closed by 159.100.136.21 port 52872 [preauth]
Sep  6 20:46:37 nativespace-cdp sshd[3032258]: Connection closed by 159.100.136.21 port 33690 [preauth]
Sep  6 20:48:30 nativespace-cdp sshd[3032658]: Invalid user zxl from 154.209.4.95 port 52554
Sep  6 20:48:30 nativespace-cdp sshd[3032658]: input_userauth_request: invalid user zxl [preauth]
Sep  6 20:48:30 nativespace-cdp sshd[3032658]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 20:48:30 nativespace-cdp sshd[3032658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.209.4.95
Sep  6 20:48:31 nativespace-cdp sshd[3032658]: Failed password for invalid user zxl from 154.209.4.95 port 52554 ssh2
Sep  6 20:48:32 nativespace-cdp sshd[3032658]: Received disconnect from 154.209.4.95 port 52554:11: Bye Bye [preauth]
Sep  6 20:48:32 nativespace-cdp sshd[3032658]: Disconnected from 154.209.4.95 port 52554 [preauth]
Sep  6 20:50:32 nativespace-cdp sshd[3033201]: Invalid user ah from 154.209.4.95 port 44048
Sep  6 20:50:32 nativespace-cdp sshd[3033201]: input_userauth_request: invalid user ah [preauth]
Sep  6 20:50:32 nativespace-cdp sshd[3033201]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 20:50:32 nativespace-cdp sshd[3033201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.209.4.95
Sep  6 20:50:34 nativespace-cdp sshd[3033201]: Failed password for invalid user ah from 154.209.4.95 port 44048 ssh2
Sep  6 20:50:34 nativespace-cdp sshd[3033201]: Received disconnect from 154.209.4.95 port 44048:11: Bye Bye [preauth]
Sep  6 20:50:34 nativespace-cdp sshd[3033201]: Disconnected from 154.209.4.95 port 44048 [preauth]
Sep  6 20:51:23 nativespace-cdp sshd[3033383]: Invalid user hjh from 154.209.4.95 port 57536
Sep  6 20:51:23 nativespace-cdp sshd[3033383]: input_userauth_request: invalid user hjh [preauth]
Sep  6 20:51:23 nativespace-cdp sshd[3033383]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 20:51:23 nativespace-cdp sshd[3033383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.209.4.95
Sep  6 20:51:25 nativespace-cdp sshd[3033383]: Failed password for invalid user hjh from 154.209.4.95 port 57536 ssh2
Sep  6 20:51:28 nativespace-cdp sshd[3033383]: Received disconnect from 154.209.4.95 port 57536:11: Bye Bye [preauth]
Sep  6 20:51:28 nativespace-cdp sshd[3033383]: Disconnected from 154.209.4.95 port 57536 [preauth]
Sep  6 20:51:33 nativespace-cdp sshd[3033428]: Connection closed by 159.100.136.21 port 42986 [preauth]
Sep  6 20:56:33 nativespace-cdp sshd[3034518]: Connection closed by 159.100.136.21 port 52696 [preauth]
Sep  6 21:01:33 nativespace-cdp sshd[3035730]: Connection closed by 159.100.136.21 port 33242 [preauth]
Sep  6 21:06:37 nativespace-cdp sshd[3036739]: Connection closed by 159.100.136.21 port 42180 [preauth]
Sep  6 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:34 nativespace-cdp sudo[3037204]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:34 nativespace-cdp sudo[3037208]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:36 nativespace-cdp sudo[3037211]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 21:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:36 nativespace-cdp sudo[3037218]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 21:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:40 nativespace-cdp sudo[3037222]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:40 nativespace-cdp sudo[3037233]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:40 nativespace-cdp sudo[3037236]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:40 nativespace-cdp sudo[3037239]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:40 nativespace-cdp sudo[3037242]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:40 nativespace-cdp sudo[3037245]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:40 nativespace-cdp sudo[3037248]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 21:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:48 nativespace-cdp sudo[3037282]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 21:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:55 nativespace-cdp sudo[3037287]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jonhartl user-2=seftvta user-3=ultbcrra user-4=firstres user-5=coursemc user-6=opaiscyx user-7=firstrel user-8=clarkass user-9=costestimatorco user-10=firstred user-11=southlon user-12=highlegh user-13=gilpin user-14=milloyco user-15=elecleis user-16=putterfi user-17=hubmaster user-18=carsinyo user-19=fetch user-20=accooper user-21=ianrayne user-22=connectedshoppin user-23=thqkgnbz user-24=brighto1 user-25=nstriton user-26=firstre2 user-27=vivienn1 user-28=battlere user-29=oneoarco user-30=bedfords user-31=belle user-32=ggaaorgu user-33=newstoda user-34=bemadonn user-35=alexadmin user-36=skyfirec user-37=innovat1 user-38=askhform user-39=stuartge user-40=nativene user-41=markward user-42=booff user-43=foundation user-44=connect9 user-45=athenare user-46=vantagep user-47=maflemin user-48=lbscrmod
Sep  6 21:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=jarvisin user-51=spectrum user-52=theblack user-53=hodgesonweb user-54=still user-55=agproduc user-56=stephani user-57=leereyn1 user-58=brmrjxl user-59=lakesan1 user-60=strathar user-61=sarafoundation user-62=atestord user-63=wilsonsw user-64=musorguk user-65=megacards user-66=martsblo user-67=dickemery123 user-68=ptkxhsbt user-69=lbhyisi user-70=hhdugcor user-71=magichat user-72=tomandle user-73=jennimil user-74=chrisdal user-75=mcdermos user-76=careers user-77=nbhavers user-78=david user-79=attlebor user-80=lucy user-81=onlycont user-82=hodgsonmail user-83=ranxterc user-84=outdoorc user-85=branko user-86=romaldki user-87=nove user-88=boldover user-89=bakery user-90=sosevalu user-91=crrtipdl user-92=oubpgvbx user-93=tstardom user-94=what user-95=cath user-96=sketchy user-97=havantho user-98=nvihkvu user-99=ladburyp user-100=dancinggardener user-101=stagingerris user-102=kategilpin
Sep  6 21:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=design user-104=asandcoc user-105=sibtoncc user-106=bwppodcast user-107=zebrapho user-108=steve user-109=burydropin user-110=fawcettd user-111=nsceres user-112=beauty user-113=eatspam user-114=darkstar user-115=dhyana user-116=putterfc user-117=nscdp user-118=fortunaz user-119=health2045 user-120=foods user-121=leftie user-122=lkpier user-123=ctedorgu user-124=philmcph user-125=firstre5 user-126=donnychicago user-127=steakbridieme user-128=smrszyqg user-129=isleofwi user-130=hidden user-131=nomistakes user-132=barbersh user-133=tigerlet user-134=cathski user-135=cambria1 user-136=reliable user-137=ninejimm user-138=howardon user-139=paulmca1 user-140=pugwash user-141=cwsocial user-142=hirefootballgame user-143=eugincou user-144=courseme feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 21:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 21:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:56 nativespace-cdp sudo[3037301]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 21:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:57 nativespace-cdp sudo[3037308]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-IQ0Qh7yJUIIW2wro.~
Sep  6 21:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:57 nativespace-cdp sudo[3037311]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-IQ0Qh7yJUIIW2wro.~'
Sep  6 21:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:57 nativespace-cdp sudo[3037314]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-IQ0Qh7yJUIIW2wro.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 21:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:57 nativespace-cdp sudo[3037318]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 21:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:57 nativespace-cdp sudo[3037321]: pam_unix(sudo:session): session closed for user root
Sep  6 21:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 21:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:09:59 nativespace-cdp sudo[3037339]: pam_unix(sudo:session): session closed for user root
Sep  6 21:11:33 nativespace-cdp sshd[3037964]: Connection closed by 159.100.136.21 port 51568 [preauth]
Sep  6 21:16:35 nativespace-cdp sshd[3041999]: Connection closed by 159.100.136.21 port 32854 [preauth]
Sep  6 21:21:35 nativespace-cdp sshd[3043859]: Connection closed by 159.100.136.21 port 42214 [preauth]
Sep  6 21:26:33 nativespace-cdp sshd[3044971]: Connection closed by 159.100.136.21 port 51802 [preauth]
Sep  6 21:31:33 nativespace-cdp sshd[3046180]: Connection closed by 159.100.136.21 port 59908 [preauth]
Sep  6 21:36:34 nativespace-cdp sshd[3047338]: Connection closed by 159.100.136.21 port 40998 [preauth]
Sep  6 21:41:35 nativespace-cdp sshd[3048516]: Connection closed by 159.100.136.21 port 50102 [preauth]
Sep  6 21:42:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 21:42:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:42:38 nativespace-cdp sudo[3049164]: pam_unix(sudo:session): session closed for user root
Sep  6 21:42:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status elecleis
Sep  6 21:42:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:42:47 nativespace-cdp sudo[3049171]: pam_unix(sudo:session): session closed for user root
Sep  6 21:42:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 21:42:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:42:49 nativespace-cdp sudo[3049219]: pam_unix(sudo:session): session closed for user root
Sep  6 21:42:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status gilpin
Sep  6 21:42:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 21:42:50 nativespace-cdp sudo[3049223]: pam_unix(sudo:session): session closed for user root
Sep  6 21:46:35 nativespace-cdp sshd[3050173]: Connection closed by 159.100.136.21 port 59540 [preauth]
Sep  6 21:56:34 nativespace-cdp sshd[3052473]: Connection closed by 159.100.136.21 port 50334 [preauth]
Sep  6 22:01:34 nativespace-cdp sshd[3053775]: Connection closed by 159.100.136.21 port 59162 [preauth]
Sep  6 22:01:57 nativespace-cdp sshd[3053856]: Invalid user zjh from 210.106.105.197 port 33518
Sep  6 22:01:57 nativespace-cdp sshd[3053856]: input_userauth_request: invalid user zjh [preauth]
Sep  6 22:01:58 nativespace-cdp sshd[3053856]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 22:01:58 nativespace-cdp sshd[3053856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.106.105.197
Sep  6 22:01:59 nativespace-cdp sshd[3053856]: Failed password for invalid user zjh from 210.106.105.197 port 33518 ssh2
Sep  6 22:02:04 nativespace-cdp sshd[3053856]: Received disconnect from 210.106.105.197 port 33518:11: Bye Bye [preauth]
Sep  6 22:02:04 nativespace-cdp sshd[3053856]: Disconnected from 210.106.105.197 port 33518 [preauth]
Sep  6 22:05:48 nativespace-cdp sshd[3054623]: Invalid user minerhub from 177.197.237.149 port 50716
Sep  6 22:05:48 nativespace-cdp sshd[3054623]: input_userauth_request: invalid user minerhub [preauth]
Sep  6 22:05:48 nativespace-cdp sshd[3054623]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 22:05:48 nativespace-cdp sshd[3054623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.197.237.149
Sep  6 22:05:50 nativespace-cdp sshd[3054623]: Failed password for invalid user minerhub from 177.197.237.149 port 50716 ssh2
Sep  6 22:05:50 nativespace-cdp sshd[3054623]: Received disconnect from 177.197.237.149 port 50716:11: Bye Bye [preauth]
Sep  6 22:05:50 nativespace-cdp sshd[3054623]: Disconnected from 177.197.237.149 port 50716 [preauth]
Sep  6 22:06:36 nativespace-cdp sshd[3054816]: Connection closed by 159.100.136.21 port 39702 [preauth]
Sep  6 22:07:54 nativespace-cdp sshd[3055000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.233.240  user=root
Sep  6 22:07:54 nativespace-cdp sshd[3055000]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 22:07:57 nativespace-cdp sshd[3055000]: Failed password for root from 54.37.233.240 port 57678 ssh2
Sep  6 22:07:57 nativespace-cdp sshd[3055000]: Received disconnect from 54.37.233.240 port 57678:11: Bye Bye [preauth]
Sep  6 22:07:57 nativespace-cdp sshd[3055000]: Disconnected from 54.37.233.240 port 57678 [preauth]
Sep  6 22:08:42 nativespace-cdp sshd[3055143]: Invalid user toptest from 210.106.105.197 port 57112
Sep  6 22:08:42 nativespace-cdp sshd[3055143]: input_userauth_request: invalid user toptest [preauth]
Sep  6 22:08:42 nativespace-cdp sshd[3055143]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 22:08:42 nativespace-cdp sshd[3055143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.106.105.197
Sep  6 22:08:43 nativespace-cdp sshd[3055143]: Failed password for invalid user toptest from 210.106.105.197 port 57112 ssh2
Sep  6 22:08:44 nativespace-cdp sshd[3055143]: Received disconnect from 210.106.105.197 port 57112:11: Bye Bye [preauth]
Sep  6 22:08:44 nativespace-cdp sshd[3055143]: Disconnected from 210.106.105.197 port 57112 [preauth]
Sep  6 22:08:45 nativespace-cdp sshd[3055165]: Invalid user neko from 54.37.233.240 port 55706
Sep  6 22:08:45 nativespace-cdp sshd[3055165]: input_userauth_request: invalid user neko [preauth]
Sep  6 22:08:45 nativespace-cdp sshd[3055165]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 22:08:45 nativespace-cdp sshd[3055165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.233.240
Sep  6 22:08:47 nativespace-cdp sshd[3055165]: Failed password for invalid user neko from 54.37.233.240 port 55706 ssh2
Sep  6 22:08:47 nativespace-cdp sshd[3055165]: Received disconnect from 54.37.233.240 port 55706:11: Bye Bye [preauth]
Sep  6 22:08:47 nativespace-cdp sshd[3055165]: Disconnected from 54.37.233.240 port 55706 [preauth]
Sep  6 22:09:15 nativespace-cdp sshd[3055317]: Invalid user r00t123 from 177.197.237.149 port 59318
Sep  6 22:09:15 nativespace-cdp sshd[3055317]: input_userauth_request: invalid user r00t123 [preauth]
Sep  6 22:09:15 nativespace-cdp sshd[3055317]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 22:09:15 nativespace-cdp sshd[3055317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.197.237.149
Sep  6 22:09:18 nativespace-cdp sshd[3055317]: Failed password for invalid user r00t123 from 177.197.237.149 port 59318 ssh2
Sep  6 22:09:18 nativespace-cdp sshd[3055317]: Received disconnect from 177.197.237.149 port 59318:11: Bye Bye [preauth]
Sep  6 22:09:18 nativespace-cdp sshd[3055317]: Disconnected from 177.197.237.149 port 59318 [preauth]
Sep  6 22:09:29 nativespace-cdp sshd[3055371]: Invalid user edubook from 54.37.233.240 port 58452
Sep  6 22:09:29 nativespace-cdp sshd[3055371]: input_userauth_request: invalid user edubook [preauth]
Sep  6 22:09:29 nativespace-cdp sshd[3055371]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 22:09:29 nativespace-cdp sshd[3055371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.233.240
Sep  6 22:09:31 nativespace-cdp sshd[3055371]: Failed password for invalid user edubook from 54.37.233.240 port 58452 ssh2
Sep  6 22:09:31 nativespace-cdp sshd[3055371]: Received disconnect from 54.37.233.240 port 58452:11: Bye Bye [preauth]
Sep  6 22:09:31 nativespace-cdp sshd[3055371]: Disconnected from 54.37.233.240 port 58452 [preauth]
Sep  6 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:32 nativespace-cdp sudo[3055416]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:32 nativespace-cdp sudo[3055425]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:36 nativespace-cdp sudo[3055428]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 22:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:37 nativespace-cdp sudo[3055459]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 22:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:39 nativespace-cdp sshd[3055474]: Invalid user zgr from 210.106.105.197 port 44858
Sep  6 22:09:39 nativespace-cdp sshd[3055474]: input_userauth_request: invalid user zgr [preauth]
Sep  6 22:09:39 nativespace-cdp sshd[3055474]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 22:09:39 nativespace-cdp sshd[3055474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.106.105.197
Sep  6 22:09:41 nativespace-cdp sudo[3055462]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 22:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:41 nativespace-cdp sudo[3055497]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 22:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:41 nativespace-cdp sudo[3055500]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 22:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:41 nativespace-cdp sudo[3055503]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 22:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:41 nativespace-cdp sudo[3055506]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 22:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:41 nativespace-cdp sudo[3055509]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 22:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:41 nativespace-cdp sudo[3055512]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:42 nativespace-cdp sshd[3055474]: Failed password for invalid user zgr from 210.106.105.197 port 44858 ssh2
Sep  6 22:09:42 nativespace-cdp sshd[3055474]: Received disconnect from 210.106.105.197 port 44858:11: Bye Bye [preauth]
Sep  6 22:09:42 nativespace-cdp sshd[3055474]: Disconnected from 210.106.105.197 port 44858 [preauth]
Sep  6 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:43 nativespace-cdp sudo[3055552]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:45 nativespace-cdp sudo[3055557]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lakesan1 user-2=brmrjxl user-3=strathar user-4=sarafoundation user-5=atestord user-6=wilsonsw user-7=musorguk user-8=megacards user-9=martsblo user-10=dickemery123 user-11=ptkxhsbt user-12=lbhyisi user-13=hhdugcor user-14=magichat user-15=booff user-16=markward user-17=foundation user-18=athenare user-19=connect9 user-20=vantagep user-21=maflemin user-22=lbscrmod user-23=ulsukarm user-24=jarvisin user-25=spectrum user-26=theblack user-27=hodgesonweb user-28=still user-29=agproduc user-30=stephani user-31=leereyn1 user-32=brighto1 user-33=nstriton user-34=firstre2 user-35=vivienn1 user-36=battlere user-37=oneoarco user-38=bedfords user-39=ggaaorgu user-40=belle user-41=newstoda user-42=bemadonn user-43=alexadmin user-44=skyfirec user-45=innovat1 user-46=askhform user-47=stuartge user-48=nativene
Sep  6 22:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=jonhartl user-50=seftvta user-51=ultbcrra user-52=firstres user-53=coursemc user-54=opaiscyx user-55=firstrel user-56=clarkass user-57=costestimatorco user-58=firstred user-59=southlon user-60=highlegh user-61=gilpin user-62=milloyco user-63=elecleis user-64=putterfi user-65=hubmaster user-66=carsinyo user-67=fetch user-68=accooper user-69=ianrayne user-70=connectedshoppin user-71=thqkgnbz user-72=putterfc user-73=nscdp user-74=fortunaz user-75=health2045 user-76=foods user-77=leftie user-78=lkpier user-79=ctedorgu user-80=philmcph user-81=donnychicago user-82=firstre5 user-83=steakbridieme user-84=smrszyqg user-85=isleofwi user-86=hidden user-87=nomistakes user-88=tigerlet user-89=barbersh user-90=cathski user-91=cambria1 user-92=ninejimm user-93=reliable user-94=pugwash user-95=paulmca1 user-96=howardon user-97=cwsocial user-98=hirefootballgame user-99=eugincou user-100=courseme user-101=sibtoncc
Sep  6 22:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=asandcoc user-103=bwppodcast user-104=zebrapho user-105=steve user-106=burydropin user-107=fawcettd user-108=nsceres user-109=beauty user-110=eatspam user-111=darkstar user-112=dhyana user-113=nove user-114=boldover user-115=bakery user-116=sosevalu user-117=crrtipdl user-118=oubpgvbx user-119=tstardom user-120=what user-121=cath user-122=sketchy user-123=havantho user-124=nvihkvu user-125=ladburyp user-126=dancinggardener user-127=stagingerris user-128=kategilpin user-129=design user-130=tomandle user-131=jennimil user-132=chrisdal user-133=mcdermos user-134=careers user-135=nbhavers user-136=david user-137=attlebor user-138=lucy user-139=onlycont user-140=outdoorc user-141=hodgsonmail user-142=ranxterc user-143=branko user-144=romaldki feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 22:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 22:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:46 nativespace-cdp sudo[3055564]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 22:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:47 nativespace-cdp sudo[3055576]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UlRhtiFiZZTHuv2q.~
Sep  6 22:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:47 nativespace-cdp sudo[3055579]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UlRhtiFiZZTHuv2q.~'
Sep  6 22:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:47 nativespace-cdp sudo[3055583]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UlRhtiFiZZTHuv2q.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 22:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:47 nativespace-cdp sudo[3055587]: pam_unix(sudo:session): session closed for user root
Sep  6 22:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 22:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:09:47 nativespace-cdp sudo[3055591]: pam_unix(sudo:session): session closed for user root
Sep  6 22:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 22:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 22:10:04 nativespace-cdp sudo[3055761]: pam_unix(sudo:session): session closed for user root
Sep  6 22:10:51 nativespace-cdp sshd[3056196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.197.237.149  user=root
Sep  6 22:10:51 nativespace-cdp sshd[3056196]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  6 22:10:53 nativespace-cdp sshd[3056196]: Failed password for root from 177.197.237.149 port 40754 ssh2
Sep  6 22:11:33 nativespace-cdp sshd[3056407]: Connection closed by 159.100.136.21 port 48476 [preauth]
Sep  6 22:16:36 nativespace-cdp sshd[3057671]: Connection closed by 159.100.136.21 port 56458 [preauth]
Sep  6 22:21:33 nativespace-cdp sshd[3058685]: Connection closed by 159.100.136.21 port 37002 [preauth]
Sep  6 22:26:37 nativespace-cdp sshd[3059767]: Connection closed by 159.100.136.21 port 46450 [preauth]
Sep  6 22:31:36 nativespace-cdp sshd[3060936]: Connection closed by 159.100.136.21 port 55604 [preauth]
Sep  6 22:36:35 nativespace-cdp sshd[3062168]: Connection closed by 159.100.136.21 port 36682 [preauth]
Sep  6 22:41:33 nativespace-cdp sshd[3063307]: Connection closed by 159.100.136.21 port 46100 [preauth]
Sep  6 22:46:36 nativespace-cdp sshd[3064318]: Connection closed by 159.100.136.21 port 55832 [preauth]
Sep  6 22:51:36 nativespace-cdp sshd[3065391]: Connection closed by 159.100.136.21 port 36762 [preauth]
Sep  6 22:56:34 nativespace-cdp sshd[3066956]: Connection closed by 159.100.136.21 port 46590 [preauth]
Sep  6 23:01:33 nativespace-cdp sshd[3068231]: Connection closed by 159.100.136.21 port 55604 [preauth]
Sep  6 23:06:33 nativespace-cdp sshd[3069253]: Connection closed by 159.100.136.21 port 36976 [preauth]
Sep  6 23:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  6 23:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:29 nativespace-cdp sudo[3069766]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  6 23:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:29 nativespace-cdp sudo[3069769]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  6 23:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:30 nativespace-cdp sudo[3069772]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  6 23:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:30 nativespace-cdp sudo[3069779]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  6 23:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:41 nativespace-cdp sudo[3069782]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  6 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:41 nativespace-cdp sudo[3069823]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  6 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:41 nativespace-cdp sudo[3069828]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  6 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:41 nativespace-cdp sudo[3069831]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  6 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:42 nativespace-cdp sudo[3069835]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  6 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:42 nativespace-cdp sudo[3069838]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  6 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:42 nativespace-cdp sudo[3069841]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  6 23:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:49 nativespace-cdp sudo[3069866]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  6 23:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:49 nativespace-cdp sudo[3069871]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=cath user-2=sketchy user-3=havantho user-4=nvihkvu user-5=tstardom user-6=oubpgvbx user-7=what user-8=design user-9=ladburyp user-10=stagingerris user-11=dancinggardener user-12=kategilpin user-13=boldover user-14=nove user-15=bakery user-16=sosevalu user-17=crrtipdl user-18=onlycont user-19=attlebor user-20=lucy user-21=romaldki user-22=ranxterc user-23=hodgsonmail user-24=outdoorc user-25=branko user-26=jennimil user-27=tomandle user-28=nbhavers user-29=careers user-30=david user-31=chrisdal user-32=mcdermos user-33=pugwash user-34=howardon user-35=paulmca1 user-36=cwsocial user-37=cathski user-38=cambria1 user-39=reliable user-40=ninejimm user-41=eugincou user-42=courseme user-43=hirefootballgame user-44=lkpier user-45=ctedorgu user-46=philmcph user-47=steakbridieme user-48=donnychicago
Sep  6 23:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstre5 user-50=putterfc user-51=nscdp user-52=health2045 user-53=fortunaz user-54=foods user-55=leftie user-56=hidden user-57=nomistakes user-58=tigerlet user-59=barbersh user-60=isleofwi user-61=smrszyqg user-62=nsceres user-63=burydropin user-64=fawcettd user-65=dhyana user-66=beauty user-67=eatspam user-68=darkstar user-69=asandcoc user-70=sibtoncc user-71=steve user-72=bwppodcast user-73=zebrapho user-74=alexadmin user-75=skyfirec user-76=nativene user-77=innovat1 user-78=askhform user-79=stuartge user-80=firstre2 user-81=vivienn1 user-82=battlere user-83=oneoarco user-84=brighto1 user-85=nstriton user-86=ggaaorgu user-87=belle user-88=newstoda user-89=bemadonn user-90=bedfords user-91=putterfi user-92=hubmaster user-93=carsinyo user-94=fetch user-95=gilpin user-96=milloyco user-97=elecleis user-98=connectedshoppin user-99=thqkgnbz user-100=accooper user-101=ianrayne user-102=coursemc
Sep  6 23:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=opaiscyx user-104=seftvta user-105=jonhartl user-106=ultbcrra user-107=firstres user-108=firstred user-109=southlon user-110=highlegh user-111=firstrel user-112=clarkass user-113=costestimatorco user-114=dickemery123 user-115=ptkxhsbt user-116=martsblo user-117=magichat user-118=lbhyisi user-119=hhdugcor user-120=strathar user-121=sarafoundation user-122=atestord user-123=lakesan1 user-124=brmrjxl user-125=musorguk user-126=megacards user-127=wilsonsw user-128=spectrum user-129=theblack user-130=hodgesonweb user-131=jarvisin user-132=stephani user-133=leereyn1 user-134=still user-135=agproduc user-136=athenare user-137=connect9 user-138=vantagep user-139=maflemin user-140=lbscrmod user-141=booff user-142=foundation user-143=markward user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  6 23:09:49 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  6 23:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:50 nativespace-cdp sudo[3069875]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:51 nativespace-cdp sudo[3069880]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Jxn0AWWZnQ7MX8y6.~
Sep  6 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:51 nativespace-cdp sudo[3069883]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Jxn0AWWZnQ7MX8y6.~'
Sep  6 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:51 nativespace-cdp sudo[3069886]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Jxn0AWWZnQ7MX8y6.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  6 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:51 nativespace-cdp sudo[3069890]: pam_unix(sudo:session): session closed for user root
Sep  6 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  6 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:09:51 nativespace-cdp sudo[3069893]: pam_unix(sudo:session): session closed for user root
Sep  6 23:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  6 23:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  6 23:10:11 nativespace-cdp sudo[3070195]: pam_unix(sudo:session): session closed for user root
Sep  6 23:11:35 nativespace-cdp sshd[3070518]: Connection closed by 159.100.136.21 port 46364 [preauth]
Sep  6 23:16:33 nativespace-cdp sshd[3071457]: Connection closed by 159.100.136.21 port 55996 [preauth]
Sep  6 23:21:33 nativespace-cdp sshd[3072418]: Connection closed by 159.100.136.21 port 37012 [preauth]
Sep  6 23:26:34 nativespace-cdp sshd[3073388]: Connection closed by 159.100.136.21 port 46836 [preauth]
Sep  6 23:31:33 nativespace-cdp sshd[3074537]: Connection closed by 159.100.136.21 port 56206 [preauth]
Sep  6 23:36:33 nativespace-cdp sshd[3075489]: Connection closed by 159.100.136.21 port 37422 [preauth]
Sep  6 23:41:33 nativespace-cdp sshd[3076653]: Connection closed by 159.100.136.21 port 46752 [preauth]
Sep  6 23:46:34 nativespace-cdp sshd[3077796]: Connection closed by 159.100.136.21 port 55188 [preauth]
Sep  6 23:51:33 nativespace-cdp sshd[3078755]: Connection closed by 159.100.136.21 port 36524 [preauth]
Sep  6 23:56:36 nativespace-cdp sshd[3079908]: Connection closed by 159.100.136.21 port 45846 [preauth]
Sep  6 23:57:29 nativespace-cdp sshd[3080127]: Invalid user idc from 81.192.46.48 port 34656
Sep  6 23:57:29 nativespace-cdp sshd[3080127]: input_userauth_request: invalid user idc [preauth]
Sep  6 23:57:30 nativespace-cdp sshd[3080127]: pam_unix(sshd:auth): check pass; user unknown
Sep  6 23:57:30 nativespace-cdp sshd[3080127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.192.46.48
Sep  6 23:57:31 nativespace-cdp sshd[3080127]: Failed password for invalid user idc from 81.192.46.48 port 34656 ssh2
Sep  6 23:57:31 nativespace-cdp sshd[3080127]: Received disconnect from 81.192.46.48 port 34656:11: Bye Bye [preauth]
Sep  6 23:57:31 nativespace-cdp sshd[3080127]: Disconnected from 81.192.46.48 port 34656 [preauth]
Sep  7 00:00:32 nativespace-cdp sshd[3080869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.192.46.48  user=root
Sep  7 00:00:32 nativespace-cdp sshd[3080869]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 00:00:35 nativespace-cdp sshd[3080869]: Failed password for root from 81.192.46.48 port 34156 ssh2
Sep  7 00:00:35 nativespace-cdp sshd[3080869]: Received disconnect from 81.192.46.48 port 34156:11: Bye Bye [preauth]
Sep  7 00:00:35 nativespace-cdp sshd[3080869]: Disconnected from 81.192.46.48 port 34156 [preauth]
Sep  7 00:01:13 nativespace-cdp sshd[3081046]: Invalid user pascoal from 81.192.46.48 port 46872
Sep  7 00:01:13 nativespace-cdp sshd[3081046]: input_userauth_request: invalid user pascoal [preauth]
Sep  7 00:01:13 nativespace-cdp sshd[3081046]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 00:01:13 nativespace-cdp sshd[3081046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.192.46.48
Sep  7 00:01:15 nativespace-cdp sshd[3081046]: Failed password for invalid user pascoal from 81.192.46.48 port 46872 ssh2
Sep  7 00:01:15 nativespace-cdp sshd[3081046]: Received disconnect from 81.192.46.48 port 46872:11: Bye Bye [preauth]
Sep  7 00:01:15 nativespace-cdp sshd[3081046]: Disconnected from 81.192.46.48 port 46872 [preauth]
Sep  7 00:01:33 nativespace-cdp sshd[3081105]: Connection closed by 159.100.136.21 port 55690 [preauth]
Sep  7 00:01:54 nativespace-cdp sshd[3081160]: Invalid user sasa from 81.192.46.48 port 59588
Sep  7 00:01:54 nativespace-cdp sshd[3081160]: input_userauth_request: invalid user sasa [preauth]
Sep  7 00:01:54 nativespace-cdp sshd[3081160]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 00:01:54 nativespace-cdp sshd[3081160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.192.46.48
Sep  7 00:01:56 nativespace-cdp sshd[3081160]: Failed password for invalid user sasa from 81.192.46.48 port 59588 ssh2
Sep  7 00:06:33 nativespace-cdp sshd[3082091]: Connection closed by 159.100.136.21 port 37750 [preauth]
Sep  7 00:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 00:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:16 nativespace-cdp sudo[3082608]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 00:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:16 nativespace-cdp sudo[3082612]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 00:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:17 nativespace-cdp sudo[3082617]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 00:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:17 nativespace-cdp sudo[3082624]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 00:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:18 nativespace-cdp sudo[3082630]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 00:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:18 nativespace-cdp sudo[3082639]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 00:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:18 nativespace-cdp sudo[3082643]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 00:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:18 nativespace-cdp sudo[3082648]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 00:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:18 nativespace-cdp sudo[3082654]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 00:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:18 nativespace-cdp sudo[3082659]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 00:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:18 nativespace-cdp sudo[3082665]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 00:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:26 nativespace-cdp sudo[3082690]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 00:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:26 nativespace-cdp sudo[3082697]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=costestimatorco user-2=firstrel user-3=clarkass user-4=highlegh user-5=southlon user-6=firstred user-7=firstres user-8=ultbcrra user-9=seftvta user-10=jonhartl user-11=coursemc user-12=opaiscyx user-13=ianrayne user-14=accooper user-15=thqkgnbz user-16=connectedshoppin user-17=elecleis user-18=milloyco user-19=gilpin user-20=fetch user-21=carsinyo user-22=hubmaster user-23=putterfi user-24=bedfords user-25=bemadonn user-26=newstoda user-27=belle user-28=ggaaorgu user-29=nstriton user-30=brighto1 user-31=oneoarco user-32=battlere user-33=vivienn1 user-34=firstre2 user-35=askhform user-36=stuartge user-37=innovat1 user-38=nativene user-39=alexadmin user-40=skyfirec user-41=ulsukarm user-42=foundation user-43=booff user-44=markward user-45=lbscrmod user-46=maflemin user-47=vantagep user-48=athenare
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=connect9 user-50=agproduc user-51=still user-52=leereyn1 user-53=stephani user-54=jarvisin user-55=theblack user-56=hodgesonweb user-57=spectrum user-58=wilsonsw user-59=megacards user-60=musorguk user-61=lakesan1 user-62=brmrjxl user-63=atestord user-64=sarafoundation user-65=strathar user-66=hhdugcor user-67=lbhyisi user-68=magichat user-69=martsblo user-70=ptkxhsbt user-71=dickemery123 user-72=mcdermos user-73=chrisdal user-74=david user-75=careers user-76=nbhavers user-77=tomandle user-78=jennimil user-79=branko user-80=hodgsonmail user-81=ranxterc user-82=outdoorc user-83=romaldki user-84=lucy user-85=attlebor user-86=onlycont user-87=crrtipdl user-88=sosevalu user-89=bakery user-90=nove user-91=boldover user-92=kategilpin user-93=stagingerris user-94=dancinggardener user-95=ladburyp user-96=design user-97=what user-98=oubpgvbx user-99=tstardom user-100=nvihkvu user-101=havantho user-102=cath
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=sketchy user-104=zebrapho user-105=bwppodcast user-106=steve user-107=asandcoc user-108=sibtoncc user-109=darkstar user-110=eatspam user-111=beauty user-112=dhyana user-113=fawcettd user-114=burydropin user-115=nsceres user-116=isleofwi user-117=smrszyqg user-118=barbersh user-119=tigerlet user-120=nomistakes user-121=hidden user-122=foods user-123=leftie user-124=health2045 user-125=fortunaz user-126=nscdp user-127=putterfc user-128=steakbridieme user-129=firstre5 user-130=donnychicago user-131=ctedorgu user-132=philmcph user-133=lkpier user-134=hirefootballgame user-135=courseme user-136=eugincou user-137=reliable user-138=ninejimm user-139=cambria1 user-140=cathski user-141=cwsocial user-142=paulmca1 user-143=pugwash user-144=howardon feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 00:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:26 nativespace-cdp sudo[3082703]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 00:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:26 nativespace-cdp sudo[3082710]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9y6fK0AyQRyxonvP.~
Sep  7 00:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:26 nativespace-cdp sudo[3082715]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9y6fK0AyQRyxonvP.~'
Sep  7 00:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:26 nativespace-cdp sudo[3082719]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9y6fK0AyQRyxonvP.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 00:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:26 nativespace-cdp sudo[3082725]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 00:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:27 nativespace-cdp sudo[3082731]: pam_unix(sudo:session): session closed for user root
Sep  7 00:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 00:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 00:09:31 nativespace-cdp sudo[3082764]: pam_unix(sudo:session): session closed for user root
Sep  7 00:11:34 nativespace-cdp sshd[3083306]: Connection closed by 159.100.136.21 port 46556 [preauth]
Sep  7 00:16:36 nativespace-cdp sshd[3084409]: Connection closed by 159.100.136.21 port 55554 [preauth]
Sep  7 00:21:35 nativespace-cdp sshd[3085468]: Connection closed by 159.100.136.21 port 36274 [preauth]
Sep  7 00:26:33 nativespace-cdp sshd[3086874]: Connection closed by 159.100.136.21 port 46086 [preauth]
Sep  7 00:31:33 nativespace-cdp sshd[3088144]: Connection closed by 159.100.136.21 port 55482 [preauth]
Sep  7 00:36:33 nativespace-cdp sshd[3089136]: Connection closed by 159.100.136.21 port 36466 [preauth]
Sep  7 00:41:35 nativespace-cdp sshd[3090357]: Connection closed by 159.100.136.21 port 45808 [preauth]
Sep  7 00:46:34 nativespace-cdp sshd[3091369]: Connection closed by 159.100.136.21 port 55538 [preauth]
Sep  7 00:51:33 nativespace-cdp sshd[3092457]: Connection closed by 159.100.136.21 port 36336 [preauth]
Sep  7 00:56:34 nativespace-cdp sshd[3093529]: Connection closed by 159.100.136.21 port 45940 [preauth]
Sep  7 01:01:33 nativespace-cdp sshd[3094823]: Connection closed by 159.100.136.21 port 55570 [preauth]
Sep  7 01:06:37 nativespace-cdp sshd[3095837]: Connection closed by 159.100.136.21 port 37506 [preauth]
Sep  7 01:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 01:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:17 nativespace-cdp sudo[3096360]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 01:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:17 nativespace-cdp sudo[3096363]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 01:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:18 nativespace-cdp sudo[3096367]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 01:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:18 nativespace-cdp sudo[3096371]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 01:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:19 nativespace-cdp sudo[3096374]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:19 nativespace-cdp sudo[3096382]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:19 nativespace-cdp sudo[3096385]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:19 nativespace-cdp sudo[3096388]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:19 nativespace-cdp sudo[3096391]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:19 nativespace-cdp sudo[3096395]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 01:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:19 nativespace-cdp sudo[3096398]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:21 nativespace-cdp sudo[3096408]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:21 nativespace-cdp sudo[3096413]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=zebrapho user-2=bwppodcast user-3=steve user-4=asandcoc user-5=sibtoncc user-6=darkstar user-7=eatspam user-8=beauty user-9=dhyana user-10=fawcettd user-11=burydropin user-12=nsceres user-13=smrszyqg user-14=isleofwi user-15=barbersh user-16=tigerlet user-17=nomistakes user-18=hidden user-19=foods user-20=leftie user-21=health2045 user-22=fortunaz user-23=nscdp user-24=putterfc user-25=firstre5 user-26=donnychicago user-27=steakbridieme user-28=ctedorgu user-29=philmcph user-30=lkpier user-31=hirefootballgame user-32=courseme user-33=eugincou user-34=reliable user-35=ninejimm user-36=cathski user-37=cambria1 user-38=cwsocial user-39=paulmca1 user-40=pugwash user-41=howardon user-42=mcdermos user-43=chrisdal user-44=david user-45=nbhavers user-46=careers user-47=tomandle user-48=jennimil
Sep  7 01:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=branko user-50=ranxterc user-51=outdoorc user-52=hodgsonmail user-53=romaldki user-54=lucy user-55=attlebor user-56=onlycont user-57=crrtipdl user-58=sosevalu user-59=bakery user-60=nove user-61=boldover user-62=kategilpin user-63=dancinggardener user-64=stagingerris user-65=ladburyp user-66=design user-67=what user-68=oubpgvbx user-69=tstardom user-70=nvihkvu user-71=havantho user-72=cath user-73=sketchy user-74=ulsukarm user-75=foundation user-76=booff user-77=markward user-78=lbscrmod user-79=maflemin user-80=vantagep user-81=athenare user-82=connect9 user-83=agproduc user-84=still user-85=leereyn1 user-86=stephani user-87=jarvisin user-88=hodgesonweb user-89=theblack user-90=spectrum user-91=wilsonsw user-92=megacards user-93=musorguk user-94=lakesan1 user-95=brmrjxl user-96=atestord user-97=sarafoundation user-98=strathar user-99=hhdugcor user-100=lbhyisi user-101=magichat user-102=martsblo
Sep  7 01:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ptkxhsbt user-104=dickemery123 user-105=costestimatorco user-106=clarkass user-107=firstrel user-108=highlegh user-109=southlon user-110=firstred user-111=firstres user-112=ultbcrra user-113=seftvta user-114=jonhartl user-115=opaiscyx user-116=coursemc user-117=ianrayne user-118=accooper user-119=thqkgnbz user-120=connectedshoppin user-121=elecleis user-122=gilpin user-123=milloyco user-124=fetch user-125=carsinyo user-126=putterfi user-127=hubmaster user-128=bedfords user-129=bemadonn user-130=newstoda user-131=belle user-132=ggaaorgu user-133=nstriton user-134=brighto1 user-135=oneoarco user-136=battlere user-137=vivienn1 user-138=firstre2 user-139=askhform user-140=stuartge user-141=innovat1 user-142=nativene user-143=alexadmin user-144=skyfirec feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 01:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 01:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:22 nativespace-cdp sudo[3096417]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 01:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:22 nativespace-cdp sudo[3096422]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wciNaYq9NRChmI6V.~
Sep  7 01:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:22 nativespace-cdp sudo[3096425]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wciNaYq9NRChmI6V.~'
Sep  7 01:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:22 nativespace-cdp sudo[3096428]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wciNaYq9NRChmI6V.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 01:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:22 nativespace-cdp sudo[3096432]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 01:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:22 nativespace-cdp sudo[3096436]: pam_unix(sudo:session): session closed for user root
Sep  7 01:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 01:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 01:09:26 nativespace-cdp sudo[3096461]: pam_unix(sudo:session): session closed for user root
Sep  7 01:11:33 nativespace-cdp sshd[3097082]: Connection closed by 159.100.136.21 port 47262 [preauth]
Sep  7 01:16:33 nativespace-cdp sshd[3098110]: Connection closed by 159.100.136.21 port 56984 [preauth]
Sep  7 01:21:33 nativespace-cdp sshd[3099131]: Connection closed by 159.100.136.21 port 38318 [preauth]
Sep  7 01:26:33 nativespace-cdp sshd[3100179]: Connection closed by 159.100.136.21 port 47626 [preauth]
Sep  7 01:31:35 nativespace-cdp sshd[3101266]: Connection closed by 159.100.136.21 port 56490 [preauth]
Sep  7 01:36:34 nativespace-cdp sshd[3102260]: Connection closed by 159.100.136.21 port 37884 [preauth]
Sep  7 01:41:35 nativespace-cdp sshd[3103473]: Connection closed by 159.100.136.21 port 46804 [preauth]
Sep  7 01:46:33 nativespace-cdp sshd[3104480]: Connection closed by 159.100.136.21 port 55420 [preauth]
Sep  7 01:51:33 nativespace-cdp sshd[3105664]: Connection closed by 159.100.136.21 port 35666 [preauth]
Sep  7 01:56:34 nativespace-cdp sshd[3106744]: Connection closed by 159.100.136.21 port 45408 [preauth]
Sep  7 02:01:33 nativespace-cdp sshd[3107853]: Connection closed by 159.100.136.21 port 54826 [preauth]
Sep  7 02:06:37 nativespace-cdp sshd[3108849]: Connection closed by 159.100.136.21 port 35158 [preauth]
Sep  7 02:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 02:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:16 nativespace-cdp sudo[3109425]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 02:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:16 nativespace-cdp sudo[3109428]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 02:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:17 nativespace-cdp sudo[3109431]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 02:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:17 nativespace-cdp sudo[3109440]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 02:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:18 nativespace-cdp sudo[3109444]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 02:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:18 nativespace-cdp sudo[3109453]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 02:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:18 nativespace-cdp sudo[3109456]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 02:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:18 nativespace-cdp sudo[3109459]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 02:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:18 nativespace-cdp sudo[3109462]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 02:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:18 nativespace-cdp sudo[3109465]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 02:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:18 nativespace-cdp sudo[3109468]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:21 nativespace-cdp sudo[3109480]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:21 nativespace-cdp sudo[3109484]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=paulmca1 user-2=pugwash user-3=howardon user-4=cwsocial user-5=cambria1 user-6=cathski user-7=reliable user-8=ninejimm user-9=eugincou user-10=courseme user-11=hirefootballgame user-12=lkpier user-13=philmcph user-14=ctedorgu user-15=firstre5 user-16=donnychicago user-17=steakbridieme user-18=putterfc user-19=nscdp user-20=fortunaz user-21=health2045 user-22=leftie user-23=foods user-24=hidden user-25=nomistakes user-26=barbersh user-27=tigerlet user-28=smrszyqg user-29=isleofwi user-30=nsceres user-31=burydropin user-32=fawcettd user-33=dhyana user-34=beauty user-35=eatspam user-36=darkstar user-37=asandcoc user-38=sibtoncc user-39=steve user-40=bwppodcast user-41=zebrapho user-42=cath user-43=sketchy user-44=havantho user-45=nvihkvu user-46=oubpgvbx user-47=tstardom user-48=what user-49=design
Sep  7 02:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=ladburyp user-51=dancinggardener user-52=stagingerris user-53=kategilpin user-54=boldover user-55=nove user-56=bakery user-57=sosevalu user-58=crrtipdl user-59=onlycont user-60=attlebor user-61=lucy user-62=romaldki user-63=hodgsonmail user-64=outdoorc user-65=ranxterc user-66=branko user-67=jennimil user-68=tomandle user-69=nbhavers user-70=careers user-71=david user-72=chrisdal user-73=mcdermos user-74=dickemery123 user-75=ptkxhsbt user-76=martsblo user-77=magichat user-78=lbhyisi user-79=hhdugcor user-80=strathar user-81=sarafoundation user-82=atestord user-83=brmrjxl user-84=lakesan1 user-85=musorguk user-86=megacards user-87=wilsonsw user-88=spectrum user-89=hodgesonweb user-90=theblack user-91=jarvisin user-92=stephani user-93=leereyn1 user-94=still user-95=agproduc user-96=athenare user-97=connect9 user-98=vantagep user-99=maflemin user-100=lbscrmod user-101=booff user-102=foundation
Sep  7 02:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=markward user-104=ulsukarm user-105=skyfirec user-106=alexadmin user-107=nativene user-108=innovat1 user-109=stuartge user-110=askhform user-111=firstre2 user-112=vivienn1 user-113=battlere user-114=oneoarco user-115=brighto1 user-116=nstriton user-117=belle user-118=ggaaorgu user-119=newstoda user-120=bemadonn user-121=bedfords user-122=hubmaster user-123=putterfi user-124=carsinyo user-125=fetch user-126=milloyco user-127=gilpin user-128=elecleis user-129=connectedshoppin user-130=thqkgnbz user-131=accooper user-132=ianrayne user-133=coursemc user-134=opaiscyx user-135=jonhartl user-136=seftvta user-137=ultbcrra user-138=firstres user-139=firstred user-140=southlon user-141=highlegh user-142=firstrel user-143=clarkass user-144=costestimatorco feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 02:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:21 nativespace-cdp sudo[3109488]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:21 nativespace-cdp sudo[3109493]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dJH7QDIgApI9wn26.~
Sep  7 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:22 nativespace-cdp sudo[3109496]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dJH7QDIgApI9wn26.~'
Sep  7 02:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:22 nativespace-cdp sudo[3109499]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dJH7QDIgApI9wn26.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 02:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:22 nativespace-cdp sudo[3109503]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 02:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:22 nativespace-cdp sudo[3109506]: pam_unix(sudo:session): session closed for user root
Sep  7 02:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 02:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:09:23 nativespace-cdp sudo[3109526]: pam_unix(sudo:session): session closed for user root
Sep  7 02:11:33 nativespace-cdp sshd[3110142]: Connection closed by 159.100.136.21 port 43966 [preauth]
Sep  7 02:13:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 02:13:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 02:13:02 nativespace-cdp sudo[3110342]: pam_unix(sudo:session): session closed for user root
Sep  7 02:16:34 nativespace-cdp sshd[3111095]: Connection closed by 159.100.136.21 port 53418 [preauth]
Sep  7 02:21:34 nativespace-cdp sshd[3112051]: Connection closed by 159.100.136.21 port 34408 [preauth]
Sep  7 02:26:33 nativespace-cdp sshd[3113148]: Connection closed by 159.100.136.21 port 43574 [preauth]
Sep  7 02:31:34 nativespace-cdp sshd[3114154]: Connection closed by 159.100.136.21 port 53130 [preauth]
Sep  7 02:36:34 nativespace-cdp sshd[3115185]: Connection closed by 159.100.136.21 port 34384 [preauth]
Sep  7 02:41:33 nativespace-cdp sshd[3116351]: Connection closed by 159.100.136.21 port 43738 [preauth]
Sep  7 02:46:33 nativespace-cdp sshd[3117447]: Connection closed by 159.100.136.21 port 53082 [preauth]
Sep  7 02:51:33 nativespace-cdp sshd[3118419]: Connection closed by 159.100.136.21 port 32932 [preauth]
Sep  7 02:56:36 nativespace-cdp sshd[3119658]: Connection closed by 159.100.136.21 port 42490 [preauth]
Sep  7 03:01:33 nativespace-cdp sshd[3120686]: Connection closed by 159.100.136.21 port 51798 [preauth]
Sep  7 03:06:34 nativespace-cdp sshd[3121667]: Connection closed by 159.100.136.21 port 60188 [preauth]
Sep  7 03:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 03:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:16 nativespace-cdp sudo[3122183]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 03:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:16 nativespace-cdp sudo[3122186]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 03:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:17 nativespace-cdp sudo[3122189]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 03:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:17 nativespace-cdp sudo[3122199]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 03:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:18 nativespace-cdp sudo[3122202]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:19 nativespace-cdp sudo[3122210]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:19 nativespace-cdp sudo[3122213]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:19 nativespace-cdp sudo[3122216]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:19 nativespace-cdp sudo[3122219]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:19 nativespace-cdp sudo[3122222]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:19 nativespace-cdp sudo[3122226]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:31 nativespace-cdp sudo[3122253]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:31 nativespace-cdp sudo[3122260]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=asandcoc user-2=sibtoncc user-3=steve user-4=bwppodcast user-5=zebrapho user-6=nsceres user-7=fawcettd user-8=burydropin user-9=dhyana user-10=beauty user-11=darkstar user-12=eatspam user-13=lkpier user-14=steakbridieme user-15=firstre5 user-16=donnychicago user-17=ctedorgu user-18=philmcph user-19=nscdp user-20=putterfc user-21=foods user-22=leftie user-23=fortunaz user-24=health2045 user-25=nomistakes user-26=hidden user-27=barbersh user-28=tigerlet user-29=isleofwi user-30=smrszyqg user-31=cwsocial user-32=howardon user-33=paulmca1 user-34=pugwash user-35=cathski user-36=cambria1 user-37=reliable user-38=ninejimm user-39=eugincou user-40=courseme user-41=hirefootballgame user-42=jennimil user-43=tomandle user-44=david user-45=nbhavers user-46=careers user-47=chrisdal user-48=mcdermos
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=lucy user-51=attlebor user-52=romaldki user-53=hodgsonmail user-54=ranxterc user-55=outdoorc user-56=branko user-57=boldover user-58=nove user-59=bakery user-60=crrtipdl user-61=sosevalu user-62=havantho user-63=cath user-64=sketchy user-65=nvihkvu user-66=oubpgvbx user-67=tstardom user-68=what user-69=design user-70=stagingerris user-71=dancinggardener user-72=ladburyp user-73=kategilpin user-74=vantagep user-75=athenare user-76=connect9 user-77=lbscrmod user-78=maflemin user-79=markward user-80=booff user-81=foundation user-82=ulsukarm user-83=spectrum user-84=theblack user-85=hodgesonweb user-86=jarvisin user-87=stephani user-88=leereyn1 user-89=agproduc user-90=still user-91=strathar user-92=atestord user-93=sarafoundation user-94=lakesan1 user-95=brmrjxl user-96=megacards user-97=musorguk user-98=wilsonsw user-99=dickemery123 user-100=ptkxhsbt user-101=martsblo user-102=magichat
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=hhdugcor user-104=lbhyisi user-105=coursemc user-106=opaiscyx user-107=ultbcrra user-108=jonhartl user-109=seftvta user-110=firstres user-111=firstred user-112=highlegh user-113=southlon user-114=firstrel user-115=clarkass user-116=costestimatorco user-117=hubmaster user-118=putterfi user-119=fetch user-120=carsinyo user-121=milloyco user-122=gilpin user-123=elecleis user-124=connectedshoppin user-125=thqkgnbz user-126=accooper user-127=ianrayne user-128=vivienn1 user-129=firstre2 user-130=oneoarco user-131=battlere user-132=nstriton user-133=brighto1 user-134=newstoda user-135=belle user-136=ggaaorgu user-137=bemadonn user-138=bedfords user-139=skyfirec user-140=alexadmin user-141=nativene user-142=innovat1 user-143=stuartge user-144=askhform feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:31 nativespace-cdp sudo[3122265]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:31 nativespace-cdp sudo[3122269]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jSYjjPmhwn4hdKQK.~
Sep  7 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:31 nativespace-cdp sudo[3122272]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jSYjjPmhwn4hdKQK.~'
Sep  7 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:31 nativespace-cdp sudo[3122276]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jSYjjPmhwn4hdKQK.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:31 nativespace-cdp sudo[3122280]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 03:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:31 nativespace-cdp sudo[3122284]: pam_unix(sudo:session): session closed for user root
Sep  7 03:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 03:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 03:09:48 nativespace-cdp sudo[3122346]: pam_unix(sudo:session): session closed for user root
Sep  7 03:11:33 nativespace-cdp sshd[3122936]: Connection closed by 159.100.136.21 port 41210 [preauth]
Sep  7 03:16:33 nativespace-cdp sshd[3123917]: Connection closed by 159.100.136.21 port 50132 [preauth]
Sep  7 03:21:33 nativespace-cdp sshd[3124855]: Connection closed by 159.100.136.21 port 59028 [preauth]
Sep  7 03:26:33 nativespace-cdp sshd[3125980]: Connection closed by 159.100.136.21 port 39744 [preauth]
Sep  7 03:31:35 nativespace-cdp sshd[3127043]: Connection closed by 159.100.136.21 port 48450 [preauth]
Sep  7 03:36:34 nativespace-cdp sshd[3127992]: Connection closed by 159.100.136.21 port 57406 [preauth]
Sep  7 03:41:33 nativespace-cdp sshd[3129133]: Connection closed by 159.100.136.21 port 38394 [preauth]
Sep  7 03:46:34 nativespace-cdp sshd[3130241]: Connection closed by 159.100.136.21 port 47948 [preauth]
Sep  7 03:51:35 nativespace-cdp sshd[3131254]: Connection closed by 159.100.136.21 port 57066 [preauth]
Sep  7 03:56:33 nativespace-cdp sshd[3132333]: Connection closed by 159.100.136.21 port 38190 [preauth]
Sep  7 04:01:33 nativespace-cdp sshd[3133386]: Connection closed by 159.100.136.21 port 47982 [preauth]
Sep  7 04:06:36 nativespace-cdp sshd[3134365]: Connection closed by 159.100.136.21 port 57730 [preauth]
Sep  7 04:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 04:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:16 nativespace-cdp sudo[3134828]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 04:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:16 nativespace-cdp sudo[3134831]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 04:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:17 nativespace-cdp sudo[3134834]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 04:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:17 nativespace-cdp sudo[3134838]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 04:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:18 nativespace-cdp sudo[3134841]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 04:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:18 nativespace-cdp sudo[3134849]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 04:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:18 nativespace-cdp sudo[3134852]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 04:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:18 nativespace-cdp sudo[3134855]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 04:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:18 nativespace-cdp sudo[3134858]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 04:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:18 nativespace-cdp sudo[3134861]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 04:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:18 nativespace-cdp sudo[3134865]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 04:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:34 nativespace-cdp sudo[3135020]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 04:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:34 nativespace-cdp sudo[3135024]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nstriton user-2=brighto1 user-3=vivienn1 user-4=firstre2 user-5=oneoarco user-6=battlere user-7=bedfords user-8=newstoda user-9=ggaaorgu user-10=belle user-11=bemadonn user-12=skyfirec user-13=alexadmin user-14=innovat1 user-15=askhform user-16=stuartge user-17=nativene user-18=ultbcrra user-19=seftvta user-20=jonhartl user-21=firstres user-22=coursemc user-23=opaiscyx user-24=firstrel user-25=clarkass user-26=costestimatorco user-27=firstred user-28=highlegh user-29=southlon user-30=gilpin user-31=milloyco user-32=elecleis user-33=hubmaster user-34=putterfi user-35=fetch user-36=carsinyo user-37=accooper user-38=ianrayne user-39=connectedshoppin user-40=thqkgnbz user-41=lakesan1 user-42=brmrjxl user-43=strathar user-44=atestord user-45=sarafoundation user-46=wilsonsw user-47=megacards
Sep  7 04:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=musorguk user-49=martsblo user-50=dickemery123 user-51=ptkxhsbt user-52=hhdugcor user-53=lbhyisi user-54=magichat user-55=markward user-56=booff user-57=foundation user-58=vantagep user-59=connect9 user-60=athenare user-61=lbscrmod user-62=maflemin user-63=ulsukarm user-64=jarvisin user-65=spectrum user-66=theblack user-67=hodgesonweb user-68=agproduc user-69=still user-70=stephani user-71=leereyn1 user-72=nove user-73=boldover user-74=bakery user-75=crrtipdl user-76=sosevalu user-77=oubpgvbx user-78=tstardom user-79=what user-80=havantho user-81=cath user-82=sketchy user-83=nvihkvu user-84=dancinggardener user-85=stagingerris user-86=ladburyp user-87=kategilpin user-88=design user-89=tomandle user-90=jennimil user-91=chrisdal user-92=mcdermos user-93=david user-94=nbhavers user-95=careers user-96=lucy user-97=attlebor user-98=onlycont user-99=outdoorc user-100=ranxterc user-101=hodgsonmail
Sep  7 04:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=branko user-103=romaldki user-104=nscdp user-105=putterfc user-106=leftie user-107=foods user-108=health2045 user-109=fortunaz user-110=lkpier user-111=firstre5 user-112=steakbridieme user-113=donnychicago user-114=philmcph user-115=ctedorgu user-116=smrszyqg user-117=isleofwi user-118=nomistakes user-119=hidden user-120=barbersh user-121=tigerlet user-122=cambria1 user-123=cathski user-124=reliable user-125=ninejimm user-126=cwsocial user-127=paulmca1 user-128=howardon user-129=pugwash user-130=hirefootballgame user-131=eugincou user-132=courseme user-133=asandcoc user-134=sibtoncc user-135=bwppodcast user-136=zebrapho user-137=steve user-138=fawcettd user-139=burydropin user-140=nsceres user-141=beauty user-142=darkstar user-143=eatspam user-144=dhyana feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  7 04:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 04:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:35 nativespace-cdp sudo[3135028]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 04:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:35 nativespace-cdp sudo[3135034]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UqhwcNfY9pRAGqx6.~
Sep  7 04:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:35 nativespace-cdp sudo[3135037]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UqhwcNfY9pRAGqx6.~'
Sep  7 04:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:35 nativespace-cdp sudo[3135040]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UqhwcNfY9pRAGqx6.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 04:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:35 nativespace-cdp sudo[3135044]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 04:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:35 nativespace-cdp sudo[3135049]: pam_unix(sudo:session): session closed for user root
Sep  7 04:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 04:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:09:36 nativespace-cdp sudo[3135065]: pam_unix(sudo:session): session closed for user root
Sep  7 04:11:35 nativespace-cdp sshd[3135759]: Connection closed by 159.100.136.21 port 38848 [preauth]
Sep  7 04:16:33 nativespace-cdp sshd[3136726]: Connection closed by 159.100.136.21 port 47206 [preauth]
Sep  7 04:21:36 nativespace-cdp sshd[3138337]: Connection closed by 159.100.136.21 port 56494 [preauth]
Sep  7 04:26:37 nativespace-cdp sshd[3139474]: Connection closed by 159.100.136.21 port 37008 [preauth]
Sep  7 04:31:32 nativespace-cdp sshd[3140796]: Connection closed by 159.100.136.21 port 46430 [preauth]
Sep  7 04:36:32 nativespace-cdp sshd[3141869]: Connection closed by 159.100.136.21 port 56124 [preauth]
Sep  7 04:41:33 nativespace-cdp sshd[3144365]: Connection closed by 159.100.136.21 port 37378 [preauth]
Sep  7 04:46:33 nativespace-cdp sshd[3145693]: Connection closed by 159.100.136.21 port 46992 [preauth]
Sep  7 04:51:33 nativespace-cdp sshd[3146881]: Connection closed by 159.100.136.21 port 55300 [preauth]
Sep  7 04:56:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 04:56:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:21 nativespace-cdp sudo[3148171]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 04:56:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:21 nativespace-cdp sudo[3148178]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 04:56:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:25 nativespace-cdp sudo[3148188]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=foundation user-3=booff user-4=markward user-5=athenare user-6=connect9 user-7=vantagep user-8=maflemin user-9=lbscrmod user-10=still user-11=agproduc user-12=stephani user-13=leereyn1 user-14=jarvisin user-15=spectrum user-16=hodgesonweb user-17=theblack user-18=wilsonsw user-19=musorguk user-20=megacards user-21=lakesan1 user-22=brmrjxl user-23=strathar user-24=sarafoundation user-25=atestord user-26=lbhyisi user-27=hhdugcor user-28=magichat user-29=martsblo user-30=dickemery123 user-31=ptkxhsbt user-32=clarkass user-33=firstrel user-34=costestimatorco user-35=firstred user-36=southlon user-37=highlegh user-38=seftvta user-39=jonhartl user-40=ultbcrra user-41=firstres user-42=coursemc user-43=opaiscyx user-44=accooper user-45=ianrayne user-46=connectedshoppin user-47=thqkgnbz
Sep  7 04:56:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=milloyco user-49=gilpin user-50=elecleis user-51=hubmaster user-52=putterfi user-53=carsinyo user-54=fetch user-55=bedfords user-56=ggaaorgu user-57=belle user-58=newstoda user-59=bemadonn user-60=brighto1 user-61=nstriton user-62=firstre2 user-63=vivienn1 user-64=battlere user-65=oneoarco user-66=innovat1 user-67=askhform user-68=stuartge user-69=nativene user-70=alexadmin user-71=skyfirec user-72=bwppodcast user-73=zebrapho user-74=steve user-75=asandcoc user-76=sibtoncc user-77=beauty user-78=eatspam user-79=darkstar user-80=dhyana user-81=burydropin user-82=fawcettd user-83=nsceres user-84=smrszyqg user-85=isleofwi user-86=hidden user-87=nomistakes user-88=barbersh user-89=tigerlet user-90=putterfc user-91=nscdp user-92=fortunaz user-93=health2045 user-94=foods user-95=leftie user-96=lkpier user-97=philmcph user-98=ctedorgu user-99=donnychicago user-100=steakbridieme user-101=firstre5
Sep  7 04:56:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hirefootballgame user-103=eugincou user-104=courseme user-105=cathski user-106=cambria1 user-107=ninejimm user-108=reliable user-109=howardon user-110=pugwash user-111=paulmca1 user-112=cwsocial user-113=chrisdal user-114=mcdermos user-115=nbhavers user-116=careers user-117=david user-118=tomandle user-119=jennimil user-120=ranxterc user-121=outdoorc user-122=hodgsonmail user-123=branko user-124=romaldki user-125=attlebor user-126=lucy user-127=onlycont user-128=bakery user-129=sosevalu user-130=crrtipdl user-131=nove user-132=boldover user-133=ladburyp user-134=stagingerris user-135=dancinggardener user-136=kategilpin user-137=design user-138=oubpgvbx user-139=tstardom user-140=what user-141=sketchy user-142=cath user-143=havantho user-144=nvihkvu feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 04:56:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 04:56:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:26 nativespace-cdp sudo[3148192]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  7 04:56:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:27 nativespace-cdp sudo[3148199]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep  7 04:56:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:27 nativespace-cdp sudo[3148205]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:33 nativespace-cdp sshd[3148234]: Connection closed by 159.100.136.21 port 36178 [preauth]
Sep  7 04:56:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  7 04:56:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:56:50 nativespace-cdp sudo[3148306]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:56:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  7 04:56:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:51 nativespace-cdp sudo[3148312]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep  7 04:56:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:53 nativespace-cdp sudo[3148317]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep  7 04:56:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:55 nativespace-cdp sudo[3148324]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  7 04:56:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:56:55 nativespace-cdp sudo[3148335]: pam_unix(sudo:session): session closed for user root
Sep  7 04:56:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep  7 04:56:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:57:00 nativespace-cdp sudo[3148355]: pam_unix(sudo:session): session closed for user root
Sep  7 04:57:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep  7 04:57:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:57:04 nativespace-cdp sudo[3148362]: pam_unix(sudo:session): session closed for user root
Sep  7 04:57:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep  7 04:57:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:57:05 nativespace-cdp sudo[3148392]: pam_unix(sudo:session): session closed for user root
Sep  7 04:57:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep  7 04:57:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:57:05 nativespace-cdp sudo[3148396]: pam_unix(sudo:session): session closed for user root
Sep  7 04:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep  7 04:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:57:19 nativespace-cdp sudo[3148558]: pam_unix(sudo:session): session closed for user root
Sep  7 04:57:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  7 04:57:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:57:22 nativespace-cdp sudo[3148612]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:57:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  7 04:57:23 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  7 04:57:23 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  7 04:57:23 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:57:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:57:23 nativespace-cdp sudo[3148621]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:57:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  7 04:57:23 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  7 04:57:23 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  7 04:57:23 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:57:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:57:48 nativespace-cdp sudo[3148627]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:58:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  7 04:58:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:58:01 nativespace-cdp sudo[3148817]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:58:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  7 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  7 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  7 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:58:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:58:01 nativespace-cdp sudo[3148823]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:58:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  7 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  7 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  7 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:58:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:58:02 nativespace-cdp sudo[3148829]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:58:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  7 04:58:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:58:04 nativespace-cdp sudo[3148868]: pam_unix(sudo:session): session closed for user root
Sep  7 04:58:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep  7 04:58:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:58:04 nativespace-cdp sudo[3148873]: pam_unix(sudo:session): session closed for user root
Sep  7 04:58:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  7 04:58:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 04:58:16 nativespace-cdp sudo[3148954]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 04:58:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep  7 04:58:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:58:17 nativespace-cdp sudo[3148961]: pam_unix(sudo:session): session closed for user root
Sep  7 04:58:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep  7 04:58:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:58:17 nativespace-cdp sudo[3148965]: pam_unix(sudo:session): session closed for user root
Sep  7 04:58:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  7 04:58:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:58:17 nativespace-cdp sudo[3148970]: pam_unix(sudo:session): session closed for user root
Sep  7 04:58:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep  7 04:58:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:58:18 nativespace-cdp sudo[3148986]: pam_unix(sudo:session): session closed for user root
Sep  7 04:58:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep  7 04:58:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:58:18 nativespace-cdp sudo[3148992]: pam_unix(sudo:session): session closed for user root
Sep  7 04:58:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep  7 04:58:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:58:34 nativespace-cdp sudo[3149084]: pam_unix(sudo:session): session closed for user root
Sep  7 04:58:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  7 04:58:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 04:58:37 nativespace-cdp sudo[3149138]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 04:58:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  7 04:58:37 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  7 04:58:37 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  7 04:58:37 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:58:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 04:58:37 nativespace-cdp sudo[3149144]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 04:58:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  7 04:58:37 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  7 04:58:37 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  7 04:58:37 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:58:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 04:58:54 nativespace-cdp sudo[3149151]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 04:58:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  7 04:58:54 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  7 04:58:54 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  7 04:58:54 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:58:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 04:58:56 nativespace-cdp sudo[3149280]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 04:59:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  7 04:59:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 04:59:02 nativespace-cdp sudo[3149402]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 04:59:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  7 04:59:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  7 04:59:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  7 04:59:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:59:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 04:59:02 nativespace-cdp sudo[3149408]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 04:59:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  7 04:59:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  7 04:59:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  7 04:59:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:59:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 04:59:03 nativespace-cdp sudo[3149414]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 04:59:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  7 04:59:03 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  7 04:59:03 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  7 04:59:03 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:59:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 04:59:03 nativespace-cdp sudo[3149420]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 04:59:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  7 04:59:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:05 nativespace-cdp sudo[3149454]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep  7 04:59:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:05 nativespace-cdp sudo[3149458]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep  7 04:59:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:11 nativespace-cdp sudo[3149482]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep  7 04:59:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:11 nativespace-cdp sudo[3149487]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  7 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  7 04:59:12 nativespace-cdp sudo[3149497]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  7 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep  7 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:12 nativespace-cdp sudo[3149506]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep  7 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:12 nativespace-cdp sudo[3149509]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep  7 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:14 nativespace-cdp sudo[3149514]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  7 04:59:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:14 nativespace-cdp sudo[3149521]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  7 04:59:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:59:22 nativespace-cdp sudo[3149575]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:59:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  7 04:59:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:22 nativespace-cdp sudo[3149583]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  7 04:59:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:23 nativespace-cdp sudo[3149588]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep  7 04:59:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:24 nativespace-cdp sudo[3149600]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep  7 04:59:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 04:59:28 nativespace-cdp sudo[3149669]: pam_unix(sudo:session): session closed for user root
Sep  7 04:59:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  7 04:59:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:59:31 nativespace-cdp sudo[3149726]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:59:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  7 04:59:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  7 04:59:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  7 04:59:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:59:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:59:32 nativespace-cdp sudo[3149732]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:59:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  7 04:59:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  7 04:59:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  7 04:59:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:59:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:59:50 nativespace-cdp sudo[3149740]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:59:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  7 04:59:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:59:58 nativespace-cdp sudo[3149887]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:59:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  7 04:59:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  7 04:59:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  7 04:59:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:59:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:59:58 nativespace-cdp sudo[3149893]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 04:59:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  7 04:59:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  7 04:59:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  7 04:59:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  7 04:59:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 04:59:58 nativespace-cdp sudo[3149899]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 05:00:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  7 05:00:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:01 nativespace-cdp sudo[3149936]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep  7 05:00:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:01 nativespace-cdp sudo[3149940]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  7 05:00:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  7 05:00:13 nativespace-cdp sudo[3150175]: pam_unix(sudo:session): session closed for user fortunaz
Sep  7 05:00:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep  7 05:00:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:13 nativespace-cdp sudo[3150181]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep  7 05:00:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:14 nativespace-cdp sudo[3150185]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  7 05:00:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:14 nativespace-cdp sudo[3150190]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep  7 05:00:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:16 nativespace-cdp sudo[3150205]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  7 05:00:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:17 nativespace-cdp sudo[3150211]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep  7 05:00:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:25 nativespace-cdp sudo[3150338]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=ulsukarm WpToolkitNotification send_admin_auto_updates_notification available_updates_text= available_updates_list= installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep  7 05:00:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:45 nativespace-cdp sudo[3150556]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep  7 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:56 nativespace-cdp sudo[3150687]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  7 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:57 nativespace-cdp sudo[3150691]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  7 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:57 nativespace-cdp sudo[3150695]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  7 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:57 nativespace-cdp sudo[3150699]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  7 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:57 nativespace-cdp sudo[3150702]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  7 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:57 nativespace-cdp sudo[3150705]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  7 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:57 nativespace-cdp sudo[3150708]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  7 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150713]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150716]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150719]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150722]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150725]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150728]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150731]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150734]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150737]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150740]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150743]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150746]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150749]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150752]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150755]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150758]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150761]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150764]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150767]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150770]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150773]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150776]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150779]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150782]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150785]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150788]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150792]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150795]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150798]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150801]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150804]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:58 nativespace-cdp sudo[3150807]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150810]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150813]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150816]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150819]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150822]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150825]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150828]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150831]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150834]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150837]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150840]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150843]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150846]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150849]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150852]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150855]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150858]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150861]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150864]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150867]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150870]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150873]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150876]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150879]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150882]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150886]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150889]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150892]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150896]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150899]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150902]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:00:59 nativespace-cdp sudo[3150905]: pam_unix(sudo:session): session closed for user root
Sep  7 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150908]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150911]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150914]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150917]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150920]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150923]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150926]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150929]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150932]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150936]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150939]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150942]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150945]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150948]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150951]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150954]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150957]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150960]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150963]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150966]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150969]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150972]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150975]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150978]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150981]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150984]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150988]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150991]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150994]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3150997]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:00 nativespace-cdp sudo[3151000]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151003]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151007]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151010]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151013]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151016]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151019]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151022]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151025]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151028]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151031]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151034]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151037]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151040]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151043]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151046]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151049]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151052]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151055]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151060]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151070]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151084]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151087]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151090]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151093]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151096]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151099]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151102]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151105]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151108]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151112]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151115]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151118]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151121]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:01 nativespace-cdp sudo[3151124]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151127]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151130]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151133]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151137]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151141]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151144]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151147]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151150]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151153]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151156]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151159]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151162]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151165]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151168]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151171]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151174]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151177]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151180]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151183]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151186]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151189]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151192]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151195]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151198]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151201]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151204]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151207]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151210]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151213]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151216]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151219]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151222]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151225]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151229]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151232]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151235]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  7 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:02 nativespace-cdp sudo[3151238]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151241]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151249]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151252]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151255]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151258]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151261]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151264]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151267]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151270]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151273]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151276]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151279]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151282]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151286]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151289]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151292]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151295]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151298]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151301]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151304]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151307]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151310]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151313]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151316]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151319]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151322]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151325]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151328]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151331]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151334]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151337]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151341]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151344]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151347]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:03 nativespace-cdp sudo[3151350]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151353]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151356]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151359]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151362]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151365]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151368]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151371]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151374]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151377]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151380]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151383]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151386]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151389]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151392]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151395]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151398]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151401]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  7 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:01:04 nativespace-cdp sudo[3151404]: pam_unix(sudo:session): session closed for user root
Sep  7 05:01:33 nativespace-cdp sshd[3151486]: Connection closed by 159.100.136.21 port 45234 [preauth]
Sep  7 05:06:33 nativespace-cdp sshd[3152429]: Connection closed by 159.100.136.21 port 54644 [preauth]
Sep  7 05:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 05:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:19 nativespace-cdp sudo[3152914]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 05:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:19 nativespace-cdp sudo[3152917]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 05:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:20 nativespace-cdp sudo[3152920]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 05:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:20 nativespace-cdp sudo[3152924]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 05:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:22 nativespace-cdp sudo[3152927]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 05:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:22 nativespace-cdp sudo[3152937]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 05:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:22 nativespace-cdp sudo[3152940]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 05:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:22 nativespace-cdp sudo[3152943]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 05:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:22 nativespace-cdp sudo[3152946]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 05:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:22 nativespace-cdp sudo[3152949]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 05:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:22 nativespace-cdp sudo[3152953]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 05:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:24 nativespace-cdp sudo[3152965]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 05:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:25 nativespace-cdp sudo[3152969]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=mcdermos user-2=chrisdal user-3=david user-4=careers user-5=nbhavers user-6=tomandle user-7=jennimil user-8=branko user-9=outdoorc user-10=ranxterc user-11=hodgsonmail user-12=romaldki user-13=lucy user-14=attlebor user-15=onlycont user-16=crrtipdl user-17=sosevalu user-18=bakery user-19=nove user-20=boldover user-21=kategilpin user-22=dancinggardener user-23=stagingerris user-24=ladburyp user-25=design user-26=what user-27=tstardom user-28=oubpgvbx user-29=nvihkvu user-30=havantho user-31=cath user-32=sketchy user-33=zebrapho user-34=bwppodcast user-35=steve user-36=sibtoncc user-37=asandcoc user-38=darkstar user-39=eatspam user-40=beauty user-41=dhyana user-42=fawcettd user-43=burydropin user-44=nsceres user-45=isleofwi user-46=smrszyqg user-47=barbersh user-48=tigerlet user-49=nomistakes
Sep  7 05:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=hidden user-51=leftie user-52=foods user-53=health2045 user-54=fortunaz user-55=nscdp user-56=putterfc user-57=steakbridieme user-58=donnychicago user-59=firstre5 user-60=ctedorgu user-61=philmcph user-62=lkpier user-63=hirefootballgame user-64=courseme user-65=eugincou user-66=reliable user-67=ninejimm user-68=cathski user-69=cambria1 user-70=cwsocial user-71=howardon user-72=pugwash user-73=paulmca1 user-74=costestimatorco user-75=firstrel user-76=clarkass user-77=highlegh user-78=southlon user-79=firstred user-80=firstres user-81=ultbcrra user-82=seftvta user-83=jonhartl user-84=opaiscyx user-85=coursemc user-86=ianrayne user-87=accooper user-88=thqkgnbz user-89=connectedshoppin user-90=elecleis user-91=gilpin user-92=milloyco user-93=fetch user-94=carsinyo user-95=putterfi user-96=hubmaster user-97=bedfords user-98=bemadonn user-99=newstoda user-100=belle user-101=ggaaorgu user-102=nstriton
Sep  7 05:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=brighto1 user-104=oneoarco user-105=battlere user-106=vivienn1 user-107=firstre2 user-108=askhform user-109=stuartge user-110=innovat1 user-111=nativene user-112=skyfirec user-113=alexadmin user-114=ulsukarm user-115=markward user-116=foundation user-117=booff user-118=lbscrmod user-119=maflemin user-120=vantagep user-121=connect9 user-122=athenare user-123=agproduc user-124=still user-125=leereyn1 user-126=stephani user-127=jarvisin user-128=theblack user-129=hodgesonweb user-130=spectrum user-131=wilsonsw user-132=megacards user-133=musorguk user-134=brmrjxl user-135=lakesan1 user-136=atestord user-137=sarafoundation user-138=strathar user-139=hhdugcor user-140=lbhyisi user-141=magichat user-142=martsblo user-143=ptkxhsbt user-144=dickemery123 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 05:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:25 nativespace-cdp sudo[3152976]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:25 nativespace-cdp sudo[3152980]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NkgTlzUF4IIzfO50.~
Sep  7 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:25 nativespace-cdp sudo[3152983]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NkgTlzUF4IIzfO50.~'
Sep  7 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:25 nativespace-cdp sudo[3152987]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NkgTlzUF4IIzfO50.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:25 nativespace-cdp sudo[3152991]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 05:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:25 nativespace-cdp sudo[3152994]: pam_unix(sudo:session): session closed for user root
Sep  7 05:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 05:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 05:09:27 nativespace-cdp sudo[3153012]: pam_unix(sudo:session): session closed for user root
Sep  7 05:11:33 nativespace-cdp sshd[3153671]: Connection closed by 159.100.136.21 port 35572 [preauth]
Sep  7 05:13:32 nativespace-cdp sshd[3153914]: Connection closed by 167.94.146.57 port 48858 [preauth]
Sep  7 05:16:34 nativespace-cdp sshd[3154613]: Connection closed by 159.100.136.21 port 44928 [preauth]
Sep  7 05:21:33 nativespace-cdp sshd[3155557]: Connection closed by 159.100.136.21 port 54200 [preauth]
Sep  7 05:26:33 nativespace-cdp sshd[3156684]: Connection closed by 159.100.136.21 port 35564 [preauth]
Sep  7 05:31:36 nativespace-cdp sshd[3157711]: Connection closed by 159.100.136.21 port 43984 [preauth]
Sep  7 05:35:07 nativespace-cdp su: pam_unix(su:session): session opened for user fawcettd by (uid=0)
Sep  7 05:35:08 nativespace-cdp su[3158440]: pam_unix(su:session): session closed for user fawcettd
Sep  7 05:36:36 nativespace-cdp sshd[3158753]: Connection closed by 159.100.136.21 port 53148 [preauth]
Sep  7 05:41:33 nativespace-cdp sshd[3159959]: Connection closed by 159.100.136.21 port 33960 [preauth]
Sep  7 05:46:33 nativespace-cdp sshd[3160952]: Connection closed by 159.100.136.21 port 43728 [preauth]
Sep  7 05:46:44 nativespace-cdp sshd[3160973]: Bad protocol version identification '\003' from 91.238.181.35 port 65360
Sep  7 05:51:33 nativespace-cdp sshd[3161894]: Connection closed by 159.100.136.21 port 52912 [preauth]
Sep  7 05:56:35 nativespace-cdp sshd[3163018]: Connection closed by 159.100.136.21 port 33220 [preauth]
Sep  7 06:01:33 nativespace-cdp sshd[3164022]: Connection closed by 159.100.136.21 port 42456 [preauth]
Sep  7 06:06:33 nativespace-cdp sshd[3164961]: Connection closed by 159.100.136.21 port 51672 [preauth]
Sep  7 06:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 06:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:16 nativespace-cdp sudo[3165378]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 06:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:16 nativespace-cdp sudo[3165382]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 06:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:17 nativespace-cdp sudo[3165385]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 06:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:17 nativespace-cdp sudo[3165388]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 06:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:18 nativespace-cdp sudo[3165392]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 06:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:18 nativespace-cdp sudo[3165399]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 06:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:18 nativespace-cdp sudo[3165402]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 06:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:18 nativespace-cdp sudo[3165405]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 06:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:18 nativespace-cdp sudo[3165408]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 06:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:18 nativespace-cdp sudo[3165412]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 06:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:18 nativespace-cdp sudo[3165416]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 06:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:20 nativespace-cdp sudo[3165429]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 06:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:20 nativespace-cdp sudo[3165440]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=skyfirec user-2=alexadmin user-3=nativene user-4=stuartge user-5=askhform user-6=innovat1 user-7=battlere user-8=oneoarco user-9=firstre2 user-10=vivienn1 user-11=brighto1 user-12=nstriton user-13=bemadonn user-14=belle user-15=ggaaorgu user-16=newstoda user-17=bedfords user-18=carsinyo user-19=fetch user-20=putterfi user-21=hubmaster user-22=elecleis user-23=gilpin user-24=milloyco user-25=thqkgnbz user-26=connectedshoppin user-27=ianrayne user-28=accooper user-29=coursemc user-30=opaiscyx user-31=firstres user-32=jonhartl user-33=seftvta user-34=ultbcrra user-35=southlon user-36=highlegh user-37=firstred user-38=costestimatorco user-39=firstrel user-40=clarkass user-41=ptkxhsbt user-42=dickemery123 user-43=martsblo user-44=magichat user-45=lbhyisi user-46=hhdugcor user-47=sarafoundation
Sep  7 06:09:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=atestord user-49=strathar user-50=lakesan1 user-51=brmrjxl user-52=musorguk user-53=megacards user-54=wilsonsw user-55=theblack user-56=hodgesonweb user-57=spectrum user-58=jarvisin user-59=leereyn1 user-60=stephani user-61=still user-62=agproduc user-63=maflemin user-64=lbscrmod user-65=athenare user-66=connect9 user-67=vantagep user-68=foundation user-69=markward user-70=booff user-71=ulsukarm user-72=nvihkvu user-73=cath user-74=sketchy user-75=havantho user-76=what user-77=tstardom user-78=oubpgvbx user-79=design user-80=kategilpin user-81=ladburyp user-82=dancinggardener user-83=stagingerris user-84=boldover user-85=nove user-86=sosevalu user-87=crrtipdl user-88=bakery user-89=onlycont user-90=attlebor user-91=lucy user-92=romaldki user-93=branko user-94=outdoorc user-95=ranxterc user-96=hodgsonmail user-97=jennimil user-98=tomandle user-99=careers user-100=nbhavers user-101=david user-102=mcdermos
Sep  7 06:09:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=chrisdal user-104=pugwash user-105=howardon user-106=paulmca1 user-107=cwsocial user-108=ninejimm user-109=reliable user-110=cathski user-111=cambria1 user-112=courseme user-113=eugincou user-114=hirefootballgame user-115=philmcph user-116=ctedorgu user-117=firstre5 user-118=steakbridieme user-119=donnychicago user-120=lkpier user-121=health2045 user-122=fortunaz user-123=leftie user-124=foods user-125=putterfc user-126=nscdp user-127=tigerlet user-128=barbersh user-129=hidden user-130=nomistakes user-131=smrszyqg user-132=isleofwi user-133=nsceres user-134=burydropin user-135=fawcettd user-136=dhyana user-137=eatspam user-138=darkstar user-139=beauty user-140=sibtoncc user-141=asandcoc user-142=steve user-143=zebrapho user-144=bwppodcast feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 06:09:20 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 06:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:21 nativespace-cdp sudo[3165449]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:21 nativespace-cdp sudo[3165484]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5LuKrhKN5iB9oFNB.~
Sep  7 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:21 nativespace-cdp sudo[3165487]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5LuKrhKN5iB9oFNB.~'
Sep  7 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:21 nativespace-cdp sudo[3165492]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5LuKrhKN5iB9oFNB.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:21 nativespace-cdp sudo[3165499]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:21 nativespace-cdp sudo[3165502]: pam_unix(sudo:session): session closed for user root
Sep  7 06:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 06:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 06:09:22 nativespace-cdp sudo[3165563]: pam_unix(sudo:session): session closed for user root
Sep  7 06:11:33 nativespace-cdp sshd[3166265]: Connection closed by 159.100.136.21 port 32824 [preauth]
Sep  7 06:16:36 nativespace-cdp sshd[3167306]: Connection closed by 159.100.136.21 port 42182 [preauth]
Sep  7 06:21:34 nativespace-cdp sshd[3168253]: Connection closed by 159.100.136.21 port 51414 [preauth]
Sep  7 06:31:33 nativespace-cdp sshd[3170402]: Connection closed by 159.100.136.21 port 41736 [preauth]
Sep  7 06:36:33 nativespace-cdp sshd[3171483]: Connection closed by 159.100.136.21 port 50696 [preauth]
Sep  7 06:41:34 nativespace-cdp sshd[3172629]: Connection closed by 159.100.136.21 port 59936 [preauth]
Sep  7 06:46:33 nativespace-cdp sshd[3173732]: Connection closed by 159.100.136.21 port 41290 [preauth]
Sep  7 06:51:35 nativespace-cdp sshd[3174791]: Connection closed by 159.100.136.21 port 49850 [preauth]
Sep  7 06:56:33 nativespace-cdp sshd[3175846]: Connection closed by 159.100.136.21 port 58842 [preauth]
Sep  7 07:01:33 nativespace-cdp sshd[3176859]: Connection closed by 159.100.136.21 port 39812 [preauth]
Sep  7 07:06:33 nativespace-cdp sshd[3177783]: Connection closed by 159.100.136.21 port 48852 [preauth]
Sep  7 07:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 07:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:17 nativespace-cdp sudo[3178195]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 07:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:17 nativespace-cdp sudo[3178199]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 07:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:17 nativespace-cdp sudo[3178202]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 07:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:18 nativespace-cdp sudo[3178205]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 07:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:19 nativespace-cdp sudo[3178208]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 07:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:19 nativespace-cdp sudo[3178217]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 07:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:19 nativespace-cdp sudo[3178220]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 07:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:19 nativespace-cdp sudo[3178223]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 07:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:19 nativespace-cdp sudo[3178227]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 07:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:19 nativespace-cdp sudo[3178230]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 07:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:19 nativespace-cdp sudo[3178233]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 07:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:21 nativespace-cdp sudo[3178244]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 07:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:21 nativespace-cdp sudo[3178248]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=steve user-2=bwppodcast user-3=zebrapho user-4=sibtoncc user-5=asandcoc user-6=dhyana user-7=beauty user-8=darkstar user-9=eatspam user-10=nsceres user-11=fawcettd user-12=burydropin user-13=nomistakes user-14=hidden user-15=tigerlet user-16=barbersh user-17=smrszyqg user-18=isleofwi user-19=lkpier user-20=firstre5 user-21=steakbridieme user-22=donnychicago user-23=philmcph user-24=ctedorgu user-25=nscdp user-26=putterfc user-27=leftie user-28=foods user-29=fortunaz user-30=health2045 user-31=eugincou user-32=courseme user-33=hirefootballgame user-34=cwsocial user-35=paulmca1 user-36=howardon user-37=pugwash user-38=cambria1 user-39=cathski user-40=ninejimm user-41=reliable user-42=david user-43=careers user-44=nbhavers user-45=chrisdal user-46=mcdermos user-47=jennimil user-48=tomandle
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=outdoorc user-51=ranxterc user-52=hodgsonmail user-53=branko user-54=onlycont user-55=lucy user-56=attlebor user-57=bakery user-58=crrtipdl user-59=sosevalu user-60=boldover user-61=nove user-62=design user-63=dancinggardener user-64=stagingerris user-65=ladburyp user-66=kategilpin user-67=havantho user-68=cath user-69=sketchy user-70=nvihkvu user-71=oubpgvbx user-72=tstardom user-73=what user-74=ulsukarm user-75=vantagep user-76=connect9 user-77=athenare user-78=lbscrmod user-79=maflemin user-80=foundation user-81=markward user-82=booff user-83=stephani user-84=leereyn1 user-85=agproduc user-86=still user-87=spectrum user-88=hodgesonweb user-89=theblack user-90=jarvisin user-91=megacards user-92=musorguk user-93=wilsonsw user-94=strathar user-95=atestord user-96=sarafoundation user-97=lakesan1 user-98=brmrjxl user-99=magichat user-100=hhdugcor user-101=lbhyisi user-102=dickemery123
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ptkxhsbt user-104=martsblo user-105=firstred user-106=highlegh user-107=southlon user-108=clarkass user-109=firstrel user-110=costestimatorco user-111=opaiscyx user-112=coursemc user-113=ultbcrra user-114=seftvta user-115=jonhartl user-116=firstres user-117=connectedshoppin user-118=thqkgnbz user-119=accooper user-120=ianrayne user-121=hubmaster user-122=putterfi user-123=fetch user-124=carsinyo user-125=gilpin user-126=milloyco user-127=elecleis user-128=newstoda user-129=belle user-130=ggaaorgu user-131=bemadonn user-132=bedfords user-133=vivienn1 user-134=firstre2 user-135=oneoarco user-136=battlere user-137=nstriton user-138=brighto1 user-139=nativene user-140=innovat1 user-141=askhform user-142=stuartge user-143=skyfirec user-144=alexadmin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 07:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:21 nativespace-cdp sudo[3178253]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 07:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:21 nativespace-cdp sudo[3178259]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-N6tdgoT6eARAEOAu.~
Sep  7 07:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:21 nativespace-cdp sudo[3178262]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-N6tdgoT6eARAEOAu.~'
Sep  7 07:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:21 nativespace-cdp sudo[3178265]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-N6tdgoT6eARAEOAu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 07:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:21 nativespace-cdp sudo[3178269]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 07:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:21 nativespace-cdp sudo[3178272]: pam_unix(sudo:session): session closed for user root
Sep  7 07:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 07:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 07:09:23 nativespace-cdp sudo[3178291]: pam_unix(sudo:session): session closed for user root
Sep  7 07:11:33 nativespace-cdp sshd[3179080]: Connection closed by 159.100.136.21 port 57262 [preauth]
Sep  7 07:16:36 nativespace-cdp sshd[3180079]: Connection closed by 159.100.136.21 port 38314 [preauth]
Sep  7 07:21:33 nativespace-cdp sshd[3181048]: Connection closed by 159.100.136.21 port 47250 [preauth]
Sep  7 07:26:33 nativespace-cdp sshd[3182231]: Connection closed by 159.100.136.21 port 57216 [preauth]
Sep  7 07:31:33 nativespace-cdp sshd[3183274]: Connection closed by 159.100.136.21 port 38798 [preauth]
Sep  7 07:36:33 nativespace-cdp sshd[3184231]: Connection closed by 159.100.136.21 port 48766 [preauth]
Sep  7 07:41:33 nativespace-cdp sshd[3185416]: Connection closed by 159.100.136.21 port 58074 [preauth]
Sep  7 07:46:33 nativespace-cdp sshd[3186423]: Connection closed by 159.100.136.21 port 39296 [preauth]
Sep  7 07:51:34 nativespace-cdp sshd[3187989]: Connection closed by 159.100.136.21 port 47408 [preauth]
Sep  7 07:56:36 nativespace-cdp sshd[3189183]: Connection closed by 159.100.136.21 port 56032 [preauth]
Sep  7 08:01:33 nativespace-cdp sshd[3190344]: Connection closed by 159.100.136.21 port 36966 [preauth]
Sep  7 08:06:33 nativespace-cdp sshd[3191389]: Connection closed by 159.100.136.21 port 44978 [preauth]
Sep  7 08:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 08:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:17 nativespace-cdp sudo[3191872]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 08:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:17 nativespace-cdp sudo[3191875]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 08:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:17 nativespace-cdp sudo[3191878]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 08:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:17 nativespace-cdp sudo[3191882]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 08:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:20 nativespace-cdp sudo[3191886]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 08:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:20 nativespace-cdp sudo[3191895]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 08:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:20 nativespace-cdp sudo[3191898]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 08:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:20 nativespace-cdp sudo[3191901]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 08:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:20 nativespace-cdp sudo[3191904]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 08:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:20 nativespace-cdp sudo[3191908]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 08:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:20 nativespace-cdp sudo[3191911]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 08:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:27 nativespace-cdp sudo[3191933]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 08:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:27 nativespace-cdp sudo[3191938]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=milloyco user-2=gilpin user-3=elecleis user-4=hubmaster user-5=putterfi user-6=fetch user-7=carsinyo user-8=accooper user-9=ianrayne user-10=connectedshoppin user-11=thqkgnbz user-12=ultbcrra user-13=jonhartl user-14=seftvta user-15=firstres user-16=opaiscyx user-17=coursemc user-18=firstrel user-19=clarkass user-20=costestimatorco user-21=firstred user-22=highlegh user-23=southlon user-24=skyfirec user-25=alexadmin user-26=innovat1 user-27=stuartge user-28=askhform user-29=nativene user-30=nstriton user-31=brighto1 user-32=vivienn1 user-33=firstre2 user-34=oneoarco user-35=battlere user-36=bedfords user-37=newstoda user-38=ggaaorgu user-39=belle user-40=bemadonn user-41=jarvisin user-42=spectrum user-43=hodgesonweb user-44=theblack user-45=agproduc user-46=still user-47=stephani
Sep  7 08:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=leereyn1 user-49=markward user-50=foundation user-51=booff user-52=vantagep user-53=connect9 user-54=athenare user-55=lbscrmod user-56=maflemin user-57=ulsukarm user-58=martsblo user-59=dickemery123 user-60=ptkxhsbt user-61=hhdugcor user-62=lbhyisi user-63=magichat user-64=lakesan1 user-65=brmrjxl user-66=strathar user-67=atestord user-68=sarafoundation user-69=wilsonsw user-70=megacards user-71=musorguk user-72=lucy user-73=attlebor user-74=onlycont user-75=outdoorc user-76=ranxterc user-77=hodgsonmail user-78=branko user-79=romaldki user-80=tomandle user-81=jennimil user-82=chrisdal user-83=mcdermos user-84=david user-85=nbhavers user-86=careers user-87=tstardom user-88=oubpgvbx user-89=what user-90=havantho user-91=sketchy user-92=cath user-93=nvihkvu user-94=stagingerris user-95=dancinggardener user-96=ladburyp user-97=kategilpin user-98=design user-99=nove user-100=boldover user-101=bakery
Sep  7 08:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=crrtipdl user-103=sosevalu user-104=fawcettd user-105=burydropin user-106=nsceres user-107=beauty user-108=darkstar user-109=eatspam user-110=dhyana user-111=sibtoncc user-112=asandcoc user-113=bwppodcast user-114=zebrapho user-115=steve user-116=cathski user-117=cambria1 user-118=reliable user-119=ninejimm user-120=cwsocial user-121=howardon user-122=paulmca1 user-123=pugwash user-124=hirefootballgame user-125=eugincou user-126=courseme user-127=nscdp user-128=putterfc user-129=leftie user-130=foods user-131=fortunaz user-132=health2045 user-133=lkpier user-134=firstre5 user-135=donnychicago user-136=steakbridieme user-137=ctedorgu user-138=philmcph user-139=isleofwi user-140=smrszyqg user-141=nomistakes user-142=hidden user-143=barbersh user-144=tigerlet feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  7 08:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 08:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:28 nativespace-cdp sudo[3191943]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:28 nativespace-cdp sudo[3191949]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F7OE7pJvFAJRCkfZ.~
Sep  7 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:28 nativespace-cdp sudo[3191953]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F7OE7pJvFAJRCkfZ.~'
Sep  7 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:28 nativespace-cdp sudo[3191956]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F7OE7pJvFAJRCkfZ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:28 nativespace-cdp sudo[3191960]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:28 nativespace-cdp sudo[3191963]: pam_unix(sudo:session): session closed for user root
Sep  7 08:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 08:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 08:09:30 nativespace-cdp sudo[3191985]: pam_unix(sudo:session): session closed for user root
Sep  7 08:11:33 nativespace-cdp sshd[3192734]: Connection closed by 159.100.136.21 port 54408 [preauth]
Sep  7 08:16:33 nativespace-cdp sshd[3194052]: Connection closed by 159.100.136.21 port 35284 [preauth]
Sep  7 08:21:33 nativespace-cdp sshd[3195238]: Connection closed by 159.100.136.21 port 44490 [preauth]
Sep  7 08:26:33 nativespace-cdp sshd[3196515]: Connection closed by 159.100.136.21 port 54258 [preauth]
Sep  7 08:36:34 nativespace-cdp sshd[3198719]: Connection closed by 159.100.136.21 port 45206 [preauth]
Sep  7 08:41:36 nativespace-cdp sshd[3199918]: Connection closed by 159.100.136.21 port 53006 [preauth]
Sep  7 08:46:33 nativespace-cdp sshd[3200997]: Connection closed by 159.100.136.21 port 33644 [preauth]
Sep  7 08:51:36 nativespace-cdp sshd[3201986]: Connection closed by 159.100.136.21 port 42938 [preauth]
Sep  7 08:56:33 nativespace-cdp sshd[3203043]: Connection closed by 159.100.136.21 port 52370 [preauth]
Sep  7 09:01:33 nativespace-cdp sshd[3204358]: Connection closed by 159.100.136.21 port 33280 [preauth]
Sep  7 09:06:35 nativespace-cdp sshd[3205510]: Connection closed by 159.100.136.21 port 43250 [preauth]
Sep  7 09:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 09:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:24 nativespace-cdp sudo[3206001]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 09:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:24 nativespace-cdp sudo[3206005]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 09:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:26 nativespace-cdp sudo[3206010]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 09:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:26 nativespace-cdp sudo[3206017]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 09:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:30 nativespace-cdp sudo[3206024]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 09:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:30 nativespace-cdp sudo[3206044]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 09:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:30 nativespace-cdp sudo[3206050]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 09:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:30 nativespace-cdp sudo[3206054]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 09:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:30 nativespace-cdp sudo[3206059]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 09:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:30 nativespace-cdp sudo[3206065]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 09:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:30 nativespace-cdp sudo[3206070]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 09:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:32 nativespace-cdp sudo[3206080]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 09:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:33 nativespace-cdp sudo[3206087]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hidden user-2=nomistakes user-3=barbersh user-4=tigerlet user-5=smrszyqg user-6=isleofwi user-7=lkpier user-8=ctedorgu user-9=philmcph user-10=steakbridieme user-11=firstre5 user-12=donnychicago user-13=putterfc user-14=nscdp user-15=health2045 user-16=fortunaz user-17=foods user-18=leftie user-19=eugincou user-20=courseme user-21=hirefootballgame user-22=howardon user-23=pugwash user-24=paulmca1 user-25=cwsocial user-26=cathski user-27=cambria1 user-28=reliable user-29=ninejimm user-30=steve user-31=bwppodcast user-32=zebrapho user-33=sibtoncc user-34=asandcoc user-35=dhyana user-36=beauty user-37=eatspam user-38=darkstar user-39=nsceres user-40=burydropin user-41=fawcettd user-42=bakery user-43=sosevalu user-44=crrtipdl user-45=boldover user-46=nove user-47=design user-48=ladburyp
Sep  7 09:09:33 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=stagingerris user-50=dancinggardener user-51=kategilpin user-52=cath user-53=sketchy user-54=havantho user-55=nvihkvu user-56=tstardom user-57=oubpgvbx user-58=what user-59=nbhavers user-60=careers user-61=david user-62=chrisdal user-63=mcdermos user-64=jennimil user-65=tomandle user-66=romaldki user-67=hodgsonmail user-68=outdoorc user-69=ranxterc user-70=branko user-71=onlycont user-72=attlebor user-73=lucy user-74=musorguk user-75=megacards user-76=wilsonsw user-77=strathar user-78=sarafoundation user-79=atestord user-80=brmrjxl user-81=lakesan1 user-82=magichat user-83=lbhyisi user-84=hhdugcor user-85=dickemery123 user-86=ptkxhsbt user-87=martsblo user-88=ulsukarm user-89=athenare user-90=connect9 user-91=vantagep user-92=maflemin user-93=lbscrmod user-94=booff user-95=foundation user-96=markward user-97=stephani user-98=leereyn1 user-99=still user-100=agproduc user-101=spectrum user-102=theblack
Sep  7 09:09:33 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=hodgesonweb user-104=jarvisin user-105=ggaaorgu user-106=belle user-107=newstoda user-108=bemadonn user-109=bedfords user-110=firstre2 user-111=vivienn1 user-112=battlere user-113=oneoarco user-114=brighto1 user-115=nstriton user-116=nativene user-117=innovat1 user-118=askhform user-119=stuartge user-120=skyfirec user-121=alexadmin user-122=firstred user-123=southlon user-124=highlegh user-125=clarkass user-126=firstrel user-127=costestimatorco user-128=opaiscyx user-129=coursemc user-130=jonhartl user-131=seftvta user-132=ultbcrra user-133=firstres user-134=connectedshoppin user-135=thqkgnbz user-136=accooper user-137=ianrayne user-138=hubmaster user-139=putterfi user-140=carsinyo user-141=fetch user-142=milloyco user-143=gilpin user-144=elecleis feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 09:09:33 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 09:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:35 nativespace-cdp sudo[3206096]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 09:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:35 nativespace-cdp sudo[3206105]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Pse873aZdPRH6m28.~
Sep  7 09:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:35 nativespace-cdp sudo[3206110]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Pse873aZdPRH6m28.~'
Sep  7 09:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:35 nativespace-cdp sudo[3206114]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Pse873aZdPRH6m28.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 09:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:35 nativespace-cdp sudo[3206120]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 09:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:35 nativespace-cdp sudo[3206125]: pam_unix(sudo:session): session closed for user root
Sep  7 09:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 09:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 09:09:43 nativespace-cdp sudo[3206173]: pam_unix(sudo:session): session closed for user root
Sep  7 09:11:33 nativespace-cdp sshd[3206904]: Connection closed by 159.100.136.21 port 51642 [preauth]
Sep  7 09:16:33 nativespace-cdp sshd[3208198]: Connection closed by 159.100.136.21 port 33204 [preauth]
Sep  7 09:21:33 nativespace-cdp sshd[3209247]: Connection closed by 159.100.136.21 port 43156 [preauth]
Sep  7 09:26:33 nativespace-cdp sshd[3210482]: Connection closed by 159.100.136.21 port 52202 [preauth]
Sep  7 09:31:33 nativespace-cdp sshd[3211884]: Connection closed by 159.100.136.21 port 33412 [preauth]
Sep  7 09:36:36 nativespace-cdp sshd[3212961]: Connection closed by 159.100.136.21 port 43480 [preauth]
Sep  7 09:41:33 nativespace-cdp sshd[3214236]: Connection closed by 159.100.136.21 port 52772 [preauth]
Sep  7 09:46:35 nativespace-cdp sshd[3215308]: Connection closed by 159.100.136.21 port 33154 [preauth]
Sep  7 09:51:33 nativespace-cdp sshd[3216363]: Connection closed by 159.100.136.21 port 42276 [preauth]
Sep  7 09:56:33 nativespace-cdp sshd[3217702]: Connection closed by 159.100.136.21 port 51714 [preauth]
Sep  7 10:01:33 nativespace-cdp sshd[3218814]: Connection closed by 159.100.136.21 port 32782 [preauth]
Sep  7 10:02:34 nativespace-cdp sshd[3219009]: Invalid user ali from 103.130.212.167 port 48474
Sep  7 10:02:34 nativespace-cdp sshd[3219009]: input_userauth_request: invalid user ali [preauth]
Sep  7 10:02:34 nativespace-cdp sshd[3219009]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:02:34 nativespace-cdp sshd[3219009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.212.167
Sep  7 10:02:36 nativespace-cdp sshd[3219009]: Failed password for invalid user ali from 103.130.212.167 port 48474 ssh2
Sep  7 10:02:37 nativespace-cdp sshd[3219009]: Received disconnect from 103.130.212.167 port 48474:11: Bye Bye [preauth]
Sep  7 10:02:37 nativespace-cdp sshd[3219009]: Disconnected from 103.130.212.167 port 48474 [preauth]
Sep  7 10:04:50 nativespace-cdp sshd[3219416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.125.26.140  user=root
Sep  7 10:04:50 nativespace-cdp sshd[3219416]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:04:51 nativespace-cdp sshd[3219416]: Failed password for root from 186.125.26.140 port 40092 ssh2
Sep  7 10:04:56 nativespace-cdp sshd[3219416]: Received disconnect from 186.125.26.140 port 40092:11: Bye Bye [preauth]
Sep  7 10:04:56 nativespace-cdp sshd[3219416]: Disconnected from 186.125.26.140 port 40092 [preauth]
Sep  7 10:06:33 nativespace-cdp sshd[3219982]: Connection closed by 159.100.136.21 port 42762 [preauth]
Sep  7 10:06:57 nativespace-cdp sshd[3220042]: Invalid user student from 92.222.10.235 port 55324
Sep  7 10:06:57 nativespace-cdp sshd[3220042]: input_userauth_request: invalid user student [preauth]
Sep  7 10:06:57 nativespace-cdp sshd[3220042]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:06:57 nativespace-cdp sshd[3220042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.10.235
Sep  7 10:06:59 nativespace-cdp sshd[3220042]: Failed password for invalid user student from 92.222.10.235 port 55324 ssh2
Sep  7 10:07:00 nativespace-cdp sshd[3220042]: Received disconnect from 92.222.10.235 port 55324:11: Bye Bye [preauth]
Sep  7 10:07:00 nativespace-cdp sshd[3220042]: Disconnected from 92.222.10.235 port 55324 [preauth]
Sep  7 10:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 10:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:18 nativespace-cdp sudo[3220442]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 10:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:18 nativespace-cdp sudo[3220446]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 10:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:18 nativespace-cdp sudo[3220451]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 10:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:18 nativespace-cdp sudo[3220457]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 10:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:20 nativespace-cdp sudo[3220463]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 10:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:20 nativespace-cdp sudo[3220475]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 10:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:20 nativespace-cdp sudo[3220483]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 10:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:20 nativespace-cdp sudo[3220488]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 10:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:20 nativespace-cdp sudo[3220493]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 10:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:20 nativespace-cdp sudo[3220499]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 10:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:20 nativespace-cdp sudo[3220504]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 10:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:25 nativespace-cdp sudo[3220542]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 10:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:25 nativespace-cdp sudo[3220548]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nativene user-2=innovat1 user-3=stuartge user-4=askhform user-5=alexadmin user-6=skyfirec user-7=ggaaorgu user-8=belle user-9=newstoda user-10=bemadonn user-11=bedfords user-12=firstre2 user-13=vivienn1 user-14=battlere user-15=oneoarco user-16=brighto1 user-17=nstriton user-18=connectedshoppin user-19=thqkgnbz user-20=accooper user-21=ianrayne user-22=hubmaster user-23=putterfi user-24=carsinyo user-25=fetch user-26=gilpin user-27=milloyco user-28=elecleis user-29=firstred user-30=southlon user-31=highlegh user-32=clarkass user-33=firstrel user-34=costestimatorco user-35=opaiscyx user-36=coursemc user-37=jonhartl user-38=seftvta user-39=ultbcrra user-40=firstres user-41=magichat user-42=lbhyisi user-43=hhdugcor user-44=dickemery123 user-45=ptkxhsbt user-46=martsblo user-47=musorguk
Sep  7 10:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=wilsonsw user-50=strathar user-51=sarafoundation user-52=atestord user-53=lakesan1 user-54=brmrjxl user-55=stephani user-56=leereyn1 user-57=still user-58=agproduc user-59=spectrum user-60=hodgesonweb user-61=theblack user-62=jarvisin user-63=ulsukarm user-64=connect9 user-65=athenare user-66=vantagep user-67=maflemin user-68=lbscrmod user-69=booff user-70=foundation user-71=markward user-72=design user-73=ladburyp user-74=dancinggardener user-75=stagingerris user-76=kategilpin user-77=cath user-78=sketchy user-79=havantho user-80=nvihkvu user-81=oubpgvbx user-82=tstardom user-83=what user-84=bakery user-85=sosevalu user-86=crrtipdl user-87=boldover user-88=nove user-89=romaldki user-90=ranxterc user-91=outdoorc user-92=hodgsonmail user-93=branko user-94=onlycont user-95=attlebor user-96=lucy user-97=nbhavers user-98=careers user-99=david user-100=chrisdal user-101=mcdermos
Sep  7 10:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=jennimil user-103=tomandle user-104=eugincou user-105=courseme user-106=hirefootballgame user-107=howardon user-108=pugwash user-109=paulmca1 user-110=cwsocial user-111=cathski user-112=cambria1 user-113=ninejimm user-114=reliable user-115=hidden user-116=nomistakes user-117=tigerlet user-118=barbersh user-119=smrszyqg user-120=isleofwi user-121=lkpier user-122=ctedorgu user-123=philmcph user-124=donnychicago user-125=firstre5 user-126=steakbridieme user-127=putterfc user-128=nscdp user-129=health2045 user-130=fortunaz user-131=foods user-132=leftie user-133=dhyana user-134=beauty user-135=eatspam user-136=darkstar user-137=nsceres user-138=burydropin user-139=fawcettd user-140=steve user-141=bwppodcast user-142=zebrapho user-143=asandcoc user-144=sibtoncc feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  7 10:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 10:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:26 nativespace-cdp sudo[3220556]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:27 nativespace-cdp sudo[3220563]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-JncTR4loj4Iz1X02.~
Sep  7 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:27 nativespace-cdp sudo[3220569]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-JncTR4loj4Iz1X02.~'
Sep  7 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:27 nativespace-cdp sudo[3220573]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-JncTR4loj4Iz1X02.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:27 nativespace-cdp sudo[3220579]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:27 nativespace-cdp sudo[3220584]: pam_unix(sudo:session): session closed for user root
Sep  7 10:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 10:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 10:09:34 nativespace-cdp sudo[3220621]: pam_unix(sudo:session): session closed for user root
Sep  7 10:10:29 nativespace-cdp sshd[3221097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.125.26.140  user=root
Sep  7 10:10:29 nativespace-cdp sshd[3221097]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:10:29 nativespace-cdp sshd[3221101]: Invalid user dev from 92.222.10.235 port 57748
Sep  7 10:10:29 nativespace-cdp sshd[3221101]: input_userauth_request: invalid user dev [preauth]
Sep  7 10:10:29 nativespace-cdp sshd[3221101]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:10:29 nativespace-cdp sshd[3221101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.10.235
Sep  7 10:10:30 nativespace-cdp sshd[3221097]: Failed password for root from 186.125.26.140 port 56116 ssh2
Sep  7 10:10:31 nativespace-cdp sshd[3221101]: Failed password for invalid user dev from 92.222.10.235 port 57748 ssh2
Sep  7 10:10:38 nativespace-cdp sshd[3221101]: Received disconnect from 92.222.10.235 port 57748:11: Bye Bye [preauth]
Sep  7 10:10:38 nativespace-cdp sshd[3221101]: Disconnected from 92.222.10.235 port 57748 [preauth]
Sep  7 10:10:40 nativespace-cdp sshd[3221097]: Received disconnect from 186.125.26.140 port 56116:11: Bye Bye [preauth]
Sep  7 10:10:40 nativespace-cdp sshd[3221097]: Disconnected from 186.125.26.140 port 56116 [preauth]
Sep  7 10:11:10 nativespace-cdp sshd[3221343]: Connection closed by 103.130.212.167 port 47774 [preauth]
Sep  7 10:11:30 nativespace-cdp sshd[3221393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.125.26.140  user=root
Sep  7 10:11:30 nativespace-cdp sshd[3221393]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:11:32 nativespace-cdp sshd[3221393]: Failed password for root from 186.125.26.140 port 43262 ssh2
Sep  7 10:11:33 nativespace-cdp sshd[3221435]: Connection closed by 159.100.136.21 port 51902 [preauth]
Sep  7 10:12:00 nativespace-cdp sshd[3221496]: Invalid user console from 92.222.10.235 port 42518
Sep  7 10:12:00 nativespace-cdp sshd[3221496]: input_userauth_request: invalid user console [preauth]
Sep  7 10:12:00 nativespace-cdp sshd[3221496]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:12:00 nativespace-cdp sshd[3221496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.10.235
Sep  7 10:12:02 nativespace-cdp sshd[3221496]: Failed password for invalid user console from 92.222.10.235 port 42518 ssh2
Sep  7 10:12:25 nativespace-cdp sshd[3221581]: Invalid user machine from 103.130.212.167 port 38824
Sep  7 10:12:25 nativespace-cdp sshd[3221581]: input_userauth_request: invalid user machine [preauth]
Sep  7 10:12:25 nativespace-cdp sshd[3221581]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:12:25 nativespace-cdp sshd[3221581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.212.167
Sep  7 10:12:27 nativespace-cdp sshd[3221581]: Failed password for invalid user machine from 103.130.212.167 port 38824 ssh2
Sep  7 10:12:27 nativespace-cdp sshd[3221581]: Received disconnect from 103.130.212.167 port 38824:11: Bye Bye [preauth]
Sep  7 10:12:27 nativespace-cdp sshd[3221581]: Disconnected from 103.130.212.167 port 38824 [preauth]
Sep  7 10:13:21 nativespace-cdp sshd[3221722]: Invalid user cms from 103.130.212.167 port 51792
Sep  7 10:13:21 nativespace-cdp sshd[3221722]: input_userauth_request: invalid user cms [preauth]
Sep  7 10:13:21 nativespace-cdp sshd[3221722]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:13:21 nativespace-cdp sshd[3221722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.212.167
Sep  7 10:13:23 nativespace-cdp sshd[3221722]: Failed password for invalid user cms from 103.130.212.167 port 51792 ssh2
Sep  7 10:13:23 nativespace-cdp sshd[3221722]: Received disconnect from 103.130.212.167 port 51792:11: Bye Bye [preauth]
Sep  7 10:13:23 nativespace-cdp sshd[3221722]: Disconnected from 103.130.212.167 port 51792 [preauth]
Sep  7 10:14:03 nativespace-cdp sshd[3221904]: Invalid user neolinux from 82.196.3.179 port 34370
Sep  7 10:14:03 nativespace-cdp sshd[3221904]: input_userauth_request: invalid user neolinux [preauth]
Sep  7 10:14:03 nativespace-cdp sshd[3221904]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:14:03 nativespace-cdp sshd[3221904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.196.3.179
Sep  7 10:14:04 nativespace-cdp sshd[3221904]: Failed password for invalid user neolinux from 82.196.3.179 port 34370 ssh2
Sep  7 10:14:04 nativespace-cdp sshd[3221904]: Received disconnect from 82.196.3.179 port 34370:11: Bye Bye [preauth]
Sep  7 10:14:04 nativespace-cdp sshd[3221904]: Disconnected from 82.196.3.179 port 34370 [preauth]
Sep  7 10:15:58 nativespace-cdp sshd[3222457]: Invalid user ceshi from 144.217.13.134 port 42382
Sep  7 10:15:58 nativespace-cdp sshd[3222457]: input_userauth_request: invalid user ceshi [preauth]
Sep  7 10:15:58 nativespace-cdp sshd[3222457]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:15:58 nativespace-cdp sshd[3222457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.13.134
Sep  7 10:15:59 nativespace-cdp sshd[3222457]: Failed password for invalid user ceshi from 144.217.13.134 port 42382 ssh2
Sep  7 10:15:59 nativespace-cdp sshd[3222457]: Received disconnect from 144.217.13.134 port 42382:11: Bye Bye [preauth]
Sep  7 10:15:59 nativespace-cdp sshd[3222457]: Disconnected from 144.217.13.134 port 42382 [preauth]
Sep  7 10:16:08 nativespace-cdp sshd[3222497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.164.213.177  user=root
Sep  7 10:16:08 nativespace-cdp sshd[3222497]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:16:10 nativespace-cdp sshd[3222497]: Failed password for root from 110.164.213.177 port 43312 ssh2
Sep  7 10:16:10 nativespace-cdp sshd[3222497]: Received disconnect from 110.164.213.177 port 43312:11: Bye Bye [preauth]
Sep  7 10:16:10 nativespace-cdp sshd[3222497]: Disconnected from 110.164.213.177 port 43312 [preauth]
Sep  7 10:16:33 nativespace-cdp sshd[3222550]: Connection closed by 159.100.136.21 port 32950 [preauth]
Sep  7 10:17:43 nativespace-cdp sshd[3222746]: Invalid user lulu from 46.105.49.104 port 59392
Sep  7 10:17:43 nativespace-cdp sshd[3222746]: input_userauth_request: invalid user lulu [preauth]
Sep  7 10:17:43 nativespace-cdp sshd[3222746]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:17:43 nativespace-cdp sshd[3222746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.49.104
Sep  7 10:17:45 nativespace-cdp sshd[3222746]: Failed password for invalid user lulu from 46.105.49.104 port 59392 ssh2
Sep  7 10:17:45 nativespace-cdp sshd[3222746]: Received disconnect from 46.105.49.104 port 59392:11: Bye Bye [preauth]
Sep  7 10:17:45 nativespace-cdp sshd[3222746]: Disconnected from 46.105.49.104 port 59392 [preauth]
Sep  7 10:18:04 nativespace-cdp sshd[3222798]: Invalid user intelbras from 103.133.36.6 port 53190
Sep  7 10:18:04 nativespace-cdp sshd[3222798]: input_userauth_request: invalid user intelbras [preauth]
Sep  7 10:18:04 nativespace-cdp sshd[3222798]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:18:04 nativespace-cdp sshd[3222798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.36.6
Sep  7 10:18:06 nativespace-cdp sshd[3222798]: Failed password for invalid user intelbras from 103.133.36.6 port 53190 ssh2
Sep  7 10:18:06 nativespace-cdp sshd[3222798]: Received disconnect from 103.133.36.6 port 53190:11: Bye Bye [preauth]
Sep  7 10:18:06 nativespace-cdp sshd[3222798]: Disconnected from 103.133.36.6 port 53190 [preauth]
Sep  7 10:19:05 nativespace-cdp sshd[3222946]: Invalid user ugo from 98.113.203.148 port 33462
Sep  7 10:19:05 nativespace-cdp sshd[3222946]: input_userauth_request: invalid user ugo [preauth]
Sep  7 10:19:05 nativespace-cdp sshd[3222946]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:19:05 nativespace-cdp sshd[3222946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.113.203.148
Sep  7 10:19:07 nativespace-cdp sshd[3222946]: Failed password for invalid user ugo from 98.113.203.148 port 33462 ssh2
Sep  7 10:19:07 nativespace-cdp sshd[3222946]: Received disconnect from 98.113.203.148 port 33462:11: Bye Bye [preauth]
Sep  7 10:19:07 nativespace-cdp sshd[3222946]: Disconnected from 98.113.203.148 port 33462 [preauth]
Sep  7 10:21:35 nativespace-cdp sshd[3223569]: Connection closed by 159.100.136.21 port 42288 [preauth]
Sep  7 10:21:47 nativespace-cdp sshd[3223604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.113.203.148  user=root
Sep  7 10:21:47 nativespace-cdp sshd[3223604]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:21:47 nativespace-cdp sshd[3223616]: Invalid user desarrollo from 82.196.3.179 port 34794
Sep  7 10:21:47 nativespace-cdp sshd[3223616]: input_userauth_request: invalid user desarrollo [preauth]
Sep  7 10:21:47 nativespace-cdp sshd[3223616]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:21:47 nativespace-cdp sshd[3223616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.196.3.179
Sep  7 10:21:48 nativespace-cdp sshd[3223604]: Failed password for root from 98.113.203.148 port 46832 ssh2
Sep  7 10:21:48 nativespace-cdp sshd[3223604]: Received disconnect from 98.113.203.148 port 46832:11: Bye Bye [preauth]
Sep  7 10:21:48 nativespace-cdp sshd[3223604]: Disconnected from 98.113.203.148 port 46832 [preauth]
Sep  7 10:21:49 nativespace-cdp sshd[3223616]: Failed password for invalid user desarrollo from 82.196.3.179 port 34794 ssh2
Sep  7 10:21:49 nativespace-cdp sshd[3223616]: Received disconnect from 82.196.3.179 port 34794:11: Bye Bye [preauth]
Sep  7 10:21:49 nativespace-cdp sshd[3223616]: Disconnected from 82.196.3.179 port 34794 [preauth]
Sep  7 10:22:07 nativespace-cdp sshd[3223663]: Invalid user tableau from 110.164.213.177 port 59740
Sep  7 10:22:07 nativespace-cdp sshd[3223663]: input_userauth_request: invalid user tableau [preauth]
Sep  7 10:22:07 nativespace-cdp sshd[3223663]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:22:07 nativespace-cdp sshd[3223663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.164.213.177
Sep  7 10:22:10 nativespace-cdp sshd[3223663]: Failed password for invalid user tableau from 110.164.213.177 port 59740 ssh2
Sep  7 10:22:10 nativespace-cdp sshd[3223663]: Received disconnect from 110.164.213.177 port 59740:11: Bye Bye [preauth]
Sep  7 10:22:10 nativespace-cdp sshd[3223663]: Disconnected from 110.164.213.177 port 59740 [preauth]
Sep  7 10:22:16 nativespace-cdp sshd[3223696]: Invalid user yangfan from 46.105.49.104 port 60940
Sep  7 10:22:16 nativespace-cdp sshd[3223696]: input_userauth_request: invalid user yangfan [preauth]
Sep  7 10:22:16 nativespace-cdp sshd[3223696]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:22:16 nativespace-cdp sshd[3223696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.49.104
Sep  7 10:22:18 nativespace-cdp sshd[3223696]: Failed password for invalid user yangfan from 46.105.49.104 port 60940 ssh2
Sep  7 10:22:18 nativespace-cdp sshd[3223696]: Received disconnect from 46.105.49.104 port 60940:11: Bye Bye [preauth]
Sep  7 10:22:18 nativespace-cdp sshd[3223696]: Disconnected from 46.105.49.104 port 60940 [preauth]
Sep  7 10:22:24 nativespace-cdp sshd[3223709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.36.6  user=root
Sep  7 10:22:24 nativespace-cdp sshd[3223709]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:22:26 nativespace-cdp sshd[3223709]: Failed password for root from 103.133.36.6 port 34766 ssh2
Sep  7 10:22:28 nativespace-cdp sshd[3223709]: Received disconnect from 103.133.36.6 port 34766:11: Bye Bye [preauth]
Sep  7 10:22:28 nativespace-cdp sshd[3223709]: Disconnected from 103.133.36.6 port 34766 [preauth]
Sep  7 10:22:28 nativespace-cdp sshd[3223721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.13.134  user=root
Sep  7 10:22:28 nativespace-cdp sshd[3223721]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:22:29 nativespace-cdp sshd[3223723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.196.3.179  user=root
Sep  7 10:22:29 nativespace-cdp sshd[3223723]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:22:30 nativespace-cdp sshd[3223721]: Failed password for root from 144.217.13.134 port 55250 ssh2
Sep  7 10:22:30 nativespace-cdp sshd[3223721]: Received disconnect from 144.217.13.134 port 55250:11: Bye Bye [preauth]
Sep  7 10:22:30 nativespace-cdp sshd[3223721]: Disconnected from 144.217.13.134 port 55250 [preauth]
Sep  7 10:22:31 nativespace-cdp sshd[3223723]: Failed password for root from 82.196.3.179 port 47648 ssh2
Sep  7 10:22:31 nativespace-cdp sshd[3223723]: Received disconnect from 82.196.3.179 port 47648:11: Bye Bye [preauth]
Sep  7 10:22:31 nativespace-cdp sshd[3223723]: Disconnected from 82.196.3.179 port 47648 [preauth]
Sep  7 10:23:00 nativespace-cdp sshd[3223842]: Invalid user ligang from 144.217.13.134 port 41942
Sep  7 10:23:00 nativespace-cdp sshd[3223842]: input_userauth_request: invalid user ligang [preauth]
Sep  7 10:23:00 nativespace-cdp sshd[3223842]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:23:00 nativespace-cdp sshd[3223842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.13.134
Sep  7 10:23:01 nativespace-cdp sshd[3223842]: Failed password for invalid user ligang from 144.217.13.134 port 41942 ssh2
Sep  7 10:23:01 nativespace-cdp sshd[3223842]: Received disconnect from 144.217.13.134 port 41942:11: Bye Bye [preauth]
Sep  7 10:23:01 nativespace-cdp sshd[3223842]: Disconnected from 144.217.13.134 port 41942 [preauth]
Sep  7 10:23:12 nativespace-cdp sshd[3223900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.36.6  user=root
Sep  7 10:23:12 nativespace-cdp sshd[3223900]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:23:14 nativespace-cdp sshd[3223900]: Failed password for root from 103.133.36.6 port 38144 ssh2
Sep  7 10:23:17 nativespace-cdp sshd[3223900]: Received disconnect from 103.133.36.6 port 38144:11: Bye Bye [preauth]
Sep  7 10:23:17 nativespace-cdp sshd[3223900]: Disconnected from 103.133.36.6 port 38144 [preauth]
Sep  7 10:23:20 nativespace-cdp sshd[3223954]: Invalid user sftpuser from 98.113.203.148 port 59704
Sep  7 10:23:20 nativespace-cdp sshd[3223954]: input_userauth_request: invalid user sftpuser [preauth]
Sep  7 10:23:20 nativespace-cdp sshd[3223954]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 10:23:20 nativespace-cdp sshd[3223954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.113.203.148
Sep  7 10:23:22 nativespace-cdp sshd[3223954]: Failed password for invalid user sftpuser from 98.113.203.148 port 59704 ssh2
Sep  7 10:23:22 nativespace-cdp sshd[3223954]: Received disconnect from 98.113.203.148 port 59704:11: Bye Bye [preauth]
Sep  7 10:23:22 nativespace-cdp sshd[3223954]: Disconnected from 98.113.203.148 port 59704 [preauth]
Sep  7 10:23:51 nativespace-cdp sshd[3224122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.49.104  user=root
Sep  7 10:23:51 nativespace-cdp sshd[3224122]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:23:54 nativespace-cdp sshd[3224122]: Failed password for root from 46.105.49.104 port 38518 ssh2
Sep  7 10:24:11 nativespace-cdp sshd[3224213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.164.213.177  user=root
Sep  7 10:24:11 nativespace-cdp sshd[3224213]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 10:24:13 nativespace-cdp sshd[3224213]: Failed password for root from 110.164.213.177 port 44788 ssh2
Sep  7 10:24:17 nativespace-cdp sshd[3224213]: Received disconnect from 110.164.213.177 port 44788:11: Bye Bye [preauth]
Sep  7 10:24:17 nativespace-cdp sshd[3224213]: Disconnected from 110.164.213.177 port 44788 [preauth]
Sep  7 10:26:33 nativespace-cdp sshd[3225081]: Connection closed by 159.100.136.21 port 51832 [preauth]
Sep  7 10:31:33 nativespace-cdp sshd[3226483]: Connection closed by 159.100.136.21 port 60920 [preauth]
Sep  7 10:36:33 nativespace-cdp sshd[3227614]: Connection closed by 159.100.136.21 port 42450 [preauth]
Sep  7 10:41:33 nativespace-cdp sshd[3228906]: Connection closed by 159.100.136.21 port 51600 [preauth]
Sep  7 10:46:33 nativespace-cdp sshd[3231023]: Connection closed by 159.100.136.21 port 59888 [preauth]
Sep  7 10:51:33 nativespace-cdp sshd[3232302]: Connection closed by 159.100.136.21 port 40982 [preauth]
Sep  7 10:56:36 nativespace-cdp sshd[3233604]: Connection closed by 159.100.136.21 port 50744 [preauth]
Sep  7 11:01:33 nativespace-cdp sshd[3234829]: Connection closed by 159.100.136.21 port 59614 [preauth]
Sep  7 11:06:33 nativespace-cdp sshd[3235995]: Connection closed by 159.100.136.21 port 40398 [preauth]
Sep  7 11:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 11:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:17 nativespace-cdp sudo[3236483]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 11:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:17 nativespace-cdp sudo[3236486]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 11:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:18 nativespace-cdp sudo[3236489]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 11:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:18 nativespace-cdp sudo[3236493]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 11:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:25 nativespace-cdp sudo[3236496]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:25 nativespace-cdp sudo[3236535]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:25 nativespace-cdp sudo[3236538]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:25 nativespace-cdp sudo[3236541]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:25 nativespace-cdp sudo[3236544]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:25 nativespace-cdp sudo[3236547]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:25 nativespace-cdp sudo[3236551]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 11:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:27 nativespace-cdp sudo[3236562]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 11:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:27 nativespace-cdp sudo[3236569]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nsceres user-2=burydropin user-3=fawcettd user-4=dhyana user-5=beauty user-6=eatspam user-7=darkstar user-8=sibtoncc user-9=asandcoc user-10=steve user-11=bwppodcast user-12=zebrapho user-13=paulmca1 user-14=howardon user-15=pugwash user-16=cwsocial user-17=cathski user-18=cambria1 user-19=ninejimm user-20=reliable user-21=eugincou user-22=courseme user-23=hirefootballgame user-24=lkpier user-25=ctedorgu user-26=philmcph user-27=steakbridieme user-28=firstre5 user-29=donnychicago user-30=putterfc user-31=nscdp user-32=fortunaz user-33=health2045 user-34=leftie user-35=foods user-36=hidden user-37=nomistakes user-38=tigerlet user-39=barbersh user-40=smrszyqg user-41=isleofwi user-42=onlycont user-43=attlebor user-44=lucy user-45=romaldki user-46=hodgsonmail user-47=outdoorc user-48=ranxterc
Sep  7 11:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=branko user-50=jennimil user-51=tomandle user-52=careers user-53=nbhavers user-54=david user-55=chrisdal user-56=mcdermos user-57=cath user-58=sketchy user-59=havantho user-60=nvihkvu user-61=tstardom user-62=oubpgvbx user-63=what user-64=design user-65=ladburyp user-66=stagingerris user-67=dancinggardener user-68=kategilpin user-69=boldover user-70=nove user-71=bakery user-72=sosevalu user-73=crrtipdl user-74=spectrum user-75=theblack user-76=hodgesonweb user-77=jarvisin user-78=stephani user-79=leereyn1 user-80=still user-81=agproduc user-82=athenare user-83=connect9 user-84=vantagep user-85=maflemin user-86=lbscrmod user-87=foundation user-88=booff user-89=markward user-90=ulsukarm user-91=dickemery123 user-92=ptkxhsbt user-93=martsblo user-94=magichat user-95=lbhyisi user-96=hhdugcor user-97=strathar user-98=sarafoundation user-99=atestord user-100=lakesan1 user-101=brmrjxl user-102=musorguk
Sep  7 11:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=megacards user-104=wilsonsw user-105=putterfi user-106=hubmaster user-107=carsinyo user-108=fetch user-109=milloyco user-110=gilpin user-111=elecleis user-112=connectedshoppin user-113=thqkgnbz user-114=accooper user-115=ianrayne user-116=opaiscyx user-117=coursemc user-118=jonhartl user-119=seftvta user-120=ultbcrra user-121=firstres user-122=firstred user-123=southlon user-124=highlegh user-125=firstrel user-126=clarkass user-127=costestimatorco user-128=skyfirec user-129=alexadmin user-130=nativene user-131=innovat1 user-132=askhform user-133=stuartge user-134=firstre2 user-135=vivienn1 user-136=battlere user-137=oneoarco user-138=brighto1 user-139=nstriton user-140=ggaaorgu user-141=belle user-142=newstoda user-143=bemadonn user-144=bedfords feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 11:09:27 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 11:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:28 nativespace-cdp sudo[3236575]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  7 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:30 nativespace-cdp sudo[3236595]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep  7 11:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  7 11:09:30 nativespace-cdp sudo[3236601]: pam_unix(sudo:session): session closed for user onlycont
Sep  7 11:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  7 11:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:31 nativespace-cdp sudo[3236614]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  7 11:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 11:09:31 nativespace-cdp sudo[3236619]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  7 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:33 nativespace-cdp sudo[3236643]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep  7 11:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  7 11:09:33 nativespace-cdp sudo[3236649]: pam_unix(sudo:session): session closed for user lkpier
Sep  7 11:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  7 11:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:34 nativespace-cdp sudo[3236662]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep  7 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  7 11:09:34 nativespace-cdp sudo[3236668]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  7 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  7 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  7 11:09:34 nativespace-cdp sudo[3236682]: pam_unix(sudo:session): session closed for user oneoarco
Sep  7 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  7 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:35 nativespace-cdp sudo[3236695]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep  7 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  7 11:09:35 nativespace-cdp sudo[3236702]: pam_unix(sudo:session): session closed for user fortunaz
Sep  7 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep  7 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:35 nativespace-cdp sudo[3236715]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:35 nativespace-cdp sudo[3236719]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep  7 11:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:53 nativespace-cdp sudo[3237680]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep  7 11:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:53 nativespace-cdp sudo[3237687]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:54 nativespace-cdp sudo[3237698]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ORU5hVOZdT1FPz7L.~
Sep  7 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:54 nativespace-cdp sudo[3237704]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ORU5hVOZdT1FPz7L.~'
Sep  7 11:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:55 nativespace-cdp sudo[3237708]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ORU5hVOZdT1FPz7L.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 11:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:55 nativespace-cdp sudo[3237714]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 11:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:55 nativespace-cdp sudo[3237719]: pam_unix(sudo:session): session closed for user root
Sep  7 11:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 11:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 11:09:56 nativespace-cdp sudo[3237735]: pam_unix(sudo:session): session closed for user root
Sep  7 11:11:33 nativespace-cdp sshd[3238439]: Connection closed by 159.100.136.21 port 48716 [preauth]
Sep  7 11:16:33 nativespace-cdp sshd[3239522]: Connection closed by 159.100.136.21 port 58042 [preauth]
Sep  7 11:21:33 nativespace-cdp sshd[3240660]: Connection closed by 159.100.136.21 port 39088 [preauth]
Sep  7 11:26:36 nativespace-cdp sshd[3241841]: Connection closed by 159.100.136.21 port 48642 [preauth]
Sep  7 11:31:35 nativespace-cdp sshd[3242965]: Connection closed by 159.100.136.21 port 57486 [preauth]
Sep  7 11:36:40 nativespace-cdp sshd[3244054]: Connection closed by 159.100.136.21 port 38772 [preauth]
Sep  7 11:41:36 nativespace-cdp sshd[3245272]: Connection closed by 159.100.136.21 port 47382 [preauth]
Sep  7 11:46:33 nativespace-cdp sshd[3246320]: Connection closed by 159.100.136.21 port 55950 [preauth]
Sep  7 11:51:34 nativespace-cdp sshd[3247471]: Connection closed by 159.100.136.21 port 36890 [preauth]
Sep  7 11:56:33 nativespace-cdp sshd[3248794]: Connection closed by 159.100.136.21 port 46108 [preauth]
Sep  7 12:01:33 nativespace-cdp sshd[3249921]: Connection closed by 159.100.136.21 port 54778 [preauth]
Sep  7 12:06:33 nativespace-cdp sshd[3250999]: Connection closed by 159.100.136.21 port 34122 [preauth]
Sep  7 12:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 12:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:24 nativespace-cdp sudo[3251618]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 12:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:24 nativespace-cdp sudo[3251622]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 12:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:26 nativespace-cdp sudo[3251627]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 12:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:26 nativespace-cdp sudo[3251633]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 12:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:29 nativespace-cdp sudo[3251639]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 12:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:29 nativespace-cdp sudo[3251659]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 12:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:29 nativespace-cdp sudo[3251664]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 12:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:29 nativespace-cdp sudo[3251668]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 12:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:29 nativespace-cdp sudo[3251673]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 12:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:29 nativespace-cdp sudo[3251679]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 12:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:29 nativespace-cdp sudo[3251684]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 12:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:37 nativespace-cdp sudo[3251706]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 12:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:38 nativespace-cdp sudo[3251713]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=foods user-2=leftie user-3=fortunaz user-4=health2045 user-5=nscdp user-6=putterfc user-7=donnychicago user-8=firstre5 user-9=steakbridieme user-10=philmcph user-11=ctedorgu user-12=lkpier user-13=isleofwi user-14=smrszyqg user-15=barbersh user-16=tigerlet user-17=nomistakes user-18=hidden user-19=ninejimm user-20=reliable user-21=cambria1 user-22=cathski user-23=cwsocial user-24=howardon user-25=paulmca1 user-26=pugwash user-27=hirefootballgame user-28=courseme user-29=eugincou user-30=sibtoncc user-31=asandcoc user-32=zebrapho user-33=bwppodcast user-34=steve user-35=fawcettd user-36=burydropin user-37=nsceres user-38=darkstar user-39=eatspam user-40=beauty user-41=dhyana user-42=nove user-43=boldover user-44=crrtipdl user-45=sosevalu user-46=bakery user-47=what user-48=oubpgvbx
Sep  7 12:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=tstardom user-50=nvihkvu user-51=havantho user-52=sketchy user-53=cath user-54=kategilpin user-55=dancinggardener user-56=stagingerris user-57=ladburyp user-58=design user-59=tomandle user-60=jennimil user-61=mcdermos user-62=chrisdal user-63=david user-64=careers user-65=nbhavers user-66=lucy user-67=attlebor user-68=onlycont user-69=branko user-70=outdoorc user-71=hodgsonmail user-72=ranxterc user-73=romaldki user-74=lakesan1 user-75=brmrjxl user-76=atestord user-77=sarafoundation user-78=strathar user-79=wilsonsw user-80=megacards user-81=musorguk user-82=martsblo user-83=ptkxhsbt user-84=dickemery123 user-85=hhdugcor user-86=lbhyisi user-87=magichat user-88=foundation user-89=booff user-90=markward user-91=lbscrmod user-92=maflemin user-93=vantagep user-94=connect9 user-95=athenare user-96=ulsukarm user-97=jarvisin user-98=theblack user-99=hodgesonweb user-100=spectrum user-101=agproduc user-102=still
Sep  7 12:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=leereyn1 user-104=stephani user-105=nstriton user-106=brighto1 user-107=oneoarco user-108=battlere user-109=vivienn1 user-110=firstre2 user-111=bedfords user-112=bemadonn user-113=newstoda user-114=belle user-115=ggaaorgu user-116=alexadmin user-117=skyfirec user-118=askhform user-119=stuartge user-120=innovat1 user-121=nativene user-122=firstres user-123=ultbcrra user-124=seftvta user-125=jonhartl user-126=coursemc user-127=opaiscyx user-128=costestimatorco user-129=firstrel user-130=clarkass user-131=highlegh user-132=southlon user-133=firstred user-134=elecleis user-135=gilpin user-136=milloyco user-137=fetch user-138=carsinyo user-139=hubmaster user-140=putterfi user-141=ianrayne user-142=accooper user-143=thqkgnbz user-144=connectedshoppin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 12:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:39 nativespace-cdp sudo[3251721]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:40 nativespace-cdp sudo[3251730]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-x0i6rCNAqp5zqEKP.~
Sep  7 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:40 nativespace-cdp sudo[3251736]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-x0i6rCNAqp5zqEKP.~'
Sep  7 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:40 nativespace-cdp sudo[3251740]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-x0i6rCNAqp5zqEKP.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:40 nativespace-cdp sudo[3251746]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 12:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:40 nativespace-cdp sudo[3251751]: pam_unix(sudo:session): session closed for user root
Sep  7 12:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 12:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 12:09:41 nativespace-cdp sudo[3251777]: pam_unix(sudo:session): session closed for user root
Sep  7 12:11:33 nativespace-cdp sshd[3252469]: Connection closed by 159.100.136.21 port 41958 [preauth]
Sep  7 12:16:34 nativespace-cdp sshd[3253552]: Connection closed by 159.100.136.21 port 51366 [preauth]
Sep  7 12:21:33 nativespace-cdp sshd[3254622]: Connection closed by 159.100.136.21 port 60940 [preauth]
Sep  7 12:31:37 nativespace-cdp sshd[3257118]: Connection closed by 159.100.136.21 port 51472 [preauth]
Sep  7 12:36:36 nativespace-cdp sshd[3258182]: Connection closed by 159.100.136.21 port 60358 [preauth]
Sep  7 12:41:36 nativespace-cdp sshd[3259558]: Connection closed by 159.100.136.21 port 41700 [preauth]
Sep  7 12:46:36 nativespace-cdp sshd[3260610]: Connection closed by 159.100.136.21 port 51342 [preauth]
Sep  7 12:51:34 nativespace-cdp sshd[3262004]: Connection closed by 159.100.136.21 port 60878 [preauth]
Sep  7 12:56:33 nativespace-cdp sshd[3263412]: Connection closed by 159.100.136.21 port 42482 [preauth]
Sep  7 13:01:33 nativespace-cdp sshd[3264654]: Connection closed by 159.100.136.21 port 51978 [preauth]
Sep  7 13:06:44 nativespace-cdp sshd[3265889]: Did not receive identification string from 159.100.136.21 port 33690
Sep  7 13:07:19 nativespace-cdp sshd[3266339]: Invalid user rtorrent from 89.46.223.35 port 32980
Sep  7 13:07:19 nativespace-cdp sshd[3266339]: input_userauth_request: invalid user rtorrent [preauth]
Sep  7 13:07:20 nativespace-cdp sshd[3266339]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:07:20 nativespace-cdp sshd[3266339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.46.223.35
Sep  7 13:07:22 nativespace-cdp sshd[3266339]: Failed password for invalid user rtorrent from 89.46.223.35 port 32980 ssh2
Sep  7 13:07:22 nativespace-cdp sshd[3266339]: Received disconnect from 89.46.223.35 port 32980:11: Bye Bye [preauth]
Sep  7 13:07:22 nativespace-cdp sshd[3266339]: Disconnected from 89.46.223.35 port 32980 [preauth]
Sep  7 13:08:31 nativespace-cdp sshd[3266760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.234.223  user=root
Sep  7 13:08:31 nativespace-cdp sshd[3266760]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 13:08:33 nativespace-cdp sshd[3266760]: Failed password for root from 68.183.234.223 port 49138 ssh2
Sep  7 13:08:37 nativespace-cdp sshd[3266760]: Received disconnect from 68.183.234.223 port 49138:11: Bye Bye [preauth]
Sep  7 13:08:37 nativespace-cdp sshd[3266760]: Disconnected from 68.183.234.223 port 49138 [preauth]
Sep  7 13:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 13:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:43 nativespace-cdp sudo[3267127]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 13:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:43 nativespace-cdp sudo[3267131]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 13:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:46 nativespace-cdp sudo[3267136]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 13:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:47 nativespace-cdp sudo[3267157]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 13:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:53 nativespace-cdp sudo[3267165]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:53 nativespace-cdp sudo[3267211]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:53 nativespace-cdp sudo[3267216]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:53 nativespace-cdp sudo[3267220]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:53 nativespace-cdp sudo[3267225]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:53 nativespace-cdp sudo[3267231]: pam_unix(sudo:session): session closed for user root
Sep  7 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:09:53 nativespace-cdp sudo[3267239]: pam_unix(sudo:session): session closed for user root
Sep  7 13:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 13:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:10:13 nativespace-cdp sudo[3267676]: pam_unix(sudo:session): session closed for user root
Sep  7 13:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 13:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:10:15 nativespace-cdp sudo[3267681]: pam_unix(sudo:session): session closed for user root
Sep  7 13:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=skyfirec user-2=alexadmin user-3=askhform user-4=stuartge user-5=innovat1 user-6=nativene user-7=nstriton user-8=brighto1 user-9=oneoarco user-10=battlere user-11=vivienn1 user-12=firstre2 user-13=bedfords user-14=bemadonn user-15=newstoda user-16=belle user-17=ggaaorgu user-18=elecleis user-19=milloyco user-20=gilpin user-21=fetch user-22=carsinyo user-23=hubmaster user-24=putterfi user-25=ianrayne user-26=accooper user-27=thqkgnbz user-28=connectedshoppin user-29=firstres user-30=ultbcrra user-31=jonhartl user-32=seftvta user-33=opaiscyx user-34=coursemc user-35=costestimatorco user-36=firstrel user-37=clarkass user-38=highlegh user-39=southlon user-40=firstred user-41=martsblo user-42=ptkxhsbt user-43=dickemery123 user-44=hhdugcor user-45=lbhyisi user-46=magichat user-47=brmrjxl
Sep  7 13:10:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=lakesan1 user-49=atestord user-50=sarafoundation user-51=strathar user-52=wilsonsw user-53=megacards user-54=musorguk user-55=jarvisin user-56=hodgesonweb user-57=theblack user-58=spectrum user-59=agproduc user-60=still user-61=leereyn1 user-62=stephani user-63=foundation user-64=booff user-65=markward user-66=lbscrmod user-67=maflemin user-68=vantagep user-69=athenare user-70=connect9 user-71=ulsukarm user-72=what user-73=tstardom user-74=oubpgvbx user-75=nvihkvu user-76=havantho user-77=sketchy user-78=cath user-79=kategilpin user-80=dancinggardener user-81=stagingerris user-82=ladburyp user-83=design user-84=nove user-85=boldover user-86=crrtipdl user-87=sosevalu user-88=bakery user-89=lucy user-90=attlebor user-91=onlycont user-92=branko user-93=outdoorc user-94=ranxterc user-95=hodgsonmail user-96=romaldki user-97=tomandle user-98=jennimil user-99=mcdermos user-100=chrisdal user-101=david
Sep  7 13:10:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=careers user-103=nbhavers user-104=ninejimm user-105=reliable user-106=cambria1 user-107=cathski user-108=cwsocial user-109=paulmca1 user-110=howardon user-111=pugwash user-112=hirefootballgame user-113=courseme user-114=eugincou user-115=foods user-116=leftie user-117=health2045 user-118=fortunaz user-119=nscdp user-120=putterfc user-121=steakbridieme user-122=donnychicago user-123=firstre5 user-124=ctedorgu user-125=philmcph user-126=lkpier user-127=isleofwi user-128=smrszyqg user-129=tigerlet user-130=barbersh user-131=nomistakes user-132=hidden user-133=fawcettd user-134=burydropin user-135=nsceres user-136=darkstar user-137=eatspam user-138=beauty user-139=dhyana user-140=asandcoc user-141=sibtoncc user-142=zebrapho user-143=bwppodcast user-144=steve feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  7 13:10:15 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 13:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:10:17 nativespace-cdp sudo[3267702]: pam_unix(sudo:session): session closed for user root
Sep  7 13:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 13:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:10:18 nativespace-cdp sudo[3267767]: pam_unix(sudo:session): session closed for user root
Sep  7 13:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7IKlDChpr3irwM5R.~
Sep  7 13:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:10:18 nativespace-cdp sudo[3267782]: pam_unix(sudo:session): session closed for user root
Sep  7 13:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7IKlDChpr3irwM5R.~'
Sep  7 13:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:10:18 nativespace-cdp sudo[3267786]: pam_unix(sudo:session): session closed for user root
Sep  7 13:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7IKlDChpr3irwM5R.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 13:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:10:18 nativespace-cdp sudo[3267790]: pam_unix(sudo:session): session closed for user root
Sep  7 13:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 13:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:10:18 nativespace-cdp sudo[3267793]: pam_unix(sudo:session): session closed for user root
Sep  7 13:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 13:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 13:10:20 nativespace-cdp sudo[3267833]: pam_unix(sudo:session): session closed for user root
Sep  7 13:11:24 nativespace-cdp sshd[3268417]: Invalid user db2inst1 from 157.245.102.141 port 36354
Sep  7 13:11:24 nativespace-cdp sshd[3268417]: input_userauth_request: invalid user db2inst1 [preauth]
Sep  7 13:11:24 nativespace-cdp sshd[3268417]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:11:24 nativespace-cdp sshd[3268417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.102.141
Sep  7 13:11:27 nativespace-cdp sshd[3268417]: Failed password for invalid user db2inst1 from 157.245.102.141 port 36354 ssh2
Sep  7 13:11:27 nativespace-cdp sshd[3268417]: Received disconnect from 157.245.102.141 port 36354:11: Bye Bye [preauth]
Sep  7 13:11:27 nativespace-cdp sshd[3268417]: Disconnected from 157.245.102.141 port 36354 [preauth]
Sep  7 13:11:36 nativespace-cdp sshd[3268524]: Connection closed by 159.100.136.21 port 42470 [preauth]
Sep  7 13:12:38 nativespace-cdp sshd[3269084]: Invalid user hui from 152.42.139.235 port 60818
Sep  7 13:12:38 nativespace-cdp sshd[3269084]: input_userauth_request: invalid user hui [preauth]
Sep  7 13:12:38 nativespace-cdp sshd[3269084]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:12:38 nativespace-cdp sshd[3269084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.139.235
Sep  7 13:12:40 nativespace-cdp sshd[3269084]: Failed password for invalid user hui from 152.42.139.235 port 60818 ssh2
Sep  7 13:12:40 nativespace-cdp sshd[3269084]: Received disconnect from 152.42.139.235 port 60818:11: Bye Bye [preauth]
Sep  7 13:12:40 nativespace-cdp sshd[3269084]: Disconnected from 152.42.139.235 port 60818 [preauth]
Sep  7 13:12:40 nativespace-cdp sshd[3269090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.189.126.17  user=root
Sep  7 13:12:40 nativespace-cdp sshd[3269090]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 13:12:41 nativespace-cdp sshd[3269090]: Failed password for root from 196.189.126.17 port 42780 ssh2
Sep  7 13:12:41 nativespace-cdp sshd[3269090]: Received disconnect from 196.189.126.17 port 42780:11: Bye Bye [preauth]
Sep  7 13:12:41 nativespace-cdp sshd[3269090]: Disconnected from 196.189.126.17 port 42780 [preauth]
Sep  7 13:12:51 nativespace-cdp sshd[3269139]: Invalid user dados from 158.51.111.15 port 53236
Sep  7 13:12:51 nativespace-cdp sshd[3269139]: input_userauth_request: invalid user dados [preauth]
Sep  7 13:12:51 nativespace-cdp sshd[3269139]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:12:51 nativespace-cdp sshd[3269139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.51.111.15
Sep  7 13:12:53 nativespace-cdp sshd[3269139]: Failed password for invalid user dados from 158.51.111.15 port 53236 ssh2
Sep  7 13:13:02 nativespace-cdp sshd[3269139]: Received disconnect from 158.51.111.15 port 53236:11: Bye Bye [preauth]
Sep  7 13:13:02 nativespace-cdp sshd[3269139]: Disconnected from 158.51.111.15 port 53236 [preauth]
Sep  7 13:13:22 nativespace-cdp sshd[3269350]: Invalid user rafa from 103.249.84.110 port 33176
Sep  7 13:13:22 nativespace-cdp sshd[3269350]: input_userauth_request: invalid user rafa [preauth]
Sep  7 13:13:22 nativespace-cdp sshd[3269350]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:13:22 nativespace-cdp sshd[3269350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.249.84.110
Sep  7 13:13:24 nativespace-cdp sshd[3269350]: Failed password for invalid user rafa from 103.249.84.110 port 33176 ssh2
Sep  7 13:13:27 nativespace-cdp sshd[3269350]: Received disconnect from 103.249.84.110 port 33176:11: Bye Bye [preauth]
Sep  7 13:13:27 nativespace-cdp sshd[3269350]: Disconnected from 103.249.84.110 port 33176 [preauth]
Sep  7 13:13:40 nativespace-cdp sshd[3269451]: Invalid user deploy from 201.63.145.114 port 37430
Sep  7 13:13:40 nativespace-cdp sshd[3269451]: input_userauth_request: invalid user deploy [preauth]
Sep  7 13:13:40 nativespace-cdp sshd[3269451]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:13:40 nativespace-cdp sshd[3269451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.63.145.114
Sep  7 13:13:42 nativespace-cdp sshd[3269451]: Failed password for invalid user deploy from 201.63.145.114 port 37430 ssh2
Sep  7 13:13:42 nativespace-cdp sshd[3269451]: Received disconnect from 201.63.145.114 port 37430:11: Bye Bye [preauth]
Sep  7 13:13:42 nativespace-cdp sshd[3269451]: Disconnected from 201.63.145.114 port 37430 [preauth]
Sep  7 13:14:31 nativespace-cdp sshd[3269779]: Invalid user l from 222.253.33.98 port 60096
Sep  7 13:14:31 nativespace-cdp sshd[3269779]: input_userauth_request: invalid user l [preauth]
Sep  7 13:14:31 nativespace-cdp sshd[3269779]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:14:31 nativespace-cdp sshd[3269779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.253.33.98
Sep  7 13:14:32 nativespace-cdp sshd[3269779]: Failed password for invalid user l from 222.253.33.98 port 60096 ssh2
Sep  7 13:14:32 nativespace-cdp sshd[3269779]: Received disconnect from 222.253.33.98 port 60096:11: Bye Bye [preauth]
Sep  7 13:14:32 nativespace-cdp sshd[3269779]: Disconnected from 222.253.33.98 port 60096 [preauth]
Sep  7 13:14:33 nativespace-cdp sshd[3269804]: Invalid user charlie from 89.46.223.35 port 54896
Sep  7 13:14:33 nativespace-cdp sshd[3269804]: input_userauth_request: invalid user charlie [preauth]
Sep  7 13:14:33 nativespace-cdp sshd[3269804]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:14:33 nativespace-cdp sshd[3269804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.46.223.35
Sep  7 13:14:35 nativespace-cdp sshd[3269804]: Failed password for invalid user charlie from 89.46.223.35 port 54896 ssh2
Sep  7 13:14:39 nativespace-cdp sshd[3269804]: Received disconnect from 89.46.223.35 port 54896:11: Bye Bye [preauth]
Sep  7 13:14:39 nativespace-cdp sshd[3269804]: Disconnected from 89.46.223.35 port 54896 [preauth]
Sep  7 13:14:43 nativespace-cdp sshd[3269868]: Invalid user mark from 150.185.5.6 port 48169
Sep  7 13:14:43 nativespace-cdp sshd[3269868]: input_userauth_request: invalid user mark [preauth]
Sep  7 13:14:43 nativespace-cdp sshd[3269868]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:14:43 nativespace-cdp sshd[3269868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.185.5.6
Sep  7 13:14:44 nativespace-cdp sshd[3269873]: Invalid user qa from 123.30.249.49 port 55775
Sep  7 13:14:44 nativespace-cdp sshd[3269873]: input_userauth_request: invalid user qa [preauth]
Sep  7 13:14:44 nativespace-cdp sshd[3269873]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:14:44 nativespace-cdp sshd[3269873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.249.49
Sep  7 13:14:45 nativespace-cdp sshd[3269868]: Failed password for invalid user mark from 150.185.5.6 port 48169 ssh2
Sep  7 13:14:46 nativespace-cdp sshd[3269873]: Failed password for invalid user qa from 123.30.249.49 port 55775 ssh2
Sep  7 13:14:48 nativespace-cdp sshd[3269868]: Received disconnect from 150.185.5.6 port 48169:11: Bye Bye [preauth]
Sep  7 13:14:48 nativespace-cdp sshd[3269868]: Disconnected from 150.185.5.6 port 48169 [preauth]
Sep  7 13:14:48 nativespace-cdp sshd[3269873]: Received disconnect from 123.30.249.49 port 55775:11: Bye Bye [preauth]
Sep  7 13:14:48 nativespace-cdp sshd[3269873]: Disconnected from 123.30.249.49 port 55775 [preauth]
Sep  7 13:15:11 nativespace-cdp sshd[3270184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.46.223.35  user=root
Sep  7 13:15:11 nativespace-cdp sshd[3270184]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 13:15:13 nativespace-cdp sshd[3270184]: Failed password for root from 89.46.223.35 port 46534 ssh2
Sep  7 13:15:13 nativespace-cdp sshd[3270184]: Received disconnect from 89.46.223.35 port 46534:11: Bye Bye [preauth]
Sep  7 13:15:13 nativespace-cdp sshd[3270184]: Disconnected from 89.46.223.35 port 46534 [preauth]
Sep  7 13:15:32 nativespace-cdp sshd[3270445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.51.111.15  user=root
Sep  7 13:15:32 nativespace-cdp sshd[3270445]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 13:15:34 nativespace-cdp sshd[3270445]: Failed password for root from 158.51.111.15 port 57736 ssh2
Sep  7 13:15:34 nativespace-cdp sshd[3270445]: Received disconnect from 158.51.111.15 port 57736:11: Bye Bye [preauth]
Sep  7 13:15:34 nativespace-cdp sshd[3270445]: Disconnected from 158.51.111.15 port 57736 [preauth]
Sep  7 13:15:43 nativespace-cdp sshd[3270590]: Invalid user test123 from 157.245.102.141 port 34262
Sep  7 13:15:43 nativespace-cdp sshd[3270590]: input_userauth_request: invalid user test123 [preauth]
Sep  7 13:15:43 nativespace-cdp sshd[3270590]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:15:43 nativespace-cdp sshd[3270590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.102.141
Sep  7 13:15:44 nativespace-cdp sshd[3270590]: Failed password for invalid user test123 from 157.245.102.141 port 34262 ssh2
Sep  7 13:15:44 nativespace-cdp sshd[3270590]: Received disconnect from 157.245.102.141 port 34262:11: Bye Bye [preauth]
Sep  7 13:15:44 nativespace-cdp sshd[3270590]: Disconnected from 157.245.102.141 port 34262 [preauth]
Sep  7 13:15:55 nativespace-cdp sshd[3270711]: Invalid user alex from 201.63.145.114 port 37746
Sep  7 13:15:55 nativespace-cdp sshd[3270711]: input_userauth_request: invalid user alex [preauth]
Sep  7 13:15:55 nativespace-cdp sshd[3270711]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:15:55 nativespace-cdp sshd[3270711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.63.145.114
Sep  7 13:15:57 nativespace-cdp sshd[3270711]: Failed password for invalid user alex from 201.63.145.114 port 37746 ssh2
Sep  7 13:15:57 nativespace-cdp sshd[3270711]: Received disconnect from 201.63.145.114 port 37746:11: Bye Bye [preauth]
Sep  7 13:15:57 nativespace-cdp sshd[3270711]: Disconnected from 201.63.145.114 port 37746 [preauth]
Sep  7 13:16:26 nativespace-cdp sshd[3270925]: Invalid user developer from 158.51.111.15 port 58090
Sep  7 13:16:26 nativespace-cdp sshd[3270925]: input_userauth_request: invalid user developer [preauth]
Sep  7 13:16:26 nativespace-cdp sshd[3270925]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:16:26 nativespace-cdp sshd[3270925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.51.111.15
Sep  7 13:16:28 nativespace-cdp sshd[3270925]: Failed password for invalid user developer from 158.51.111.15 port 58090 ssh2
Sep  7 13:16:28 nativespace-cdp sshd[3270925]: Received disconnect from 158.51.111.15 port 58090:11: Bye Bye [preauth]
Sep  7 13:16:28 nativespace-cdp sshd[3270925]: Disconnected from 158.51.111.15 port 58090 [preauth]
Sep  7 13:16:29 nativespace-cdp sshd[3270936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.102.141  user=root
Sep  7 13:16:29 nativespace-cdp sshd[3270936]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 13:16:31 nativespace-cdp sshd[3270936]: Failed password for root from 157.245.102.141 port 41938 ssh2
Sep  7 13:16:35 nativespace-cdp sshd[3270997]: Connection closed by 159.100.136.21 port 50354 [preauth]
Sep  7 13:16:51 nativespace-cdp sshd[3271051]: Invalid user vpn from 201.63.145.114 port 49272
Sep  7 13:16:51 nativespace-cdp sshd[3271051]: input_userauth_request: invalid user vpn [preauth]
Sep  7 13:16:51 nativespace-cdp sshd[3271051]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:16:51 nativespace-cdp sshd[3271051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.63.145.114
Sep  7 13:16:53 nativespace-cdp sshd[3271051]: Failed password for invalid user vpn from 201.63.145.114 port 49272 ssh2
Sep  7 13:16:55 nativespace-cdp sshd[3271051]: Received disconnect from 201.63.145.114 port 49272:11: Bye Bye [preauth]
Sep  7 13:16:55 nativespace-cdp sshd[3271051]: Disconnected from 201.63.145.114 port 49272 [preauth]
Sep  7 13:17:07 nativespace-cdp sshd[3271182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.234.223  user=root
Sep  7 13:17:07 nativespace-cdp sshd[3271182]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 13:17:09 nativespace-cdp sshd[3271182]: Failed password for root from 68.183.234.223 port 51712 ssh2
Sep  7 13:17:09 nativespace-cdp sshd[3271182]: Received disconnect from 68.183.234.223 port 51712:11: Bye Bye [preauth]
Sep  7 13:17:09 nativespace-cdp sshd[3271182]: Disconnected from 68.183.234.223 port 51712 [preauth]
Sep  7 13:17:28 nativespace-cdp sshd[3271356]: Invalid user desarrollo from 144.126.131.161 port 45502
Sep  7 13:17:28 nativespace-cdp sshd[3271356]: input_userauth_request: invalid user desarrollo [preauth]
Sep  7 13:17:28 nativespace-cdp sshd[3271356]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:17:28 nativespace-cdp sshd[3271356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.126.131.161
Sep  7 13:17:30 nativespace-cdp sshd[3271356]: Failed password for invalid user desarrollo from 144.126.131.161 port 45502 ssh2
Sep  7 13:17:33 nativespace-cdp sshd[3271356]: Received disconnect from 144.126.131.161 port 45502:11: Bye Bye [preauth]
Sep  7 13:17:33 nativespace-cdp sshd[3271356]: Disconnected from 144.126.131.161 port 45502 [preauth]
Sep  7 13:17:49 nativespace-cdp sshd[3271584]: Invalid user devin from 68.183.234.223 port 37962
Sep  7 13:17:49 nativespace-cdp sshd[3271584]: input_userauth_request: invalid user devin [preauth]
Sep  7 13:17:49 nativespace-cdp sshd[3271584]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:17:49 nativespace-cdp sshd[3271584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.234.223
Sep  7 13:17:51 nativespace-cdp sshd[3271584]: Failed password for invalid user devin from 68.183.234.223 port 37962 ssh2
Sep  7 13:17:54 nativespace-cdp sshd[3271601]: Invalid user baccellieri from 152.42.139.235 port 49866
Sep  7 13:17:54 nativespace-cdp sshd[3271601]: input_userauth_request: invalid user baccellieri [preauth]
Sep  7 13:17:54 nativespace-cdp sshd[3271601]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:17:54 nativespace-cdp sshd[3271601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.139.235
Sep  7 13:17:55 nativespace-cdp sshd[3271584]: Received disconnect from 68.183.234.223 port 37962:11: Bye Bye [preauth]
Sep  7 13:17:55 nativespace-cdp sshd[3271584]: Disconnected from 68.183.234.223 port 37962 [preauth]
Sep  7 13:17:56 nativespace-cdp sshd[3271601]: Failed password for invalid user baccellieri from 152.42.139.235 port 49866 ssh2
Sep  7 13:17:58 nativespace-cdp sshd[3271601]: Received disconnect from 152.42.139.235 port 49866:11: Bye Bye [preauth]
Sep  7 13:17:58 nativespace-cdp sshd[3271601]: Disconnected from 152.42.139.235 port 49866 [preauth]
Sep  7 13:18:06 nativespace-cdp sshd[3271672]: Invalid user mika from 196.189.126.17 port 35520
Sep  7 13:18:06 nativespace-cdp sshd[3271672]: input_userauth_request: invalid user mika [preauth]
Sep  7 13:18:06 nativespace-cdp sshd[3271672]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:18:06 nativespace-cdp sshd[3271672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.189.126.17
Sep  7 13:18:07 nativespace-cdp sshd[3271674]: Invalid user rafa from 222.253.33.98 port 51942
Sep  7 13:18:07 nativespace-cdp sshd[3271674]: input_userauth_request: invalid user rafa [preauth]
Sep  7 13:18:07 nativespace-cdp sshd[3271674]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:18:07 nativespace-cdp sshd[3271674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.253.33.98
Sep  7 13:18:08 nativespace-cdp sshd[3271672]: Failed password for invalid user mika from 196.189.126.17 port 35520 ssh2
Sep  7 13:18:08 nativespace-cdp sshd[3271672]: Received disconnect from 196.189.126.17 port 35520:11: Bye Bye [preauth]
Sep  7 13:18:08 nativespace-cdp sshd[3271672]: Disconnected from 196.189.126.17 port 35520 [preauth]
Sep  7 13:18:09 nativespace-cdp sshd[3271674]: Failed password for invalid user rafa from 222.253.33.98 port 51942 ssh2
Sep  7 13:18:10 nativespace-cdp sshd[3271674]: Received disconnect from 222.253.33.98 port 51942:11: Bye Bye [preauth]
Sep  7 13:18:10 nativespace-cdp sshd[3271674]: Disconnected from 222.253.33.98 port 51942 [preauth]
Sep  7 13:18:17 nativespace-cdp sshd[3271769]: Invalid user vk from 103.249.84.110 port 43804
Sep  7 13:18:17 nativespace-cdp sshd[3271769]: input_userauth_request: invalid user vk [preauth]
Sep  7 13:18:17 nativespace-cdp sshd[3271769]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:18:17 nativespace-cdp sshd[3271769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.249.84.110
Sep  7 13:18:19 nativespace-cdp sshd[3271769]: Failed password for invalid user vk from 103.249.84.110 port 43804 ssh2
Sep  7 13:18:19 nativespace-cdp sshd[3271769]: Received disconnect from 103.249.84.110 port 43804:11: Bye Bye [preauth]
Sep  7 13:18:19 nativespace-cdp sshd[3271769]: Disconnected from 103.249.84.110 port 43804 [preauth]
Sep  7 13:18:37 nativespace-cdp sshd[3271963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.139.235  user=root
Sep  7 13:18:37 nativespace-cdp sshd[3271963]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 13:18:40 nativespace-cdp sshd[3271963]: Failed password for root from 152.42.139.235 port 59092 ssh2
Sep  7 13:18:40 nativespace-cdp sshd[3271963]: Received disconnect from 152.42.139.235 port 59092:11: Bye Bye [preauth]
Sep  7 13:18:40 nativespace-cdp sshd[3271963]: Disconnected from 152.42.139.235 port 59092 [preauth]
Sep  7 13:18:40 nativespace-cdp sshd[3272055]: Invalid user testuser from 150.185.5.6 port 58862
Sep  7 13:18:40 nativespace-cdp sshd[3272055]: input_userauth_request: invalid user testuser [preauth]
Sep  7 13:18:40 nativespace-cdp sshd[3272055]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:18:40 nativespace-cdp sshd[3272055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.185.5.6
Sep  7 13:18:42 nativespace-cdp sshd[3272055]: Failed password for invalid user testuser from 150.185.5.6 port 58862 ssh2
Sep  7 13:18:46 nativespace-cdp sshd[3272055]: Received disconnect from 150.185.5.6 port 58862:11: Bye Bye [preauth]
Sep  7 13:18:46 nativespace-cdp sshd[3272055]: Disconnected from 150.185.5.6 port 58862 [preauth]
Sep  7 13:18:52 nativespace-cdp sshd[3272149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.185.5.6  user=root
Sep  7 13:18:52 nativespace-cdp sshd[3272149]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 13:18:54 nativespace-cdp sshd[3272149]: Failed password for root from 150.185.5.6 port 59573 ssh2
Sep  7 13:18:56 nativespace-cdp sshd[3272149]: Received disconnect from 150.185.5.6 port 59573:11: Bye Bye [preauth]
Sep  7 13:18:56 nativespace-cdp sshd[3272149]: Disconnected from 150.185.5.6 port 59573 [preauth]
Sep  7 13:19:00 nativespace-cdp sshd[3272189]: Invalid user rfprod from 222.253.33.98 port 60902
Sep  7 13:19:00 nativespace-cdp sshd[3272189]: input_userauth_request: invalid user rfprod [preauth]
Sep  7 13:19:00 nativespace-cdp sshd[3272189]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:19:00 nativespace-cdp sshd[3272189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.253.33.98
Sep  7 13:19:01 nativespace-cdp sshd[3272235]: Invalid user vector from 103.249.84.110 port 56996
Sep  7 13:19:01 nativespace-cdp sshd[3272235]: input_userauth_request: invalid user vector [preauth]
Sep  7 13:19:01 nativespace-cdp sshd[3272235]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:19:01 nativespace-cdp sshd[3272235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.249.84.110
Sep  7 13:19:02 nativespace-cdp sshd[3272189]: Failed password for invalid user rfprod from 222.253.33.98 port 60902 ssh2
Sep  7 13:19:03 nativespace-cdp sshd[3272235]: Failed password for invalid user vector from 103.249.84.110 port 56996 ssh2
Sep  7 13:19:07 nativespace-cdp sshd[3272235]: Received disconnect from 103.249.84.110 port 56996:11: Bye Bye [preauth]
Sep  7 13:19:07 nativespace-cdp sshd[3272235]: Disconnected from 103.249.84.110 port 56996 [preauth]
Sep  7 13:19:12 nativespace-cdp sshd[3272418]: Invalid user builduser from 123.30.249.49 port 43962
Sep  7 13:19:12 nativespace-cdp sshd[3272418]: input_userauth_request: invalid user builduser [preauth]
Sep  7 13:19:12 nativespace-cdp sshd[3272418]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:19:12 nativespace-cdp sshd[3272418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.249.49
Sep  7 13:19:14 nativespace-cdp sshd[3272418]: Failed password for invalid user builduser from 123.30.249.49 port 43962 ssh2
Sep  7 13:19:17 nativespace-cdp sshd[3272418]: Received disconnect from 123.30.249.49 port 43962:11: Bye Bye [preauth]
Sep  7 13:19:17 nativespace-cdp sshd[3272418]: Disconnected from 123.30.249.49 port 43962 [preauth]
Sep  7 13:19:23 nativespace-cdp sshd[3272478]: Invalid user rafa from 196.189.126.17 port 53228
Sep  7 13:19:23 nativespace-cdp sshd[3272478]: input_userauth_request: invalid user rafa [preauth]
Sep  7 13:19:23 nativespace-cdp sshd[3272478]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:19:23 nativespace-cdp sshd[3272478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.189.126.17
Sep  7 13:19:24 nativespace-cdp sshd[3272478]: Failed password for invalid user rafa from 196.189.126.17 port 53228 ssh2
Sep  7 13:19:27 nativespace-cdp sshd[3272478]: Received disconnect from 196.189.126.17 port 53228:11: Bye Bye [preauth]
Sep  7 13:19:27 nativespace-cdp sshd[3272478]: Disconnected from 196.189.126.17 port 53228 [preauth]
Sep  7 13:20:11 nativespace-cdp sshd[3272852]: Invalid user cinthia from 123.30.249.49 port 51202
Sep  7 13:20:11 nativespace-cdp sshd[3272852]: input_userauth_request: invalid user cinthia [preauth]
Sep  7 13:20:11 nativespace-cdp sshd[3272852]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:20:11 nativespace-cdp sshd[3272852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.249.49
Sep  7 13:20:13 nativespace-cdp sshd[3272852]: Failed password for invalid user cinthia from 123.30.249.49 port 51202 ssh2
Sep  7 13:20:13 nativespace-cdp sshd[3272852]: Received disconnect from 123.30.249.49 port 51202:11: Bye Bye [preauth]
Sep  7 13:20:13 nativespace-cdp sshd[3272852]: Disconnected from 123.30.249.49 port 51202 [preauth]
Sep  7 13:21:33 nativespace-cdp sshd[3273710]: Connection closed by 159.100.136.21 port 59936 [preauth]
Sep  7 13:24:13 nativespace-cdp sshd[3274665]: Invalid user vector from 144.126.131.161 port 37854
Sep  7 13:24:13 nativespace-cdp sshd[3274665]: input_userauth_request: invalid user vector [preauth]
Sep  7 13:24:13 nativespace-cdp sshd[3274665]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:24:13 nativespace-cdp sshd[3274665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.126.131.161
Sep  7 13:24:15 nativespace-cdp sshd[3274665]: Failed password for invalid user vector from 144.126.131.161 port 37854 ssh2
Sep  7 13:24:15 nativespace-cdp sshd[3274665]: Received disconnect from 144.126.131.161 port 37854:11: Bye Bye [preauth]
Sep  7 13:24:15 nativespace-cdp sshd[3274665]: Disconnected from 144.126.131.161 port 37854 [preauth]
Sep  7 13:25:17 nativespace-cdp sshd[3275394]: Invalid user rjp from 144.126.131.161 port 34944
Sep  7 13:25:17 nativespace-cdp sshd[3275394]: input_userauth_request: invalid user rjp [preauth]
Sep  7 13:25:17 nativespace-cdp sshd[3275394]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 13:25:17 nativespace-cdp sshd[3275394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.126.131.161
Sep  7 13:25:19 nativespace-cdp sshd[3275394]: Failed password for invalid user rjp from 144.126.131.161 port 34944 ssh2
Sep  7 13:25:21 nativespace-cdp sshd[3275394]: Received disconnect from 144.126.131.161 port 34944:11: Bye Bye [preauth]
Sep  7 13:25:21 nativespace-cdp sshd[3275394]: Disconnected from 144.126.131.161 port 34944 [preauth]
Sep  7 13:26:33 nativespace-cdp sshd[3275974]: Connection closed by 159.100.136.21 port 41474 [preauth]
Sep  7 13:31:33 nativespace-cdp sshd[3278497]: Connection closed by 159.100.136.21 port 50860 [preauth]
Sep  7 13:36:35 nativespace-cdp sshd[3279636]: Connection closed by 159.100.136.21 port 60444 [preauth]
Sep  7 13:41:37 nativespace-cdp sshd[3281001]: Connection closed by 159.100.136.21 port 41090 [preauth]
Sep  7 13:46:35 nativespace-cdp sshd[3282083]: Connection closed by 159.100.136.21 port 50866 [preauth]
Sep  7 13:51:35 nativespace-cdp sshd[3283283]: Connection closed by 159.100.136.21 port 59322 [preauth]
Sep  7 13:56:33 nativespace-cdp sshd[3284656]: Connection closed by 159.100.136.21 port 40960 [preauth]
Sep  7 14:01:33 nativespace-cdp sshd[3285870]: Connection closed by 159.100.136.21 port 50390 [preauth]
Sep  7 14:06:35 nativespace-cdp sshd[3286958]: Connection closed by 159.100.136.21 port 59940 [preauth]
Sep  7 14:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 14:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:23 nativespace-cdp sudo[3287530]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 14:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:23 nativespace-cdp sudo[3287534]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 14:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:24 nativespace-cdp sudo[3287540]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 14:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:24 nativespace-cdp sudo[3287549]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 14:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:26 nativespace-cdp sudo[3287555]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 14:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:26 nativespace-cdp sudo[3287567]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 14:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:27 nativespace-cdp sudo[3287572]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 14:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:27 nativespace-cdp sudo[3287576]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 14:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:27 nativespace-cdp sudo[3287581]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 14:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:27 nativespace-cdp sudo[3287587]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 14:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:27 nativespace-cdp sudo[3287595]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 14:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:38 nativespace-cdp sudo[3287624]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 14:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:38 nativespace-cdp sudo[3287630]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=outdoorc user-2=hodgsonmail user-3=ranxterc user-4=branko user-5=romaldki user-6=attlebor user-7=lucy user-8=onlycont user-9=chrisdal user-10=mcdermos user-11=nbhavers user-12=careers user-13=david user-14=tomandle user-15=jennimil user-16=ladburyp user-17=stagingerris user-18=dancinggardener user-19=kategilpin user-20=design user-21=oubpgvbx user-22=tstardom user-23=what user-24=cath user-25=sketchy user-26=havantho user-27=nvihkvu user-28=bakery user-29=sosevalu user-30=crrtipdl user-31=nove user-32=boldover user-33=beauty user-34=eatspam user-35=darkstar user-36=dhyana user-37=burydropin user-38=fawcettd user-39=nsceres user-40=bwppodcast user-41=zebrapho user-42=steve user-43=asandcoc user-44=sibtoncc user-45=hirefootballgame user-46=eugincou user-47=courseme user-48=cambria1 user-49=cathski
Sep  7 14:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=reliable user-51=ninejimm user-52=howardon user-53=paulmca1 user-54=pugwash user-55=cwsocial user-56=isleofwi user-57=smrszyqg user-58=hidden user-59=nomistakes user-60=barbersh user-61=tigerlet user-62=putterfc user-63=nscdp user-64=fortunaz user-65=health2045 user-66=foods user-67=leftie user-68=lkpier user-69=philmcph user-70=ctedorgu user-71=firstre5 user-72=donnychicago user-73=steakbridieme user-74=accooper user-75=ianrayne user-76=connectedshoppin user-77=thqkgnbz user-78=milloyco user-79=gilpin user-80=elecleis user-81=putterfi user-82=hubmaster user-83=carsinyo user-84=fetch user-85=firstrel user-86=clarkass user-87=costestimatorco user-88=firstred user-89=southlon user-90=highlegh user-91=seftvta user-92=jonhartl user-93=ultbcrra user-94=firstres user-95=opaiscyx user-96=coursemc user-97=innovat1 user-98=askhform user-99=stuartge user-100=nativene user-101=skyfirec user-102=alexadmin
Sep  7 14:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=belle user-105=ggaaorgu user-106=newstoda user-107=bemadonn user-108=brighto1 user-109=nstriton user-110=firstre2 user-111=vivienn1 user-112=battlere user-113=oneoarco user-114=still user-115=agproduc user-116=stephani user-117=leereyn1 user-118=jarvisin user-119=spectrum user-120=hodgesonweb user-121=theblack user-122=ulsukarm user-123=booff user-124=markward user-125=foundation user-126=athenare user-127=connect9 user-128=vantagep user-129=maflemin user-130=lbscrmod user-131=lbhyisi user-132=hhdugcor user-133=magichat user-134=martsblo user-135=dickemery123 user-136=ptkxhsbt user-137=wilsonsw user-138=musorguk user-139=megacards user-140=lakesan1 user-141=brmrjxl user-142=strathar user-143=sarafoundation user-144=atestord feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 14:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 14:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:39 nativespace-cdp sudo[3287637]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 14:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:39 nativespace-cdp sudo[3287645]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tL5507btsN65AJDA.~
Sep  7 14:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:39 nativespace-cdp sudo[3287650]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tL5507btsN65AJDA.~'
Sep  7 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:40 nativespace-cdp sudo[3287654]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tL5507btsN65AJDA.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:40 nativespace-cdp sudo[3287660]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:40 nativespace-cdp sudo[3287665]: pam_unix(sudo:session): session closed for user root
Sep  7 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 14:09:41 nativespace-cdp sudo[3287689]: pam_unix(sudo:session): session closed for user root
Sep  7 14:11:36 nativespace-cdp sshd[3288371]: Connection closed by 159.100.136.21 port 40620 [preauth]
Sep  7 14:16:33 nativespace-cdp sshd[3289412]: Connection closed by 159.100.136.21 port 50162 [preauth]
Sep  7 14:21:33 nativespace-cdp sshd[3290477]: Connection closed by 159.100.136.21 port 58870 [preauth]
Sep  7 14:31:33 nativespace-cdp sshd[3292887]: Connection closed by 159.100.136.21 port 48480 [preauth]
Sep  7 14:36:35 nativespace-cdp sshd[3293927]: Connection closed by 159.100.136.21 port 58338 [preauth]
Sep  7 14:37:23 nativespace-cdp sshd[3294121]: Invalid user temp from 201.48.78.29 port 59122
Sep  7 14:37:23 nativespace-cdp sshd[3294121]: input_userauth_request: invalid user temp [preauth]
Sep  7 14:37:23 nativespace-cdp sshd[3294121]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:37:23 nativespace-cdp sshd[3294121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.48.78.29
Sep  7 14:37:25 nativespace-cdp sshd[3294121]: Failed password for invalid user temp from 201.48.78.29 port 59122 ssh2
Sep  7 14:37:25 nativespace-cdp sshd[3294121]: Received disconnect from 201.48.78.29 port 59122:11: Bye Bye [preauth]
Sep  7 14:37:25 nativespace-cdp sshd[3294121]: Disconnected from 201.48.78.29 port 59122 [preauth]
Sep  7 14:37:26 nativespace-cdp sshd[3294127]: Invalid user test-user from 60.199.224.55 port 58844
Sep  7 14:37:26 nativespace-cdp sshd[3294127]: input_userauth_request: invalid user test-user [preauth]
Sep  7 14:37:26 nativespace-cdp sshd[3294127]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:37:26 nativespace-cdp sshd[3294127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.199.224.55
Sep  7 14:37:28 nativespace-cdp sshd[3294127]: Failed password for invalid user test-user from 60.199.224.55 port 58844 ssh2
Sep  7 14:37:28 nativespace-cdp sshd[3294127]: Received disconnect from 60.199.224.55 port 58844:11: Bye Bye [preauth]
Sep  7 14:37:28 nativespace-cdp sshd[3294127]: Disconnected from 60.199.224.55 port 58844 [preauth]
Sep  7 14:39:43 nativespace-cdp sshd[3294744]: Invalid user soporte from 167.71.229.36 port 40872
Sep  7 14:39:43 nativespace-cdp sshd[3294744]: input_userauth_request: invalid user soporte [preauth]
Sep  7 14:39:43 nativespace-cdp sshd[3294744]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:39:43 nativespace-cdp sshd[3294744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.229.36
Sep  7 14:39:45 nativespace-cdp sshd[3294744]: Failed password for invalid user soporte from 167.71.229.36 port 40872 ssh2
Sep  7 14:39:45 nativespace-cdp sshd[3294744]: Received disconnect from 167.71.229.36 port 40872:11: Bye Bye [preauth]
Sep  7 14:39:45 nativespace-cdp sshd[3294744]: Disconnected from 167.71.229.36 port 40872 [preauth]
Sep  7 14:40:25 nativespace-cdp sshd[3295217]: Invalid user temp from 118.193.39.171 port 44814
Sep  7 14:40:25 nativespace-cdp sshd[3295217]: input_userauth_request: invalid user temp [preauth]
Sep  7 14:40:25 nativespace-cdp sshd[3295217]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:40:25 nativespace-cdp sshd[3295217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.193.39.171
Sep  7 14:40:27 nativespace-cdp sshd[3295217]: Failed password for invalid user temp from 118.193.39.171 port 44814 ssh2
Sep  7 14:40:27 nativespace-cdp sshd[3295217]: Received disconnect from 118.193.39.171 port 44814:11: Bye Bye [preauth]
Sep  7 14:40:27 nativespace-cdp sshd[3295217]: Disconnected from 118.193.39.171 port 44814 [preauth]
Sep  7 14:41:04 nativespace-cdp sshd[3295352]: Invalid user test-user from 103.86.198.162 port 50683
Sep  7 14:41:04 nativespace-cdp sshd[3295352]: input_userauth_request: invalid user test-user [preauth]
Sep  7 14:41:04 nativespace-cdp sshd[3295352]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:41:04 nativespace-cdp sshd[3295352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.86.198.162
Sep  7 14:41:07 nativespace-cdp sshd[3295352]: Failed password for invalid user test-user from 103.86.198.162 port 50683 ssh2
Sep  7 14:41:10 nativespace-cdp sshd[3295374]: Invalid user shuo from 157.245.194.78 port 34864
Sep  7 14:41:10 nativespace-cdp sshd[3295374]: input_userauth_request: invalid user shuo [preauth]
Sep  7 14:41:10 nativespace-cdp sshd[3295374]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:41:10 nativespace-cdp sshd[3295374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.194.78
Sep  7 14:41:12 nativespace-cdp sshd[3295352]: Received disconnect from 103.86.198.162 port 50683:11: Bye Bye [preauth]
Sep  7 14:41:12 nativespace-cdp sshd[3295352]: Disconnected from 103.86.198.162 port 50683 [preauth]
Sep  7 14:41:13 nativespace-cdp sshd[3295374]: Failed password for invalid user shuo from 157.245.194.78 port 34864 ssh2
Sep  7 14:41:13 nativespace-cdp sshd[3295374]: Received disconnect from 157.245.194.78 port 34864:11: Bye Bye [preauth]
Sep  7 14:41:13 nativespace-cdp sshd[3295374]: Disconnected from 157.245.194.78 port 34864 [preauth]
Sep  7 14:41:33 nativespace-cdp sshd[3295426]: Connection closed by 159.100.136.21 port 38202 [preauth]
Sep  7 14:43:48 nativespace-cdp sshd[3295840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.48.78.29  user=root
Sep  7 14:43:48 nativespace-cdp sshd[3295840]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 14:43:50 nativespace-cdp sshd[3295840]: Failed password for root from 201.48.78.29 port 51432 ssh2
Sep  7 14:43:50 nativespace-cdp sshd[3295840]: Received disconnect from 201.48.78.29 port 51432:11: Bye Bye [preauth]
Sep  7 14:43:50 nativespace-cdp sshd[3295840]: Disconnected from 201.48.78.29 port 51432 [preauth]
Sep  7 14:44:26 nativespace-cdp sshd[3295957]: Invalid user huwei from 118.193.39.171 port 55802
Sep  7 14:44:26 nativespace-cdp sshd[3295957]: input_userauth_request: invalid user huwei [preauth]
Sep  7 14:44:26 nativespace-cdp sshd[3295957]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:44:26 nativespace-cdp sshd[3295957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.193.39.171
Sep  7 14:44:28 nativespace-cdp sshd[3295963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.229.36  user=root
Sep  7 14:44:28 nativespace-cdp sshd[3295963]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 14:44:28 nativespace-cdp sshd[3295957]: Failed password for invalid user huwei from 118.193.39.171 port 55802 ssh2
Sep  7 14:44:28 nativespace-cdp sshd[3295957]: Received disconnect from 118.193.39.171 port 55802:11: Bye Bye [preauth]
Sep  7 14:44:28 nativespace-cdp sshd[3295957]: Disconnected from 118.193.39.171 port 55802 [preauth]
Sep  7 14:44:30 nativespace-cdp sshd[3295963]: Failed password for root from 167.71.229.36 port 47456 ssh2
Sep  7 14:44:30 nativespace-cdp sshd[3295963]: Received disconnect from 167.71.229.36 port 47456:11: Bye Bye [preauth]
Sep  7 14:44:30 nativespace-cdp sshd[3295963]: Disconnected from 167.71.229.36 port 47456 [preauth]
Sep  7 14:44:38 nativespace-cdp sshd[3295980]: Invalid user postgres from 201.48.78.29 port 38338
Sep  7 14:44:38 nativespace-cdp sshd[3295980]: input_userauth_request: invalid user postgres [preauth]
Sep  7 14:44:38 nativespace-cdp sshd[3295980]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:44:38 nativespace-cdp sshd[3295980]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.48.78.29
Sep  7 14:44:40 nativespace-cdp sshd[3295980]: Failed password for invalid user postgres from 201.48.78.29 port 38338 ssh2
Sep  7 14:44:40 nativespace-cdp sshd[3295980]: Received disconnect from 201.48.78.29 port 38338:11: Bye Bye [preauth]
Sep  7 14:44:40 nativespace-cdp sshd[3295980]: Disconnected from 201.48.78.29 port 38338 [preauth]
Sep  7 14:44:45 nativespace-cdp sshd[3296027]: Invalid user xiangyu from 157.245.194.78 port 53226
Sep  7 14:44:45 nativespace-cdp sshd[3296027]: input_userauth_request: invalid user xiangyu [preauth]
Sep  7 14:44:45 nativespace-cdp sshd[3296027]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:44:45 nativespace-cdp sshd[3296027]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.194.78
Sep  7 14:44:47 nativespace-cdp sshd[3296027]: Failed password for invalid user xiangyu from 157.245.194.78 port 53226 ssh2
Sep  7 14:44:49 nativespace-cdp sshd[3296027]: Received disconnect from 157.245.194.78 port 53226:11: Bye Bye [preauth]
Sep  7 14:44:49 nativespace-cdp sshd[3296027]: Disconnected from 157.245.194.78 port 53226 [preauth]
Sep  7 14:44:49 nativespace-cdp sshd[3296030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.86.198.162  user=root
Sep  7 14:44:49 nativespace-cdp sshd[3296030]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 14:44:51 nativespace-cdp sshd[3296041]: Invalid user userone from 60.199.224.55 port 55924
Sep  7 14:44:51 nativespace-cdp sshd[3296041]: input_userauth_request: invalid user userone [preauth]
Sep  7 14:44:51 nativespace-cdp sshd[3296041]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:44:51 nativespace-cdp sshd[3296041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.199.224.55
Sep  7 14:44:51 nativespace-cdp sshd[3296030]: Failed password for root from 103.86.198.162 port 37665 ssh2
Sep  7 14:44:51 nativespace-cdp sshd[3296030]: Received disconnect from 103.86.198.162 port 37665:11: Bye Bye [preauth]
Sep  7 14:44:51 nativespace-cdp sshd[3296030]: Disconnected from 103.86.198.162 port 37665 [preauth]
Sep  7 14:44:52 nativespace-cdp sshd[3296041]: Failed password for invalid user userone from 60.199.224.55 port 55924 ssh2
Sep  7 14:44:53 nativespace-cdp sshd[3296041]: Received disconnect from 60.199.224.55 port 55924:11: Bye Bye [preauth]
Sep  7 14:44:53 nativespace-cdp sshd[3296041]: Disconnected from 60.199.224.55 port 55924 [preauth]
Sep  7 14:45:19 nativespace-cdp sshd[3296237]: Invalid user ir from 167.71.229.36 port 42446
Sep  7 14:45:19 nativespace-cdp sshd[3296237]: input_userauth_request: invalid user ir [preauth]
Sep  7 14:45:19 nativespace-cdp sshd[3296237]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:45:19 nativespace-cdp sshd[3296237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.229.36
Sep  7 14:45:21 nativespace-cdp sshd[3296237]: Failed password for invalid user ir from 167.71.229.36 port 42446 ssh2
Sep  7 14:45:21 nativespace-cdp sshd[3296237]: Received disconnect from 167.71.229.36 port 42446:11: Bye Bye [preauth]
Sep  7 14:45:21 nativespace-cdp sshd[3296237]: Disconnected from 167.71.229.36 port 42446 [preauth]
Sep  7 14:45:37 nativespace-cdp sshd[3296315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.86.198.162  user=root
Sep  7 14:45:37 nativespace-cdp sshd[3296315]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 14:45:38 nativespace-cdp sshd[3296325]: Invalid user exchangeadmin from 60.199.224.55 port 40698
Sep  7 14:45:38 nativespace-cdp sshd[3296325]: input_userauth_request: invalid user exchangeadmin [preauth]
Sep  7 14:45:38 nativespace-cdp sshd[3296325]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:45:38 nativespace-cdp sshd[3296325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.199.224.55
Sep  7 14:45:38 nativespace-cdp sshd[3296375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.194.78  user=root
Sep  7 14:45:38 nativespace-cdp sshd[3296375]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 14:45:38 nativespace-cdp sshd[3296315]: Failed password for root from 103.86.198.162 port 44178 ssh2
Sep  7 14:45:38 nativespace-cdp sshd[3296315]: Received disconnect from 103.86.198.162 port 44178:11: Bye Bye [preauth]
Sep  7 14:45:38 nativespace-cdp sshd[3296315]: Disconnected from 103.86.198.162 port 44178 [preauth]
Sep  7 14:45:39 nativespace-cdp sshd[3296303]: Connection closed by 118.193.39.171 port 51690 [preauth]
Sep  7 14:45:40 nativespace-cdp sshd[3296325]: Failed password for invalid user exchangeadmin from 60.199.224.55 port 40698 ssh2
Sep  7 14:45:40 nativespace-cdp sshd[3296375]: Failed password for root from 157.245.194.78 port 58208 ssh2
Sep  7 14:45:40 nativespace-cdp sshd[3296325]: Received disconnect from 60.199.224.55 port 40698:11: Bye Bye [preauth]
Sep  7 14:45:40 nativespace-cdp sshd[3296325]: Disconnected from 60.199.224.55 port 40698 [preauth]
Sep  7 14:45:40 nativespace-cdp sshd[3296375]: Received disconnect from 157.245.194.78 port 58208:11: Bye Bye [preauth]
Sep  7 14:45:40 nativespace-cdp sshd[3296375]: Disconnected from 157.245.194.78 port 58208 [preauth]
Sep  7 14:46:33 nativespace-cdp sshd[3296595]: Connection closed by 159.100.136.21 port 47460 [preauth]
Sep  7 14:47:07 nativespace-cdp sshd[3296607]: Connection closed by 118.193.39.171 port 47650 [preauth]
Sep  7 14:47:38 nativespace-cdp sshd[3296750]: Invalid user richard from 118.193.39.171 port 35154
Sep  7 14:47:38 nativespace-cdp sshd[3296750]: input_userauth_request: invalid user richard [preauth]
Sep  7 14:47:38 nativespace-cdp sshd[3296750]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 14:47:38 nativespace-cdp sshd[3296750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.193.39.171
Sep  7 14:47:40 nativespace-cdp sshd[3296750]: Failed password for invalid user richard from 118.193.39.171 port 35154 ssh2
Sep  7 14:47:43 nativespace-cdp sshd[3296750]: Received disconnect from 118.193.39.171 port 35154:11: Bye Bye [preauth]
Sep  7 14:47:43 nativespace-cdp sshd[3296750]: Disconnected from 118.193.39.171 port 35154 [preauth]
Sep  7 14:51:36 nativespace-cdp sshd[3297955]: Connection closed by 159.100.136.21 port 56912 [preauth]
Sep  7 14:56:35 nativespace-cdp sshd[3299296]: Connection closed by 159.100.136.21 port 38118 [preauth]
Sep  7 15:01:33 nativespace-cdp sshd[3300454]: Connection closed by 159.100.136.21 port 47844 [preauth]
Sep  7 15:06:34 nativespace-cdp sshd[3301442]: Connection closed by 159.100.136.21 port 57928 [preauth]
Sep  7 15:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 15:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:21 nativespace-cdp sudo[3301966]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 15:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:21 nativespace-cdp sudo[3301970]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 15:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:21 nativespace-cdp sudo[3301975]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 15:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:21 nativespace-cdp sudo[3301982]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 15:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:24 nativespace-cdp sudo[3301988]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 15:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:24 nativespace-cdp sudo[3302001]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 15:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:24 nativespace-cdp sudo[3302006]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 15:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:24 nativespace-cdp sudo[3302010]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 15:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:24 nativespace-cdp sudo[3302015]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 15:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:24 nativespace-cdp sudo[3302020]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 15:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:24 nativespace-cdp sudo[3302027]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 15:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:26 nativespace-cdp sudo[3302039]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 15:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:26 nativespace-cdp sudo[3302045]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=oneoarco user-2=battlere user-3=vivienn1 user-4=firstre2 user-5=nstriton user-6=brighto1 user-7=bemadonn user-8=newstoda user-9=ggaaorgu user-10=belle user-11=bedfords user-12=alexadmin user-13=skyfirec user-14=nativene user-15=askhform user-16=stuartge user-17=innovat1 user-18=coursemc user-19=opaiscyx user-20=firstres user-21=ultbcrra user-22=jonhartl user-23=seftvta user-24=highlegh user-25=southlon user-26=firstred user-27=costestimatorco user-28=clarkass user-29=firstrel user-30=fetch user-31=carsinyo user-32=putterfi user-33=hubmaster user-34=elecleis user-35=gilpin user-36=milloyco user-37=thqkgnbz user-38=connectedshoppin user-39=ianrayne user-40=accooper user-41=atestord user-42=sarafoundation user-43=strathar user-44=lakesan1 user-45=brmrjxl user-46=megacards user-47=musorguk
Sep  7 15:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=wilsonsw user-49=ptkxhsbt user-50=dickemery123 user-51=martsblo user-52=magichat user-53=hhdugcor user-54=lbhyisi user-55=lbscrmod user-56=maflemin user-57=vantagep user-58=athenare user-59=connect9 user-60=booff user-61=foundation user-62=markward user-63=ulsukarm user-64=hodgesonweb user-65=theblack user-66=spectrum user-67=jarvisin user-68=leereyn1 user-69=stephani user-70=agproduc user-71=still user-72=boldover user-73=nove user-74=crrtipdl user-75=sosevalu user-76=bakery user-77=nvihkvu user-78=havantho user-79=sketchy user-80=cath user-81=what user-82=oubpgvbx user-83=tstardom user-84=design user-85=kategilpin user-86=stagingerris user-87=dancinggardener user-88=ladburyp user-89=jennimil user-90=tomandle user-91=david user-92=nbhavers user-93=careers user-94=mcdermos user-95=chrisdal user-96=onlycont user-97=lucy user-98=attlebor user-99=romaldki user-100=branko user-101=outdoorc
Sep  7 15:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hodgsonmail user-103=ranxterc user-104=donnychicago user-105=steakbridieme user-106=firstre5 user-107=ctedorgu user-108=philmcph user-109=lkpier user-110=foods user-111=leftie user-112=fortunaz user-113=health2045 user-114=nscdp user-115=putterfc user-116=barbersh user-117=tigerlet user-118=nomistakes user-119=hidden user-120=isleofwi user-121=smrszyqg user-122=cwsocial user-123=pugwash user-124=howardon user-125=paulmca1 user-126=ninejimm user-127=reliable user-128=cathski user-129=cambria1 user-130=courseme user-131=eugincou user-132=hirefootballgame user-133=sibtoncc user-134=asandcoc user-135=steve user-136=zebrapho user-137=bwppodcast user-138=nsceres user-139=fawcettd user-140=burydropin user-141=dhyana user-142=darkstar user-143=eatspam user-144=beauty feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  7 15:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 15:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:27 nativespace-cdp sudo[3302053]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 15:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:27 nativespace-cdp sudo[3302061]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-b05tP7dimzLihs57.~
Sep  7 15:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:27 nativespace-cdp sudo[3302066]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-b05tP7dimzLihs57.~'
Sep  7 15:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:27 nativespace-cdp sudo[3302070]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-b05tP7dimzLihs57.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 15:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:27 nativespace-cdp sudo[3302076]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 15:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:27 nativespace-cdp sudo[3302081]: pam_unix(sudo:session): session closed for user root
Sep  7 15:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 15:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 15:09:28 nativespace-cdp sudo[3302105]: pam_unix(sudo:session): session closed for user root
Sep  7 15:11:35 nativespace-cdp sshd[3302796]: Connection closed by 159.100.136.21 port 38590 [preauth]
Sep  7 15:16:33 nativespace-cdp sshd[3303868]: Connection closed by 159.100.136.21 port 48196 [preauth]
Sep  7 15:21:33 nativespace-cdp sshd[3304965]: Connection closed by 159.100.136.21 port 57718 [preauth]
Sep  7 15:26:33 nativespace-cdp sshd[3306064]: Connection closed by 159.100.136.21 port 38672 [preauth]
Sep  7 15:31:37 nativespace-cdp sshd[3307375]: Connection closed by 159.100.136.21 port 47602 [preauth]
Sep  7 15:36:36 nativespace-cdp sshd[3308379]: Connection closed by 159.100.136.21 port 56666 [preauth]
Sep  7 15:41:33 nativespace-cdp sshd[3309642]: Connection closed by 159.100.136.21 port 37816 [preauth]
Sep  7 15:46:34 nativespace-cdp sshd[3310685]: Connection closed by 159.100.136.21 port 47466 [preauth]
Sep  7 15:51:35 nativespace-cdp sshd[3311675]: Connection closed by 159.100.136.21 port 56842 [preauth]
Sep  7 15:56:33 nativespace-cdp sshd[3312763]: Connection closed by 159.100.136.21 port 38144 [preauth]
Sep  7 16:01:33 nativespace-cdp sshd[3314011]: Connection closed by 159.100.136.21 port 47506 [preauth]
Sep  7 16:06:34 nativespace-cdp sshd[3315205]: Connection closed by 159.100.136.21 port 57348 [preauth]
Sep  7 16:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 16:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:17 nativespace-cdp sudo[3315805]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 16:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:17 nativespace-cdp sudo[3315809]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 16:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:18 nativespace-cdp sudo[3315814]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 16:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:18 nativespace-cdp sudo[3315820]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 16:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:19 nativespace-cdp sudo[3315826]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 16:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:19 nativespace-cdp sudo[3315837]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 16:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:19 nativespace-cdp sudo[3315841]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 16:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:19 nativespace-cdp sudo[3315846]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 16:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:19 nativespace-cdp sudo[3315851]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 16:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:19 nativespace-cdp sudo[3315856]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 16:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:19 nativespace-cdp sudo[3315862]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 16:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:21 nativespace-cdp sudo[3315876]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 16:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:21 nativespace-cdp sudo[3315882]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=barbersh user-2=tigerlet user-3=nomistakes user-4=hidden user-5=isleofwi user-6=smrszyqg user-7=firstre5 user-8=steakbridieme user-9=donnychicago user-10=ctedorgu user-11=philmcph user-12=lkpier user-13=leftie user-14=foods user-15=fortunaz user-16=health2045 user-17=nscdp user-18=putterfc user-19=courseme user-20=eugincou user-21=hirefootballgame user-22=cwsocial user-23=paulmca1 user-24=howardon user-25=pugwash user-26=reliable user-27=ninejimm user-28=cathski user-29=cambria1 user-30=steve user-31=zebrapho user-32=bwppodcast user-33=asandcoc user-34=sibtoncc user-35=dhyana user-36=darkstar user-37=eatspam user-38=beauty user-39=nsceres user-40=fawcettd user-41=burydropin user-42=crrtipdl user-43=sosevalu user-44=bakery user-45=boldover user-46=nove user-47=design user-48=kategilpin
Sep  7 16:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=stagingerris user-50=dancinggardener user-51=ladburyp user-52=nvihkvu user-53=havantho user-54=cath user-55=sketchy user-56=what user-57=oubpgvbx user-58=tstardom user-59=david user-60=careers user-61=nbhavers user-62=mcdermos user-63=chrisdal user-64=jennimil user-65=tomandle user-66=romaldki user-67=branko user-68=hodgsonmail user-69=outdoorc user-70=ranxterc user-71=onlycont user-72=lucy user-73=attlebor user-74=megacards user-75=musorguk user-76=wilsonsw user-77=atestord user-78=sarafoundation user-79=strathar user-80=lakesan1 user-81=brmrjxl user-82=magichat user-83=hhdugcor user-84=lbhyisi user-85=ptkxhsbt user-86=dickemery123 user-87=martsblo user-88=ulsukarm user-89=lbscrmod user-90=maflemin user-91=vantagep user-92=athenare user-93=connect9 user-94=foundation user-95=markward user-96=booff user-97=leereyn1 user-98=stephani user-99=agproduc user-100=still user-101=theblack user-102=hodgesonweb
Sep  7 16:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=spectrum user-104=jarvisin user-105=bemadonn user-106=newstoda user-107=belle user-108=ggaaorgu user-109=bedfords user-110=oneoarco user-111=battlere user-112=vivienn1 user-113=firstre2 user-114=nstriton user-115=brighto1 user-116=nativene user-117=stuartge user-118=askhform user-119=innovat1 user-120=skyfirec user-121=alexadmin user-122=highlegh user-123=southlon user-124=firstred user-125=costestimatorco user-126=clarkass user-127=firstrel user-128=coursemc user-129=opaiscyx user-130=firstres user-131=ultbcrra user-132=seftvta user-133=jonhartl user-134=thqkgnbz user-135=connectedshoppin user-136=ianrayne user-137=accooper user-138=fetch user-139=carsinyo user-140=hubmaster user-141=putterfi user-142=elecleis user-143=gilpin user-144=milloyco feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 16:09:21 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 16:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:22 nativespace-cdp sudo[3315888]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 16:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:22 nativespace-cdp sudo[3315896]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Rs0aMPWIjSPin7yT.~
Sep  7 16:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:22 nativespace-cdp sudo[3315901]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Rs0aMPWIjSPin7yT.~'
Sep  7 16:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:22 nativespace-cdp sudo[3315905]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Rs0aMPWIjSPin7yT.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 16:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:22 nativespace-cdp sudo[3315911]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 16:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:22 nativespace-cdp sudo[3315916]: pam_unix(sudo:session): session closed for user root
Sep  7 16:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 16:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 16:09:23 nativespace-cdp sudo[3315940]: pam_unix(sudo:session): session closed for user root
Sep  7 16:11:33 nativespace-cdp sshd[3316728]: Connection closed by 159.100.136.21 port 38708 [preauth]
Sep  7 16:16:34 nativespace-cdp sshd[3317837]: Connection closed by 159.100.136.21 port 48476 [preauth]
Sep  7 16:21:33 nativespace-cdp sshd[3318948]: Connection closed by 159.100.136.21 port 57760 [preauth]
Sep  7 16:26:34 nativespace-cdp sshd[3320058]: Connection closed by 159.100.136.21 port 39082 [preauth]
Sep  7 16:31:34 nativespace-cdp sshd[3321314]: Connection closed by 159.100.136.21 port 48388 [preauth]
Sep  7 16:36:34 nativespace-cdp sshd[3322327]: Connection closed by 159.100.136.21 port 57754 [preauth]
Sep  7 16:41:35 nativespace-cdp sshd[3323639]: Connection closed by 159.100.136.21 port 38200 [preauth]
Sep  7 16:46:39 nativespace-cdp sshd[3324694]: Did not receive identification string from 159.100.136.21 port 46938
Sep  7 16:47:00 nativespace-cdp crond[3324633]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  7 16:51:33 nativespace-cdp sshd[3325649]: Connection closed by 159.100.136.21 port 55790 [preauth]
Sep  7 16:56:33 nativespace-cdp sshd[3326775]: Connection closed by 159.100.136.21 port 36546 [preauth]
Sep  7 17:01:34 nativespace-cdp sshd[3328257]: Connection closed by 159.100.136.21 port 45224 [preauth]
Sep  7 17:06:34 nativespace-cdp sshd[3329342]: Connection closed by 159.100.136.21 port 53782 [preauth]
Sep  7 17:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 17:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:09:41 nativespace-cdp sudo[3329981]: pam_unix(sudo:session): session closed for user root
Sep  7 17:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 17:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:09:41 nativespace-cdp sudo[3329986]: pam_unix(sudo:session): session closed for user root
Sep  7 17:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 17:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:09:42 nativespace-cdp sudo[3329991]: pam_unix(sudo:session): session closed for user root
Sep  7 17:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 17:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:09:42 nativespace-cdp sudo[3329999]: pam_unix(sudo:session): session closed for user root
Sep  7 17:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 17:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:02 nativespace-cdp sudo[3330005]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 17:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:02 nativespace-cdp sudo[3330228]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 17:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:02 nativespace-cdp sudo[3330231]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 17:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:02 nativespace-cdp sudo[3330234]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 17:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:02 nativespace-cdp sudo[3330237]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 17:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:03 nativespace-cdp sudo[3330240]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 17:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:03 nativespace-cdp sudo[3330244]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 17:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:08 nativespace-cdp sudo[3330302]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 17:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:09 nativespace-cdp sudo[3330307]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=eugincou user-2=courseme user-3=hirefootballgame user-4=paulmca1 user-5=howardon user-6=pugwash user-7=cwsocial user-8=cathski user-9=cambria1 user-10=reliable user-11=ninejimm user-12=hidden user-13=nomistakes user-14=barbersh user-15=tigerlet user-16=smrszyqg user-17=isleofwi user-18=lkpier user-19=philmcph user-20=ctedorgu user-21=firstre5 user-22=steakbridieme user-23=donnychicago user-24=putterfc user-25=nscdp user-26=health2045 user-27=fortunaz user-28=leftie user-29=foods user-30=dhyana user-31=beauty user-32=eatspam user-33=darkstar user-34=nsceres user-35=burydropin user-36=fawcettd user-37=steve user-38=bwppodcast user-39=zebrapho user-40=sibtoncc user-41=asandcoc user-42=design user-43=ladburyp user-44=stagingerris user-45=dancinggardener user-46=kategilpin user-47=cath
Sep  7 17:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=sketchy user-49=havantho user-50=nvihkvu user-51=tstardom user-52=oubpgvbx user-53=what user-54=bakery user-55=sosevalu user-56=crrtipdl user-57=boldover user-58=nove user-59=romaldki user-60=outdoorc user-61=ranxterc user-62=hodgsonmail user-63=branko user-64=onlycont user-65=attlebor user-66=lucy user-67=careers user-68=nbhavers user-69=david user-70=chrisdal user-71=mcdermos user-72=jennimil user-73=tomandle user-74=magichat user-75=lbhyisi user-76=hhdugcor user-77=dickemery123 user-78=ptkxhsbt user-79=martsblo user-80=musorguk user-81=megacards user-82=wilsonsw user-83=strathar user-84=sarafoundation user-85=atestord user-86=lakesan1 user-87=brmrjxl user-88=stephani user-89=leereyn1 user-90=still user-91=agproduc user-92=spectrum user-93=theblack user-94=hodgesonweb user-95=jarvisin user-96=ulsukarm user-97=connect9 user-98=athenare user-99=vantagep user-100=maflemin user-101=lbscrmod
Sep  7 17:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=markward user-103=booff user-104=foundation user-105=nativene user-106=innovat1 user-107=askhform user-108=stuartge user-109=skyfirec user-110=alexadmin user-111=belle user-112=ggaaorgu user-113=newstoda user-114=bemadonn user-115=bedfords user-116=firstre2 user-117=vivienn1 user-118=battlere user-119=oneoarco user-120=brighto1 user-121=nstriton user-122=connectedshoppin user-123=thqkgnbz user-124=accooper user-125=ianrayne user-126=hubmaster user-127=putterfi user-128=carsinyo user-129=fetch user-130=gilpin user-131=milloyco user-132=elecleis user-133=firstred user-134=southlon user-135=highlegh user-136=firstrel user-137=clarkass user-138=costestimatorco user-139=opaiscyx user-140=coursemc user-141=seftvta user-142=jonhartl user-143=ultbcrra user-144=firstres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  7 17:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:10 nativespace-cdp sudo[3330314]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:10 nativespace-cdp sudo[3330319]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7FALsXEyUgFeQUdk.~
Sep  7 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:10 nativespace-cdp sudo[3330322]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7FALsXEyUgFeQUdk.~'
Sep  7 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:10 nativespace-cdp sudo[3330325]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7FALsXEyUgFeQUdk.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:10 nativespace-cdp sudo[3330329]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:10 nativespace-cdp sudo[3330332]: pam_unix(sudo:session): session closed for user root
Sep  7 17:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 17:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 17:10:11 nativespace-cdp sudo[3330350]: pam_unix(sudo:session): session closed for user root
Sep  7 17:11:36 nativespace-cdp sshd[3330749]: Connection closed by 159.100.136.21 port 34796 [preauth]
Sep  7 17:16:34 nativespace-cdp sshd[3331935]: Connection closed by 159.100.136.21 port 44310 [preauth]
Sep  7 17:21:34 nativespace-cdp sshd[3333024]: Connection closed by 159.100.136.21 port 53472 [preauth]
Sep  7 17:26:34 nativespace-cdp sshd[3334154]: Connection closed by 159.100.136.21 port 34568 [preauth]
Sep  7 17:31:33 nativespace-cdp sshd[3335391]: Connection closed by 159.100.136.21 port 43986 [preauth]
Sep  7 17:36:33 nativespace-cdp sshd[3336550]: Connection closed by 159.100.136.21 port 53726 [preauth]
Sep  7 17:41:33 nativespace-cdp sshd[3337890]: Connection closed by 159.100.136.21 port 34200 [preauth]
Sep  7 17:46:35 nativespace-cdp sshd[3339334]: Connection closed by 159.100.136.21 port 43182 [preauth]
Sep  7 17:51:33 nativespace-cdp sshd[3340388]: Connection closed by 159.100.136.21 port 52472 [preauth]
Sep  7 17:56:35 nativespace-cdp sshd[3341424]: Connection closed by 159.100.136.21 port 33178 [preauth]
Sep  7 18:01:35 nativespace-cdp sshd[3342711]: Connection closed by 159.100.136.21 port 41622 [preauth]
Sep  7 18:04:01 nativespace-cdp sshd[3343428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.254.235.13  user=root
Sep  7 18:04:01 nativespace-cdp sshd[3343428]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 18:04:03 nativespace-cdp sshd[3343428]: Failed password for root from 27.254.235.13 port 45078 ssh2
Sep  7 18:04:03 nativespace-cdp sshd[3343428]: Received disconnect from 27.254.235.13 port 45078:11: Bye Bye [preauth]
Sep  7 18:04:03 nativespace-cdp sshd[3343428]: Disconnected from 27.254.235.13 port 45078 [preauth]
Sep  7 18:06:33 nativespace-cdp sshd[3344431]: Connection closed by 159.100.136.21 port 50440 [preauth]
Sep  7 18:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 18:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:34 nativespace-cdp sudo[3344928]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 18:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:34 nativespace-cdp sudo[3344932]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 18:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:36 nativespace-cdp sudo[3344937]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 18:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:36 nativespace-cdp sudo[3344948]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 18:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:37 nativespace-cdp sshd[3344973]: Invalid user qyy from 27.254.235.13 port 58250
Sep  7 18:09:37 nativespace-cdp sshd[3344973]: input_userauth_request: invalid user qyy [preauth]
Sep  7 18:09:38 nativespace-cdp sshd[3344973]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 18:09:38 nativespace-cdp sshd[3344973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.254.235.13
Sep  7 18:09:39 nativespace-cdp sudo[3344954]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:39 nativespace-cdp sudo[3345055]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:39 nativespace-cdp sudo[3345061]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:39 nativespace-cdp sudo[3345065]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:39 nativespace-cdp sudo[3345070]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:39 nativespace-cdp sudo[3345075]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:39 nativespace-cdp sudo[3345081]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:40 nativespace-cdp sshd[3344973]: Failed password for invalid user qyy from 27.254.235.13 port 58250 ssh2
Sep  7 18:09:40 nativespace-cdp sshd[3344973]: Received disconnect from 27.254.235.13 port 58250:11: Bye Bye [preauth]
Sep  7 18:09:40 nativespace-cdp sshd[3344973]: Disconnected from 27.254.235.13 port 58250 [preauth]
Sep  7 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:41 nativespace-cdp sudo[3345093]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:41 nativespace-cdp sudo[3345100]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=fetch user-2=carsinyo user-3=hubmaster user-4=putterfi user-5=elecleis user-6=milloyco user-7=gilpin user-8=thqkgnbz user-9=connectedshoppin user-10=ianrayne user-11=accooper user-12=coursemc user-13=opaiscyx user-14=firstres user-15=ultbcrra user-16=jonhartl user-17=seftvta user-18=highlegh user-19=southlon user-20=firstred user-21=costestimatorco user-22=firstrel user-23=clarkass user-24=alexadmin user-25=skyfirec user-26=nativene user-27=askhform user-28=stuartge user-29=innovat1 user-30=oneoarco user-31=battlere user-32=vivienn1 user-33=firstre2 user-34=nstriton user-35=brighto1 user-36=bemadonn user-37=newstoda user-38=belle user-39=ggaaorgu user-40=bedfords user-41=theblack user-42=hodgesonweb user-43=spectrum user-44=jarvisin user-45=leereyn1 user-46=stephani user-47=agproduc
Sep  7 18:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=still user-49=lbscrmod user-50=maflemin user-51=vantagep user-52=connect9 user-53=athenare user-54=booff user-55=markward user-56=foundation user-57=ulsukarm user-58=ptkxhsbt user-59=dickemery123 user-60=martsblo user-61=magichat user-62=hhdugcor user-63=lbhyisi user-64=atestord user-65=sarafoundation user-66=strathar user-67=brmrjxl user-68=lakesan1 user-69=megacards user-70=musorguk user-71=wilsonsw user-72=onlycont user-73=lucy user-74=attlebor user-75=romaldki user-76=branko user-77=hodgsonmail user-78=outdoorc user-79=ranxterc user-80=jennimil user-81=tomandle user-82=david user-83=careers user-84=nbhavers user-85=mcdermos user-86=chrisdal user-87=nvihkvu user-88=havantho user-89=sketchy user-90=cath user-91=what user-92=oubpgvbx user-93=tstardom user-94=design user-95=kategilpin user-96=dancinggardener user-97=stagingerris user-98=ladburyp user-99=boldover user-100=nove user-101=crrtipdl
Sep  7 18:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sosevalu user-103=bakery user-104=nsceres user-105=fawcettd user-106=burydropin user-107=dhyana user-108=darkstar user-109=eatspam user-110=beauty user-111=asandcoc user-112=sibtoncc user-113=steve user-114=zebrapho user-115=bwppodcast user-116=cwsocial user-117=pugwash user-118=howardon user-119=paulmca1 user-120=reliable user-121=ninejimm user-122=cathski user-123=cambria1 user-124=courseme user-125=eugincou user-126=hirefootballgame user-127=firstre5 user-128=steakbridieme user-129=donnychicago user-130=ctedorgu user-131=philmcph user-132=lkpier user-133=foods user-134=leftie user-135=health2045 user-136=fortunaz user-137=nscdp user-138=putterfc user-139=barbersh user-140=tigerlet user-141=nomistakes user-142=hidden user-143=smrszyqg user-144=isleofwi feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  7 18:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:42 nativespace-cdp sudo[3345107]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:42 nativespace-cdp sudo[3345116]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-pPaXnbynVdHk0de6.~
Sep  7 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:42 nativespace-cdp sudo[3345121]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-pPaXnbynVdHk0de6.~'
Sep  7 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:42 nativespace-cdp sudo[3345125]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-pPaXnbynVdHk0de6.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:43 nativespace-cdp sudo[3345131]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:09:43 nativespace-cdp sudo[3345136]: pam_unix(sudo:session): session closed for user root
Sep  7 18:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 18:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 18:10:00 nativespace-cdp sudo[3345197]: pam_unix(sudo:session): session closed for user root
Sep  7 18:10:30 nativespace-cdp sshd[3345686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.254.235.13  user=root
Sep  7 18:10:30 nativespace-cdp sshd[3345686]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 18:10:31 nativespace-cdp sshd[3345686]: Failed password for root from 27.254.235.13 port 42818 ssh2
Sep  7 18:10:36 nativespace-cdp sshd[3345686]: Received disconnect from 27.254.235.13 port 42818:11: Bye Bye [preauth]
Sep  7 18:10:36 nativespace-cdp sshd[3345686]: Disconnected from 27.254.235.13 port 42818 [preauth]
Sep  7 18:11:33 nativespace-cdp sshd[3345862]: Connection closed by 159.100.136.21 port 59242 [preauth]
Sep  7 18:16:33 nativespace-cdp sshd[3347067]: Connection closed by 159.100.136.21 port 40524 [preauth]
Sep  7 18:21:36 nativespace-cdp sshd[3348139]: Connection closed by 159.100.136.21 port 49948 [preauth]
Sep  7 18:26:33 nativespace-cdp sshd[3349137]: Connection closed by 159.100.136.21 port 59692 [preauth]
Sep  7 18:31:33 nativespace-cdp sshd[3350467]: Connection closed by 159.100.136.21 port 40518 [preauth]
Sep  7 18:36:33 nativespace-cdp sshd[3351506]: Connection closed by 159.100.136.21 port 49486 [preauth]
Sep  7 18:41:34 nativespace-cdp sshd[3353055]: Connection closed by 159.100.136.21 port 58622 [preauth]
Sep  7 18:46:34 nativespace-cdp sshd[3354146]: Connection closed by 159.100.136.21 port 39694 [preauth]
Sep  7 18:51:33 nativespace-cdp sshd[3355205]: Connection closed by 159.100.136.21 port 48952 [preauth]
Sep  7 18:56:33 nativespace-cdp sshd[3356349]: Connection closed by 159.100.136.21 port 58326 [preauth]
Sep  7 19:01:33 nativespace-cdp sshd[3357617]: Connection closed by 159.100.136.21 port 39310 [preauth]
Sep  7 19:06:36 nativespace-cdp sshd[3358573]: Connection closed by 159.100.136.21 port 48988 [preauth]
Sep  7 19:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 19:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:33 nativespace-cdp sudo[3359121]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 19:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:33 nativespace-cdp sudo[3359125]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 19:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:34 nativespace-cdp sudo[3359130]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 19:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:34 nativespace-cdp sudo[3359135]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 19:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:35 nativespace-cdp sudo[3359142]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:35 nativespace-cdp sudo[3359152]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:35 nativespace-cdp sudo[3359156]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:35 nativespace-cdp sudo[3359161]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:35 nativespace-cdp sudo[3359166]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:36 nativespace-cdp sudo[3359174]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:36 nativespace-cdp sudo[3359182]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 19:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:55 nativespace-cdp sudo[3359237]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:56 nativespace-cdp sudo[3359245]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=atestord user-2=sarafoundation user-3=strathar user-4=brmrjxl user-5=lakesan1 user-6=megacards user-7=musorguk user-8=wilsonsw user-9=ptkxhsbt user-10=dickemery123 user-11=martsblo user-12=magichat user-13=hhdugcor user-14=lbhyisi user-15=lbscrmod user-16=maflemin user-17=vantagep user-18=athenare user-19=connect9 user-20=foundation user-21=booff user-22=markward user-23=ulsukarm user-24=hodgesonweb user-25=theblack user-26=spectrum user-27=jarvisin user-28=leereyn1 user-29=stephani user-30=agproduc user-31=still user-32=oneoarco user-33=battlere user-34=vivienn1 user-35=firstre2 user-36=nstriton user-37=brighto1 user-38=bemadonn user-39=newstoda user-40=belle user-41=ggaaorgu user-42=bedfords user-43=alexadmin user-44=skyfirec user-45=nativene user-46=stuartge user-47=askhform user-48=innovat1
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=opaiscyx user-50=coursemc user-51=firstres user-52=ultbcrra user-53=jonhartl user-54=seftvta user-55=highlegh user-56=southlon user-57=firstred user-58=costestimatorco user-59=firstrel user-60=clarkass user-61=fetch user-62=carsinyo user-63=putterfi user-64=hubmaster user-65=elecleis user-66=gilpin user-67=milloyco user-68=thqkgnbz user-69=connectedshoppin user-70=ianrayne user-71=accooper user-72=donnychicago user-73=steakbridieme user-74=firstre5 user-75=ctedorgu user-76=philmcph user-77=lkpier user-78=foods user-79=leftie user-80=health2045 user-81=fortunaz user-82=nscdp user-83=putterfc user-84=barbersh user-85=tigerlet user-86=nomistakes user-87=hidden user-88=isleofwi user-89=smrszyqg user-90=cwsocial user-91=paulmca1 user-92=howardon user-93=pugwash user-94=reliable user-95=ninejimm user-96=cambria1 user-97=cathski user-98=courseme user-99=eugincou user-100=hirefootballgame user-101=asandcoc
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sibtoncc user-103=steve user-104=zebrapho user-105=bwppodcast user-106=nsceres user-107=fawcettd user-108=burydropin user-109=dhyana user-110=darkstar user-111=eatspam user-112=beauty user-113=boldover user-114=nove user-115=crrtipdl user-116=sosevalu user-117=bakery user-118=nvihkvu user-119=havantho user-120=cath user-121=sketchy user-122=what user-123=tstardom user-124=oubpgvbx user-125=design user-126=kategilpin user-127=dancinggardener user-128=stagingerris user-129=ladburyp user-130=jennimil user-131=tomandle user-132=david user-133=careers user-134=nbhavers user-135=mcdermos user-136=chrisdal user-137=onlycont user-138=lucy user-139=attlebor user-140=romaldki user-141=branko user-142=ranxterc user-143=outdoorc user-144=hodgsonmail feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:56 nativespace-cdp sudo[3359253]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:56 nativespace-cdp sudo[3359259]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-j7M2tySvjRT1cDfD.~
Sep  7 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:56 nativespace-cdp sudo[3359264]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-j7M2tySvjRT1cDfD.~'
Sep  7 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:56 nativespace-cdp sudo[3359268]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-j7M2tySvjRT1cDfD.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:56 nativespace-cdp sudo[3359274]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:56 nativespace-cdp sudo[3359280]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep  7 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:57 nativespace-cdp sudo[3359286]: pam_unix(sudo:session): session closed for user root
Sep  7 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 19:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 19:09:58 nativespace-cdp sudo[3359313]: pam_unix(sudo:session): session closed for user root
Sep  7 19:11:33 nativespace-cdp sshd[3360069]: Connection closed by 159.100.136.21 port 57726 [preauth]
Sep  7 19:16:36 nativespace-cdp sshd[3361332]: Connection closed by 159.100.136.21 port 38792 [preauth]
Sep  7 19:21:34 nativespace-cdp sshd[3362446]: Connection closed by 159.100.136.21 port 47944 [preauth]
Sep  7 19:26:33 nativespace-cdp sshd[3363597]: Connection closed by 159.100.136.21 port 57806 [preauth]
Sep  7 19:31:33 nativespace-cdp sshd[3364960]: Connection closed by 159.100.136.21 port 38944 [preauth]
Sep  7 19:36:36 nativespace-cdp sshd[3366061]: Connection closed by 159.100.136.21 port 48508 [preauth]
Sep  7 19:41:33 nativespace-cdp sshd[3367419]: Connection closed by 159.100.136.21 port 57832 [preauth]
Sep  7 19:46:34 nativespace-cdp sshd[3368456]: Connection closed by 159.100.136.21 port 38732 [preauth]
Sep  7 19:51:33 nativespace-cdp sshd[3369576]: Connection closed by 159.100.136.21 port 48112 [preauth]
Sep  7 19:56:35 nativespace-cdp sshd[3370854]: Connection closed by 159.100.136.21 port 57664 [preauth]
Sep  7 20:01:33 nativespace-cdp sshd[3371887]: Connection closed by 159.100.136.21 port 37292 [preauth]
Sep  7 20:06:35 nativespace-cdp sshd[3372945]: Connection closed by 159.100.136.21 port 47126 [preauth]
Sep  7 20:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 20:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:34 nativespace-cdp sudo[3373517]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 20:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:34 nativespace-cdp sudo[3373521]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 20:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:34 nativespace-cdp sudo[3373526]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 20:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:34 nativespace-cdp sudo[3373533]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 20:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:36 nativespace-cdp sudo[3373539]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:36 nativespace-cdp sudo[3373549]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:36 nativespace-cdp sudo[3373553]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:36 nativespace-cdp sudo[3373558]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:36 nativespace-cdp sudo[3373563]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:36 nativespace-cdp sudo[3373570]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:36 nativespace-cdp sudo[3373575]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:41 nativespace-cdp sudo[3373602]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:41 nativespace-cdp sudo[3373608]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=theblack user-3=hodgesonweb user-4=spectrum user-5=agproduc user-6=still user-7=leereyn1 user-8=stephani user-9=foundation user-10=booff user-11=markward user-12=lbscrmod user-13=maflemin user-14=vantagep user-15=connect9 user-16=athenare user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=hhdugcor user-22=lbhyisi user-23=magichat user-24=brmrjxl user-25=lakesan1 user-26=atestord user-27=sarafoundation user-28=strathar user-29=wilsonsw user-30=megacards user-31=musorguk user-32=elecleis user-33=milloyco user-34=gilpin user-35=fetch user-36=carsinyo user-37=hubmaster user-38=putterfi user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=ultbcrra user-45=jonhartl user-46=seftvta user-47=coursemc
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=opaiscyx user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=highlegh user-53=southlon user-54=firstred user-55=alexadmin user-56=skyfirec user-57=stuartge user-58=askhform user-59=innovat1 user-60=nativene user-61=nstriton user-62=brighto1 user-63=oneoarco user-64=battlere user-65=vivienn1 user-66=firstre2 user-67=bedfords user-68=bemadonn user-69=newstoda user-70=ggaaorgu user-71=belle user-72=fawcettd user-73=burydropin user-74=nsceres user-75=darkstar user-76=eatspam user-77=beauty user-78=dhyana user-79=sibtoncc user-80=asandcoc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=reliable user-85=ninejimm user-86=cambria1 user-87=cathski user-88=cwsocial user-89=howardon user-90=pugwash user-91=paulmca1 user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=leftie user-96=foods user-97=health2045 user-98=fortunaz user-99=nscdp user-100=putterfc user-101=donnychicago
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=firstre5 user-103=steakbridieme user-104=ctedorgu user-105=philmcph user-106=lkpier user-107=smrszyqg user-108=isleofwi user-109=tigerlet user-110=barbersh user-111=nomistakes user-112=hidden user-113=lucy user-114=attlebor user-115=onlycont user-116=branko user-117=ranxterc user-118=outdoorc user-119=hodgsonmail user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=david user-126=careers user-127=nbhavers user-128=what user-129=tstardom user-130=oubpgvbx user-131=nvihkvu user-132=havantho user-133=cath user-134=sketchy user-135=kategilpin user-136=dancinggardener user-137=stagingerris user-138=ladburyp user-139=design user-140=nove user-141=boldover user-142=crrtipdl user-143=sosevalu user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:41 nativespace-cdp sudo[3373617]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:41 nativespace-cdp sudo[3373624]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F3xxnbdTnSdSrY4V.~
Sep  7 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:41 nativespace-cdp sudo[3373629]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F3xxnbdTnSdSrY4V.~'
Sep  7 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:41 nativespace-cdp sudo[3373634]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F3xxnbdTnSdSrY4V.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:41 nativespace-cdp sudo[3373641]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:41 nativespace-cdp sudo[3373646]: pam_unix(sudo:session): session closed for user root
Sep  7 20:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 20:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 20:09:42 nativespace-cdp sudo[3373668]: pam_unix(sudo:session): session closed for user root
Sep  7 20:11:33 nativespace-cdp sshd[3374374]: Connection closed by 159.100.136.21 port 56642 [preauth]
Sep  7 20:16:34 nativespace-cdp sshd[3375604]: Connection closed by 159.100.136.21 port 37790 [preauth]
Sep  7 20:21:33 nativespace-cdp sshd[3376781]: Connection closed by 159.100.136.21 port 46548 [preauth]
Sep  7 20:24:32 nativespace-cdp sshd[3377282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.72.191  user=root
Sep  7 20:24:32 nativespace-cdp sshd[3377282]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 20:24:34 nativespace-cdp sshd[3377282]: Failed password for root from 174.138.72.191 port 41504 ssh2
Sep  7 20:24:34 nativespace-cdp sshd[3377282]: Received disconnect from 174.138.72.191 port 41504:11: Bye Bye [preauth]
Sep  7 20:24:34 nativespace-cdp sshd[3377282]: Disconnected from 174.138.72.191 port 41504 [preauth]
Sep  7 20:26:04 nativespace-cdp sshd[3377972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.84.127  user=root
Sep  7 20:26:04 nativespace-cdp sshd[3377972]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 20:26:06 nativespace-cdp sshd[3377972]: Failed password for root from 164.92.84.127 port 34658 ssh2
Sep  7 20:26:07 nativespace-cdp sshd[3377972]: Received disconnect from 164.92.84.127 port 34658:11: Bye Bye [preauth]
Sep  7 20:26:07 nativespace-cdp sshd[3377972]: Disconnected from 164.92.84.127 port 34658 [preauth]
Sep  7 20:26:35 nativespace-cdp sshd[3378063]: Connection closed by 159.100.136.21 port 55836 [preauth]
Sep  7 20:29:49 nativespace-cdp sshd[3378581]: Invalid user serge from 74.94.234.151 port 60120
Sep  7 20:29:49 nativespace-cdp sshd[3378581]: input_userauth_request: invalid user serge [preauth]
Sep  7 20:29:49 nativespace-cdp sshd[3378581]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 20:29:49 nativespace-cdp sshd[3378581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.94.234.151
Sep  7 20:29:52 nativespace-cdp sshd[3378581]: Failed password for invalid user serge from 74.94.234.151 port 60120 ssh2
Sep  7 20:29:52 nativespace-cdp sshd[3378581]: Received disconnect from 74.94.234.151 port 60120:11: Bye Bye [preauth]
Sep  7 20:29:52 nativespace-cdp sshd[3378581]: Disconnected from 74.94.234.151 port 60120 [preauth]
Sep  7 20:30:01 nativespace-cdp sshd[3378621]: Invalid user cheeki from 164.92.84.127 port 44958
Sep  7 20:30:01 nativespace-cdp sshd[3378621]: input_userauth_request: invalid user cheeki [preauth]
Sep  7 20:30:01 nativespace-cdp sshd[3378621]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 20:30:01 nativespace-cdp sshd[3378621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.84.127
Sep  7 20:30:03 nativespace-cdp sshd[3378621]: Failed password for invalid user cheeki from 164.92.84.127 port 44958 ssh2
Sep  7 20:30:03 nativespace-cdp sshd[3378621]: Received disconnect from 164.92.84.127 port 44958:11: Bye Bye [preauth]
Sep  7 20:30:03 nativespace-cdp sshd[3378621]: Disconnected from 164.92.84.127 port 44958 [preauth]
Sep  7 20:30:45 nativespace-cdp sshd[3379016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.72.191  user=root
Sep  7 20:30:45 nativespace-cdp sshd[3379016]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 20:30:47 nativespace-cdp sshd[3379016]: Failed password for root from 174.138.72.191 port 51078 ssh2
Sep  7 20:30:47 nativespace-cdp sshd[3379016]: Received disconnect from 174.138.72.191 port 51078:11: Bye Bye [preauth]
Sep  7 20:30:47 nativespace-cdp sshd[3379016]: Disconnected from 174.138.72.191 port 51078 [preauth]
Sep  7 20:31:28 nativespace-cdp sshd[3379110]: Invalid user cel from 174.138.72.191 port 33602
Sep  7 20:31:28 nativespace-cdp sshd[3379110]: input_userauth_request: invalid user cel [preauth]
Sep  7 20:31:28 nativespace-cdp sshd[3379110]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 20:31:28 nativespace-cdp sshd[3379110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.72.191
Sep  7 20:31:30 nativespace-cdp sshd[3379110]: Failed password for invalid user cel from 174.138.72.191 port 33602 ssh2
Sep  7 20:31:30 nativespace-cdp sshd[3379110]: Received disconnect from 174.138.72.191 port 33602:11: Bye Bye [preauth]
Sep  7 20:31:30 nativespace-cdp sshd[3379110]: Disconnected from 174.138.72.191 port 33602 [preauth]
Sep  7 20:31:33 nativespace-cdp sshd[3379160]: Connection closed by 159.100.136.21 port 36626 [preauth]
Sep  7 20:31:52 nativespace-cdp sshd[3379210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.94.234.151  user=root
Sep  7 20:31:52 nativespace-cdp sshd[3379210]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 20:31:54 nativespace-cdp sshd[3379210]: Failed password for root from 74.94.234.151 port 52258 ssh2
Sep  7 20:31:54 nativespace-cdp sshd[3379210]: Received disconnect from 74.94.234.151 port 52258:11: Bye Bye [preauth]
Sep  7 20:31:54 nativespace-cdp sshd[3379210]: Disconnected from 74.94.234.151 port 52258 [preauth]
Sep  7 20:32:33 nativespace-cdp sshd[3379329]: Invalid user va from 164.92.84.127 port 55938
Sep  7 20:32:33 nativespace-cdp sshd[3379329]: input_userauth_request: invalid user va [preauth]
Sep  7 20:32:33 nativespace-cdp sshd[3379329]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 20:32:33 nativespace-cdp sshd[3379329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.84.127
Sep  7 20:32:35 nativespace-cdp sshd[3379329]: Failed password for invalid user va from 164.92.84.127 port 55938 ssh2
Sep  7 20:32:38 nativespace-cdp sshd[3379329]: Received disconnect from 164.92.84.127 port 55938:11: Bye Bye [preauth]
Sep  7 20:32:38 nativespace-cdp sshd[3379329]: Disconnected from 164.92.84.127 port 55938 [preauth]
Sep  7 20:32:51 nativespace-cdp sshd[3379402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.94.234.151  user=root
Sep  7 20:32:51 nativespace-cdp sshd[3379402]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 20:32:53 nativespace-cdp sshd[3379402]: Failed password for root from 74.94.234.151 port 37318 ssh2
Sep  7 20:32:53 nativespace-cdp sshd[3379402]: Received disconnect from 74.94.234.151 port 37318:11: Bye Bye [preauth]
Sep  7 20:32:53 nativespace-cdp sshd[3379402]: Disconnected from 74.94.234.151 port 37318 [preauth]
Sep  7 20:36:33 nativespace-cdp sshd[3380237]: Connection closed by 159.100.136.21 port 46024 [preauth]
Sep  7 20:41:33 nativespace-cdp sshd[3381460]: Connection closed by 159.100.136.21 port 55300 [preauth]
Sep  7 20:46:33 nativespace-cdp sshd[3382657]: Connection closed by 159.100.136.21 port 36136 [preauth]
Sep  7 20:51:33 nativespace-cdp sshd[3383648]: Connection closed by 159.100.136.21 port 45658 [preauth]
Sep  7 20:56:33 nativespace-cdp sshd[3384902]: Connection closed by 159.100.136.21 port 54788 [preauth]
Sep  7 21:01:04 nativespace-cdp sshd[3386007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.47.209.65  user=root
Sep  7 21:01:04 nativespace-cdp sshd[3386007]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 21:01:07 nativespace-cdp sshd[3386007]: Failed password for root from 37.47.209.65 port 11799 ssh2
Sep  7 21:01:08 nativespace-cdp sshd[3386007]: Received disconnect from 37.47.209.65 port 11799:11: Bye Bye [preauth]
Sep  7 21:01:08 nativespace-cdp sshd[3386007]: Disconnected from 37.47.209.65 port 11799 [preauth]
Sep  7 21:01:33 nativespace-cdp sshd[3386084]: Connection closed by 159.100.136.21 port 35418 [preauth]
Sep  7 21:03:40 nativespace-cdp sshd[3386489]: Invalid user dspace from 199.21.115.199 port 45018
Sep  7 21:03:40 nativespace-cdp sshd[3386489]: input_userauth_request: invalid user dspace [preauth]
Sep  7 21:03:40 nativespace-cdp sshd[3386489]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:03:40 nativespace-cdp sshd[3386489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.21.115.199
Sep  7 21:03:42 nativespace-cdp sshd[3386489]: Failed password for invalid user dspace from 199.21.115.199 port 45018 ssh2
Sep  7 21:03:42 nativespace-cdp sshd[3386489]: Received disconnect from 199.21.115.199 port 45018:11: Bye Bye [preauth]
Sep  7 21:03:42 nativespace-cdp sshd[3386489]: Disconnected from 199.21.115.199 port 45018 [preauth]
Sep  7 21:04:27 nativespace-cdp sshd[3386605]: Invalid user sxb from 103.248.43.98 port 37106
Sep  7 21:04:27 nativespace-cdp sshd[3386605]: input_userauth_request: invalid user sxb [preauth]
Sep  7 21:04:27 nativespace-cdp sshd[3386605]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:04:27 nativespace-cdp sshd[3386605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.248.43.98
Sep  7 21:04:29 nativespace-cdp sshd[3386605]: Failed password for invalid user sxb from 103.248.43.98 port 37106 ssh2
Sep  7 21:04:32 nativespace-cdp sshd[3386619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.75.26.147  user=root
Sep  7 21:04:32 nativespace-cdp sshd[3386619]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 21:04:33 nativespace-cdp sshd[3386605]: Received disconnect from 103.248.43.98 port 37106:11: Bye Bye [preauth]
Sep  7 21:04:33 nativespace-cdp sshd[3386605]: Disconnected from 103.248.43.98 port 37106 [preauth]
Sep  7 21:04:34 nativespace-cdp sshd[3386619]: Failed password for root from 34.75.26.147 port 55712 ssh2
Sep  7 21:04:34 nativespace-cdp sshd[3386619]: Received disconnect from 34.75.26.147 port 55712:11: Bye Bye [preauth]
Sep  7 21:04:34 nativespace-cdp sshd[3386619]: Disconnected from 34.75.26.147 port 55712 [preauth]
Sep  7 21:05:26 nativespace-cdp sshd[3386882]: Invalid user fxf from 91.151.128.225 port 52518
Sep  7 21:05:26 nativespace-cdp sshd[3386882]: input_userauth_request: invalid user fxf [preauth]
Sep  7 21:05:26 nativespace-cdp sshd[3386882]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:05:26 nativespace-cdp sshd[3386882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.151.128.225
Sep  7 21:05:28 nativespace-cdp sshd[3386882]: Failed password for invalid user fxf from 91.151.128.225 port 52518 ssh2
Sep  7 21:05:28 nativespace-cdp sshd[3386882]: Received disconnect from 91.151.128.225 port 52518:11: Bye Bye [preauth]
Sep  7 21:05:28 nativespace-cdp sshd[3386882]: Disconnected from 91.151.128.225 port 52518 [preauth]
Sep  7 21:06:34 nativespace-cdp sshd[3387135]: Connection closed by 159.100.136.21 port 45002 [preauth]
Sep  7 21:07:45 nativespace-cdp sshd[3387306]: Invalid user thomas from 179.51.153.37 port 49082
Sep  7 21:07:45 nativespace-cdp sshd[3387306]: input_userauth_request: invalid user thomas [preauth]
Sep  7 21:07:45 nativespace-cdp sshd[3387306]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:07:45 nativespace-cdp sshd[3387306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.51.153.37
Sep  7 21:07:46 nativespace-cdp sshd[3387306]: Failed password for invalid user thomas from 179.51.153.37 port 49082 ssh2
Sep  7 21:07:49 nativespace-cdp sshd[3387306]: Received disconnect from 179.51.153.37 port 49082:11: Bye Bye [preauth]
Sep  7 21:07:49 nativespace-cdp sshd[3387306]: Disconnected from 179.51.153.37 port 49082 [preauth]
Sep  7 21:09:26 nativespace-cdp sshd[3387607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.21.115.199  user=root
Sep  7 21:09:26 nativespace-cdp sshd[3387607]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 21:09:27 nativespace-cdp sshd[3387607]: Failed password for root from 199.21.115.199 port 41504 ssh2
Sep  7 21:09:28 nativespace-cdp sshd[3387607]: Received disconnect from 199.21.115.199 port 41504:11: Bye Bye [preauth]
Sep  7 21:09:28 nativespace-cdp sshd[3387607]: Disconnected from 199.21.115.199 port 41504 [preauth]
Sep  7 21:09:32 nativespace-cdp sshd[3387628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.75.26.147  user=root
Sep  7 21:09:32 nativespace-cdp sshd[3387628]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 21:09:34 nativespace-cdp sshd[3387628]: Failed password for root from 34.75.26.147 port 39104 ssh2
Sep  7 21:09:34 nativespace-cdp sshd[3387628]: Received disconnect from 34.75.26.147 port 39104:11: Bye Bye [preauth]
Sep  7 21:09:34 nativespace-cdp sshd[3387628]: Disconnected from 34.75.26.147 port 39104 [preauth]
Sep  7 21:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 21:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:38 nativespace-cdp sudo[3387649]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 21:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:38 nativespace-cdp sudo[3387653]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 21:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:39 nativespace-cdp sudo[3387658]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 21:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:39 nativespace-cdp sudo[3387664]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 21:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:40 nativespace-cdp sudo[3387670]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:40 nativespace-cdp sudo[3387681]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:40 nativespace-cdp sudo[3387686]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:40 nativespace-cdp sudo[3387690]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:40 nativespace-cdp sudo[3387694]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:40 nativespace-cdp sudo[3387700]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:40 nativespace-cdp sudo[3387706]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:42 nativespace-cdp sudo[3387717]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:42 nativespace-cdp sudo[3387723]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=zebrapho user-2=bwppodcast user-3=steve user-4=sibtoncc user-5=asandcoc user-6=darkstar user-7=eatspam user-8=beauty user-9=dhyana user-10=fawcettd user-11=burydropin user-12=nsceres user-13=isleofwi user-14=smrszyqg user-15=barbersh user-16=tigerlet user-17=nomistakes user-18=hidden user-19=foods user-20=leftie user-21=fortunaz user-22=health2045 user-23=nscdp user-24=putterfc user-25=steakbridieme user-26=donnychicago user-27=firstre5 user-28=ctedorgu user-29=philmcph user-30=lkpier user-31=hirefootballgame user-32=courseme user-33=eugincou user-34=reliable user-35=ninejimm user-36=cambria1 user-37=cathski user-38=cwsocial user-39=pugwash user-40=howardon user-41=paulmca1 user-42=mcdermos user-43=chrisdal user-44=david user-45=careers user-46=nbhavers user-47=tomandle user-48=jennimil
Sep  7 21:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=branko user-50=outdoorc user-51=ranxterc user-52=hodgsonmail user-53=romaldki user-54=lucy user-55=attlebor user-56=onlycont user-57=crrtipdl user-58=sosevalu user-59=bakery user-60=nove user-61=boldover user-62=kategilpin user-63=stagingerris user-64=dancinggardener user-65=ladburyp user-66=design user-67=what user-68=oubpgvbx user-69=tstardom user-70=nvihkvu user-71=havantho user-72=sketchy user-73=cath user-74=ulsukarm user-75=foundation user-76=booff user-77=markward user-78=lbscrmod user-79=maflemin user-80=vantagep user-81=connect9 user-82=athenare user-83=agproduc user-84=still user-85=leereyn1 user-86=stephani user-87=jarvisin user-88=hodgesonweb user-89=theblack user-90=spectrum user-91=wilsonsw user-92=megacards user-93=musorguk user-94=brmrjxl user-95=lakesan1 user-96=atestord user-97=sarafoundation user-98=strathar user-99=hhdugcor user-100=lbhyisi user-101=magichat user-102=martsblo
Sep  7 21:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ptkxhsbt user-104=dickemery123 user-105=costestimatorco user-106=clarkass user-107=firstrel user-108=highlegh user-109=southlon user-110=firstred user-111=firstres user-112=ultbcrra user-113=seftvta user-114=jonhartl user-115=opaiscyx user-116=coursemc user-117=ianrayne user-118=accooper user-119=thqkgnbz user-120=connectedshoppin user-121=elecleis user-122=gilpin user-123=milloyco user-124=fetch user-125=carsinyo user-126=hubmaster user-127=putterfi user-128=bedfords user-129=bemadonn user-130=newstoda user-131=belle user-132=ggaaorgu user-133=nstriton user-134=brighto1 user-135=oneoarco user-136=battlere user-137=vivienn1 user-138=firstre2 user-139=askhform user-140=stuartge user-141=innovat1 user-142=nativene user-143=alexadmin user-144=skyfirec feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 21:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:43 nativespace-cdp sudo[3387731]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:43 nativespace-cdp sudo[3387743]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-K2zJFLK1Z5xGH69G.~
Sep  7 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:43 nativespace-cdp sudo[3387749]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-K2zJFLK1Z5xGH69G.~'
Sep  7 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:43 nativespace-cdp sudo[3387753]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-K2zJFLK1Z5xGH69G.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:43 nativespace-cdp sudo[3387759]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:43 nativespace-cdp sudo[3387764]: pam_unix(sudo:session): session closed for user root
Sep  7 21:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 21:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:09:50 nativespace-cdp sudo[3387799]: pam_unix(sudo:session): session closed for user root
Sep  7 21:10:06 nativespace-cdp sshd[3387913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.248.43.98  user=root
Sep  7 21:10:06 nativespace-cdp sshd[3387913]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 21:10:09 nativespace-cdp sshd[3387913]: Failed password for root from 103.248.43.98 port 48360 ssh2
Sep  7 21:10:10 nativespace-cdp sshd[3387913]: Received disconnect from 103.248.43.98 port 48360:11: Bye Bye [preauth]
Sep  7 21:10:10 nativespace-cdp sshd[3387913]: Disconnected from 103.248.43.98 port 48360 [preauth]
Sep  7 21:10:12 nativespace-cdp sshd[3388013]: Invalid user jwkim from 34.75.26.147 port 52036
Sep  7 21:10:12 nativespace-cdp sshd[3388013]: input_userauth_request: invalid user jwkim [preauth]
Sep  7 21:10:12 nativespace-cdp sshd[3388013]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:10:12 nativespace-cdp sshd[3388013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.75.26.147
Sep  7 21:10:15 nativespace-cdp sshd[3388013]: Failed password for invalid user jwkim from 34.75.26.147 port 52036 ssh2
Sep  7 21:10:18 nativespace-cdp sshd[3388135]: Invalid user a from 199.21.115.199 port 57458
Sep  7 21:10:18 nativespace-cdp sshd[3388135]: input_userauth_request: invalid user a [preauth]
Sep  7 21:10:18 nativespace-cdp sshd[3388135]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:10:18 nativespace-cdp sshd[3388135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.21.115.199
Sep  7 21:10:20 nativespace-cdp sshd[3388135]: Failed password for invalid user a from 199.21.115.199 port 57458 ssh2
Sep  7 21:10:22 nativespace-cdp sshd[3388174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.151.128.225  user=root
Sep  7 21:10:22 nativespace-cdp sshd[3388174]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 21:10:24 nativespace-cdp sshd[3388174]: Failed password for root from 91.151.128.225 port 34206 ssh2
Sep  7 21:10:27 nativespace-cdp sshd[3388174]: Received disconnect from 91.151.128.225 port 34206:11: Bye Bye [preauth]
Sep  7 21:10:27 nativespace-cdp sshd[3388174]: Disconnected from 91.151.128.225 port 34206 [preauth]
Sep  7 21:10:55 nativespace-cdp sshd[3388333]: Invalid user kan from 179.51.153.37 port 50934
Sep  7 21:10:55 nativespace-cdp sshd[3388333]: input_userauth_request: invalid user kan [preauth]
Sep  7 21:10:55 nativespace-cdp sshd[3388333]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:10:55 nativespace-cdp sshd[3388333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.51.153.37
Sep  7 21:10:57 nativespace-cdp sshd[3388333]: Failed password for invalid user kan from 179.51.153.37 port 50934 ssh2
Sep  7 21:10:58 nativespace-cdp sshd[3388333]: Received disconnect from 179.51.153.37 port 50934:11: Bye Bye [preauth]
Sep  7 21:10:58 nativespace-cdp sshd[3388333]: Disconnected from 179.51.153.37 port 50934 [preauth]
Sep  7 21:11:06 nativespace-cdp sshd[3388506]: Invalid user bl from 91.151.128.225 port 47024
Sep  7 21:11:06 nativespace-cdp sshd[3388506]: input_userauth_request: invalid user bl [preauth]
Sep  7 21:11:06 nativespace-cdp sshd[3388506]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:11:06 nativespace-cdp sshd[3388506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.151.128.225
Sep  7 21:11:08 nativespace-cdp sshd[3388506]: Failed password for invalid user bl from 91.151.128.225 port 47024 ssh2
Sep  7 21:11:08 nativespace-cdp sshd[3388506]: Received disconnect from 91.151.128.225 port 47024:11: Bye Bye [preauth]
Sep  7 21:11:08 nativespace-cdp sshd[3388506]: Disconnected from 91.151.128.225 port 47024 [preauth]
Sep  7 21:11:33 nativespace-cdp sshd[3388586]: Connection closed by 159.100.136.21 port 54144 [preauth]
Sep  7 21:11:43 nativespace-cdp sshd[3388616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.51.153.37  user=root
Sep  7 21:11:43 nativespace-cdp sshd[3388616]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 21:11:45 nativespace-cdp sshd[3388616]: Failed password for root from 179.51.153.37 port 39272 ssh2
Sep  7 21:11:46 nativespace-cdp sshd[3388616]: Received disconnect from 179.51.153.37 port 39272:11: Bye Bye [preauth]
Sep  7 21:11:46 nativespace-cdp sshd[3388616]: Disconnected from 179.51.153.37 port 39272 [preauth]
Sep  7 21:11:48 nativespace-cdp sshd[3388637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.248.43.98  user=root
Sep  7 21:11:48 nativespace-cdp sshd[3388637]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 21:11:50 nativespace-cdp sshd[3388637]: Failed password for root from 103.248.43.98 port 45488 ssh2
Sep  7 21:11:50 nativespace-cdp sshd[3388637]: Received disconnect from 103.248.43.98 port 45488:11: Bye Bye [preauth]
Sep  7 21:11:50 nativespace-cdp sshd[3388637]: Disconnected from 103.248.43.98 port 45488 [preauth]
Sep  7 21:13:42 nativespace-cdp sshd[3388981]: Invalid user fxf from 37.47.209.65 port 26466
Sep  7 21:13:42 nativespace-cdp sshd[3388981]: input_userauth_request: invalid user fxf [preauth]
Sep  7 21:13:42 nativespace-cdp sshd[3388981]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:13:42 nativespace-cdp sshd[3388981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.47.209.65
Sep  7 21:13:44 nativespace-cdp sshd[3388981]: Failed password for invalid user fxf from 37.47.209.65 port 26466 ssh2
Sep  7 21:13:44 nativespace-cdp sshd[3388981]: Received disconnect from 37.47.209.65 port 26466:11: Bye Bye [preauth]
Sep  7 21:13:44 nativespace-cdp sshd[3388981]: Disconnected from 37.47.209.65 port 26466 [preauth]
Sep  7 21:14:16 nativespace-cdp sshd[3389062]: Invalid user test from 37.47.209.65 port 22354
Sep  7 21:14:16 nativespace-cdp sshd[3389062]: input_userauth_request: invalid user test [preauth]
Sep  7 21:14:16 nativespace-cdp sshd[3389062]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:14:16 nativespace-cdp sshd[3389062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.47.209.65
Sep  7 21:14:18 nativespace-cdp sshd[3389062]: Failed password for invalid user test from 37.47.209.65 port 22354 ssh2
Sep  7 21:14:21 nativespace-cdp sshd[3389062]: Received disconnect from 37.47.209.65 port 22354:11: Bye Bye [preauth]
Sep  7 21:14:21 nativespace-cdp sshd[3389062]: Disconnected from 37.47.209.65 port 22354 [preauth]
Sep  7 21:16:33 nativespace-cdp sshd[3389723]: Connection closed by 159.100.136.21 port 35092 [preauth]
Sep  7 21:21:33 nativespace-cdp sshd[3390768]: Connection closed by 159.100.136.21 port 44604 [preauth]
Sep  7 21:26:33 nativespace-cdp sshd[3391795]: Connection closed by 159.100.136.21 port 52882 [preauth]
Sep  7 21:31:33 nativespace-cdp sshd[3393041]: Connection closed by 159.100.136.21 port 33878 [preauth]
Sep  7 21:36:33 nativespace-cdp sshd[3394121]: Connection closed by 159.100.136.21 port 43566 [preauth]
Sep  7 21:41:36 nativespace-cdp sshd[3395302]: Connection closed by 159.100.136.21 port 52162 [preauth]
Sep  7 21:42:26 nativespace-cdp sshd[3395452]: Invalid user saman from 47.236.104.193 port 53320
Sep  7 21:42:26 nativespace-cdp sshd[3395452]: input_userauth_request: invalid user saman [preauth]
Sep  7 21:42:26 nativespace-cdp sshd[3395452]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:42:26 nativespace-cdp sshd[3395452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.104.193
Sep  7 21:42:28 nativespace-cdp sshd[3395452]: Failed password for invalid user saman from 47.236.104.193 port 53320 ssh2
Sep  7 21:42:28 nativespace-cdp sshd[3395452]: Received disconnect from 47.236.104.193 port 53320:11: Bye Bye [preauth]
Sep  7 21:42:28 nativespace-cdp sshd[3395452]: Disconnected from 47.236.104.193 port 53320 [preauth]
Sep  7 21:43:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 21:43:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:43:18 nativespace-cdp sudo[3395896]: pam_unix(sudo:session): session closed for user root
Sep  7 21:43:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status howardon
Sep  7 21:43:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:43:23 nativespace-cdp sudo[3395920]: pam_unix(sudo:session): session closed for user root
Sep  7 21:43:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 21:43:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:43:24 nativespace-cdp sudo[3395946]: pam_unix(sudo:session): session closed for user root
Sep  7 21:43:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  7 21:43:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:43:25 nativespace-cdp sudo[3395952]: pam_unix(sudo:session): session closed for user root
Sep  7 21:43:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 21:43:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:43:27 nativespace-cdp sudo[3395970]: pam_unix(sudo:session): session closed for user root
Sep  7 21:43:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status skyfirec
Sep  7 21:43:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 21:43:28 nativespace-cdp sudo[3395974]: pam_unix(sudo:session): session closed for user root
Sep  7 21:46:33 nativespace-cdp sshd[3396772]: Connection closed by 159.100.136.21 port 33544 [preauth]
Sep  7 21:49:56 nativespace-cdp sshd[3397308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.104.193  user=root
Sep  7 21:49:56 nativespace-cdp sshd[3397308]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 21:49:58 nativespace-cdp sshd[3397308]: Failed password for root from 47.236.104.193 port 56666 ssh2
Sep  7 21:49:58 nativespace-cdp sshd[3397308]: Received disconnect from 47.236.104.193 port 56666:11: Bye Bye [preauth]
Sep  7 21:49:58 nativespace-cdp sshd[3397308]: Disconnected from 47.236.104.193 port 56666 [preauth]
Sep  7 21:50:14 nativespace-cdp sshd[3397474]: Invalid user mailbackup from 47.236.104.193 port 48336
Sep  7 21:50:14 nativespace-cdp sshd[3397474]: input_userauth_request: invalid user mailbackup [preauth]
Sep  7 21:50:14 nativespace-cdp sshd[3397474]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 21:50:14 nativespace-cdp sshd[3397474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.104.193
Sep  7 21:50:15 nativespace-cdp sshd[3397474]: Failed password for invalid user mailbackup from 47.236.104.193 port 48336 ssh2
Sep  7 21:50:16 nativespace-cdp sshd[3397474]: Received disconnect from 47.236.104.193 port 48336:11: Bye Bye [preauth]
Sep  7 21:50:16 nativespace-cdp sshd[3397474]: Disconnected from 47.236.104.193 port 48336 [preauth]
Sep  7 21:51:33 nativespace-cdp sshd[3397844]: Connection closed by 159.100.136.21 port 42672 [preauth]
Sep  7 21:56:33 nativespace-cdp sshd[3399248]: Connection closed by 159.100.136.21 port 51846 [preauth]
Sep  7 22:01:33 nativespace-cdp sshd[3400584]: Connection closed by 159.100.136.21 port 32798 [preauth]
Sep  7 22:06:33 nativespace-cdp sshd[3401569]: Connection closed by 159.100.136.21 port 41478 [preauth]
Sep  7 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:34 nativespace-cdp sudo[3402079]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:34 nativespace-cdp sudo[3402083]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:34 nativespace-cdp sudo[3402088]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:34 nativespace-cdp sudo[3402095]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:36 nativespace-cdp sudo[3402101]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 22:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:36 nativespace-cdp sudo[3402110]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 22:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:36 nativespace-cdp sudo[3402115]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 22:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:36 nativespace-cdp sudo[3402119]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 22:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:36 nativespace-cdp sudo[3402124]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 22:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:36 nativespace-cdp sudo[3402129]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 22:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:36 nativespace-cdp sudo[3402135]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:51 nativespace-cdp sudo[3402184]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:51 nativespace-cdp sudo[3402192]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=elecleis user-2=gilpin user-3=milloyco user-4=carsinyo user-5=fetch user-6=putterfi user-7=hubmaster user-8=ianrayne user-9=accooper user-10=thqkgnbz user-11=connectedshoppin user-12=firstres user-13=jonhartl user-14=seftvta user-15=ultbcrra user-16=coursemc user-17=opaiscyx user-18=costestimatorco user-19=clarkass user-20=firstrel user-21=southlon user-22=highlegh user-23=firstred user-24=alexadmin user-25=skyfirec user-26=askhform user-27=stuartge user-28=innovat1 user-29=nativene user-30=brighto1 user-31=nstriton user-32=battlere user-33=oneoarco user-34=firstre2 user-35=vivienn1 user-36=bedfords user-37=bemadonn user-38=ggaaorgu user-39=belle user-40=newstoda user-41=jarvisin user-42=theblack user-43=hodgesonweb user-44=spectrum user-45=still user-46=agproduc user-47=leereyn1
Sep  7 22:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=stephani user-49=foundation user-50=markward user-51=booff user-52=maflemin user-53=lbscrmod user-54=athenare user-55=connect9 user-56=vantagep user-57=ulsukarm user-58=martsblo user-59=ptkxhsbt user-60=dickemery123 user-61=lbhyisi user-62=hhdugcor user-63=magichat user-64=brmrjxl user-65=lakesan1 user-66=sarafoundation user-67=atestord user-68=strathar user-69=wilsonsw user-70=musorguk user-71=megacards user-72=attlebor user-73=lucy user-74=onlycont user-75=branko user-76=ranxterc user-77=outdoorc user-78=hodgsonmail user-79=romaldki user-80=tomandle user-81=jennimil user-82=mcdermos user-83=chrisdal user-84=nbhavers user-85=careers user-86=david user-87=what user-88=oubpgvbx user-89=tstardom user-90=nvihkvu user-91=sketchy user-92=cath user-93=havantho user-94=kategilpin user-95=ladburyp user-96=stagingerris user-97=dancinggardener user-98=design user-99=nove user-100=boldover user-101=sosevalu
Sep  7 22:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=crrtipdl user-103=bakery user-104=burydropin user-105=fawcettd user-106=nsceres user-107=eatspam user-108=darkstar user-109=beauty user-110=dhyana user-111=asandcoc user-112=sibtoncc user-113=zebrapho user-114=bwppodcast user-115=steve user-116=reliable user-117=ninejimm user-118=cathski user-119=cambria1 user-120=howardon user-121=paulmca1 user-122=pugwash user-123=cwsocial user-124=hirefootballgame user-125=courseme user-126=eugincou user-127=health2045 user-128=fortunaz user-129=leftie user-130=foods user-131=putterfc user-132=nscdp user-133=philmcph user-134=ctedorgu user-135=donnychicago user-136=steakbridieme user-137=firstre5 user-138=lkpier user-139=smrszyqg user-140=isleofwi user-141=barbersh user-142=tigerlet user-143=hidden user-144=nomistakes feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  7 22:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:52 nativespace-cdp sudo[3402199]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 22:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:52 nativespace-cdp sudo[3402205]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5T2e2goB2df51GyV.~
Sep  7 22:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:52 nativespace-cdp sudo[3402210]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5T2e2goB2df51GyV.~'
Sep  7 22:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:52 nativespace-cdp sudo[3402214]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5T2e2goB2df51GyV.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 22:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:52 nativespace-cdp sudo[3402220]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 22:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:52 nativespace-cdp sudo[3402225]: pam_unix(sudo:session): session closed for user root
Sep  7 22:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 22:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 22:09:53 nativespace-cdp sudo[3402247]: pam_unix(sudo:session): session closed for user root
Sep  7 22:11:34 nativespace-cdp sshd[3402954]: Connection closed by 159.100.136.21 port 51154 [preauth]
Sep  7 22:16:37 nativespace-cdp sshd[3403958]: Connection closed by 159.100.136.21 port 60856 [preauth]
Sep  7 22:21:33 nativespace-cdp sshd[3404981]: Connection closed by 159.100.136.21 port 41462 [preauth]
Sep  7 22:25:19 nativespace-cdp sshd[3405829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.88.232.183  user=root
Sep  7 22:25:19 nativespace-cdp sshd[3405829]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 22:25:21 nativespace-cdp sshd[3405829]: Failed password for root from 183.88.232.183 port 52250 ssh2
Sep  7 22:25:21 nativespace-cdp sshd[3405829]: Received disconnect from 183.88.232.183 port 52250:11: Bye Bye [preauth]
Sep  7 22:25:21 nativespace-cdp sshd[3405829]: Disconnected from 183.88.232.183 port 52250 [preauth]
Sep  7 22:25:23 nativespace-cdp sshd[3405846]: Invalid user yoshi from 223.136.167.146 port 61929
Sep  7 22:25:23 nativespace-cdp sshd[3405846]: input_userauth_request: invalid user yoshi [preauth]
Sep  7 22:25:24 nativespace-cdp sshd[3405846]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:25:24 nativespace-cdp sshd[3405846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.136.167.146
Sep  7 22:25:26 nativespace-cdp sshd[3405846]: Failed password for invalid user yoshi from 223.136.167.146 port 61929 ssh2
Sep  7 22:25:26 nativespace-cdp sshd[3405846]: Received disconnect from 223.136.167.146 port 61929:11: Bye Bye [preauth]
Sep  7 22:25:26 nativespace-cdp sshd[3405846]: Disconnected from 223.136.167.146 port 61929 [preauth]
Sep  7 22:26:33 nativespace-cdp sshd[3406155]: Connection closed by 159.100.136.21 port 50552 [preauth]
Sep  7 22:27:23 nativespace-cdp sshd[3406362]: Invalid user lyb from 190.147.213.31 port 49890
Sep  7 22:27:23 nativespace-cdp sshd[3406362]: input_userauth_request: invalid user lyb [preauth]
Sep  7 22:27:23 nativespace-cdp sshd[3406362]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:27:23 nativespace-cdp sshd[3406362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.147.213.31
Sep  7 22:27:25 nativespace-cdp sshd[3406362]: Failed password for invalid user lyb from 190.147.213.31 port 49890 ssh2
Sep  7 22:27:25 nativespace-cdp sshd[3406362]: Received disconnect from 190.147.213.31 port 49890:11: Bye Bye [preauth]
Sep  7 22:27:25 nativespace-cdp sshd[3406362]: Disconnected from 190.147.213.31 port 49890 [preauth]
Sep  7 22:27:52 nativespace-cdp sshd[3406431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.76.43.171  user=root
Sep  7 22:27:52 nativespace-cdp sshd[3406431]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 22:27:54 nativespace-cdp sshd[3406431]: Failed password for root from 47.76.43.171 port 43926 ssh2
Sep  7 22:27:58 nativespace-cdp sshd[3406431]: Received disconnect from 47.76.43.171 port 43926:11: Bye Bye [preauth]
Sep  7 22:27:58 nativespace-cdp sshd[3406431]: Disconnected from 47.76.43.171 port 43926 [preauth]
Sep  7 22:29:02 nativespace-cdp sshd[3406648]: Invalid user yoshi from 202.55.175.236 port 50488
Sep  7 22:29:02 nativespace-cdp sshd[3406648]: input_userauth_request: invalid user yoshi [preauth]
Sep  7 22:29:02 nativespace-cdp sshd[3406648]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:29:02 nativespace-cdp sshd[3406648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.55.175.236
Sep  7 22:29:03 nativespace-cdp sshd[3406648]: Failed password for invalid user yoshi from 202.55.175.236 port 50488 ssh2
Sep  7 22:29:05 nativespace-cdp sshd[3406648]: Received disconnect from 202.55.175.236 port 50488:11: Bye Bye [preauth]
Sep  7 22:29:05 nativespace-cdp sshd[3406648]: Disconnected from 202.55.175.236 port 50488 [preauth]
Sep  7 22:31:50 nativespace-cdp sshd[3407359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.88.232.183  user=root
Sep  7 22:31:50 nativespace-cdp sshd[3407359]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 22:31:52 nativespace-cdp sshd[3407359]: Failed password for root from 183.88.232.183 port 46382 ssh2
Sep  7 22:32:00 nativespace-cdp sshd[3407382]: Invalid user bernadette from 190.147.213.31 port 58206
Sep  7 22:32:00 nativespace-cdp sshd[3407382]: input_userauth_request: invalid user bernadette [preauth]
Sep  7 22:32:00 nativespace-cdp sshd[3407382]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:32:00 nativespace-cdp sshd[3407382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.147.213.31
Sep  7 22:32:02 nativespace-cdp sshd[3407382]: Failed password for invalid user bernadette from 190.147.213.31 port 58206 ssh2
Sep  7 22:32:03 nativespace-cdp sshd[3407382]: Received disconnect from 190.147.213.31 port 58206:11: Bye Bye [preauth]
Sep  7 22:32:03 nativespace-cdp sshd[3407382]: Disconnected from 190.147.213.31 port 58206 [preauth]
Sep  7 22:32:19 nativespace-cdp sshd[3407359]: Received disconnect from 183.88.232.183 port 46382:11: Bye Bye [preauth]
Sep  7 22:32:19 nativespace-cdp sshd[3407359]: Disconnected from 183.88.232.183 port 46382 [preauth]
Sep  7 22:32:31 nativespace-cdp sshd[3407484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.55.175.236  user=root
Sep  7 22:32:31 nativespace-cdp sshd[3407484]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 22:32:33 nativespace-cdp sshd[3407484]: Failed password for root from 202.55.175.236 port 51690 ssh2
Sep  7 22:32:34 nativespace-cdp sshd[3407484]: Received disconnect from 202.55.175.236 port 51690:11: Bye Bye [preauth]
Sep  7 22:32:34 nativespace-cdp sshd[3407484]: Disconnected from 202.55.175.236 port 51690 [preauth]
Sep  7 22:32:43 nativespace-cdp sshd[3407525]: Invalid user javier from 183.88.232.183 port 33480
Sep  7 22:32:43 nativespace-cdp sshd[3407525]: input_userauth_request: invalid user javier [preauth]
Sep  7 22:32:43 nativespace-cdp sshd[3407525]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:32:43 nativespace-cdp sshd[3407525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.88.232.183
Sep  7 22:32:45 nativespace-cdp sshd[3407525]: Failed password for invalid user javier from 183.88.232.183 port 33480 ssh2
Sep  7 22:32:45 nativespace-cdp sshd[3407525]: Received disconnect from 183.88.232.183 port 33480:11: Bye Bye [preauth]
Sep  7 22:32:45 nativespace-cdp sshd[3407525]: Disconnected from 183.88.232.183 port 33480 [preauth]
Sep  7 22:32:53 nativespace-cdp sshd[3407584]: Invalid user intro1 from 190.147.213.31 port 42792
Sep  7 22:32:53 nativespace-cdp sshd[3407584]: input_userauth_request: invalid user intro1 [preauth]
Sep  7 22:32:53 nativespace-cdp sshd[3407584]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:32:53 nativespace-cdp sshd[3407584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.147.213.31
Sep  7 22:32:56 nativespace-cdp sshd[3407584]: Failed password for invalid user intro1 from 190.147.213.31 port 42792 ssh2
Sep  7 22:32:56 nativespace-cdp sshd[3407584]: Received disconnect from 190.147.213.31 port 42792:11: Bye Bye [preauth]
Sep  7 22:32:56 nativespace-cdp sshd[3407584]: Disconnected from 190.147.213.31 port 42792 [preauth]
Sep  7 22:33:04 nativespace-cdp sshd[3407641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.76.43.171  user=root
Sep  7 22:33:04 nativespace-cdp sshd[3407641]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 22:33:06 nativespace-cdp sshd[3407641]: Failed password for root from 47.76.43.171 port 45388 ssh2
Sep  7 22:33:07 nativespace-cdp sshd[3407641]: Received disconnect from 47.76.43.171 port 45388:11: Bye Bye [preauth]
Sep  7 22:33:07 nativespace-cdp sshd[3407641]: Disconnected from 47.76.43.171 port 45388 [preauth]
Sep  7 22:33:20 nativespace-cdp sshd[3407681]: Invalid user rustserver from 202.55.175.236 port 36170
Sep  7 22:33:20 nativespace-cdp sshd[3407681]: input_userauth_request: invalid user rustserver [preauth]
Sep  7 22:33:20 nativespace-cdp sshd[3407681]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:33:20 nativespace-cdp sshd[3407681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.55.175.236
Sep  7 22:33:22 nativespace-cdp sshd[3407681]: Failed password for invalid user rustserver from 202.55.175.236 port 36170 ssh2
Sep  7 22:33:22 nativespace-cdp sshd[3407681]: Received disconnect from 202.55.175.236 port 36170:11: Bye Bye [preauth]
Sep  7 22:33:22 nativespace-cdp sshd[3407681]: Disconnected from 202.55.175.236 port 36170 [preauth]
Sep  7 22:33:35 nativespace-cdp sshd[3407721]: Invalid user vaz from 47.76.43.171 port 48434
Sep  7 22:33:35 nativespace-cdp sshd[3407721]: input_userauth_request: invalid user vaz [preauth]
Sep  7 22:33:35 nativespace-cdp sshd[3407721]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:33:35 nativespace-cdp sshd[3407721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.76.43.171
Sep  7 22:33:38 nativespace-cdp sshd[3407721]: Failed password for invalid user vaz from 47.76.43.171 port 48434 ssh2
Sep  7 22:33:38 nativespace-cdp sshd[3407721]: Received disconnect from 47.76.43.171 port 48434:11: Bye Bye [preauth]
Sep  7 22:33:38 nativespace-cdp sshd[3407721]: Disconnected from 47.76.43.171 port 48434 [preauth]
Sep  7 22:36:35 nativespace-cdp sshd[3408558]: Connection closed by 159.100.136.21 port 41836 [preauth]
Sep  7 22:36:39 nativespace-cdp sshd[3408565]: Invalid user flume from 223.136.167.146 port 60556
Sep  7 22:36:39 nativespace-cdp sshd[3408565]: input_userauth_request: invalid user flume [preauth]
Sep  7 22:36:39 nativespace-cdp sshd[3408565]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:36:39 nativespace-cdp sshd[3408565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.136.167.146
Sep  7 22:36:41 nativespace-cdp sshd[3408565]: Failed password for invalid user flume from 223.136.167.146 port 60556 ssh2
Sep  7 22:37:22 nativespace-cdp sshd[3408565]: Received disconnect from 223.136.167.146 port 60556:11: Bye Bye [preauth]
Sep  7 22:37:22 nativespace-cdp sshd[3408565]: Disconnected from 223.136.167.146 port 60556 [preauth]
Sep  7 22:37:57 nativespace-cdp sshd[3408765]: Connection closed by 223.136.167.146 port 62370 [preauth]
Sep  7 22:38:46 nativespace-cdp sshd[3408885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.148.230.108  user=root
Sep  7 22:38:46 nativespace-cdp sshd[3408885]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 22:38:48 nativespace-cdp sshd[3408885]: Failed password for root from 177.148.230.108 port 56820 ssh2
Sep  7 22:38:48 nativespace-cdp sshd[3408885]: Received disconnect from 177.148.230.108 port 56820:11: Bye Bye [preauth]
Sep  7 22:38:48 nativespace-cdp sshd[3408885]: Disconnected from 177.148.230.108 port 56820 [preauth]
Sep  7 22:38:57 nativespace-cdp sshd[3408928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.136.167.146  user=root
Sep  7 22:38:57 nativespace-cdp sshd[3408928]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 22:38:59 nativespace-cdp sshd[3408928]: Failed password for root from 223.136.167.146 port 61576 ssh2
Sep  7 22:41:37 nativespace-cdp sshd[3409746]: Connection closed by 159.100.136.21 port 51288 [preauth]
Sep  7 22:43:47 nativespace-cdp sshd[3410109]: Invalid user lyb from 177.148.230.108 port 48830
Sep  7 22:43:47 nativespace-cdp sshd[3410109]: input_userauth_request: invalid user lyb [preauth]
Sep  7 22:43:47 nativespace-cdp sshd[3410109]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 22:43:47 nativespace-cdp sshd[3410109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.148.230.108
Sep  7 22:43:49 nativespace-cdp sshd[3410109]: Failed password for invalid user lyb from 177.148.230.108 port 48830 ssh2
Sep  7 22:43:53 nativespace-cdp sshd[3410109]: Received disconnect from 177.148.230.108 port 48830:11: Bye Bye [preauth]
Sep  7 22:43:53 nativespace-cdp sshd[3410109]: Disconnected from 177.148.230.108 port 48830 [preauth]
Sep  7 22:45:29 nativespace-cdp sshd[3410482]: Connection closed by 177.148.230.108 port 36696 [preauth]
Sep  7 22:46:36 nativespace-cdp sshd[3410814]: Connection closed by 159.100.136.21 port 60792 [preauth]
Sep  7 22:51:21 nativespace-cdp sshd[3411897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.148.230.108  user=root
Sep  7 22:51:21 nativespace-cdp sshd[3411897]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 22:51:23 nativespace-cdp sshd[3411897]: Failed password for root from 177.148.230.108 port 56512 ssh2
Sep  7 22:51:23 nativespace-cdp sshd[3411897]: Received disconnect from 177.148.230.108 port 56512:11: Bye Bye [preauth]
Sep  7 22:51:23 nativespace-cdp sshd[3411897]: Disconnected from 177.148.230.108 port 56512 [preauth]
Sep  7 22:51:33 nativespace-cdp sshd[3411946]: Connection closed by 159.100.136.21 port 41696 [preauth]
Sep  7 22:56:36 nativespace-cdp sshd[3413123]: Connection closed by 159.100.136.21 port 50810 [preauth]
Sep  7 23:01:33 nativespace-cdp sshd[3414294]: Connection closed by 159.100.136.21 port 59724 [preauth]
Sep  7 23:05:24 nativespace-cdp sshd[3415019]: Bad protocol version identification '\026\003\001' from 47.251.80.203 port 21172
Sep  7 23:05:32 nativespace-cdp sshd[3415022]: Invalid user  from 47.251.80.203 port 21180
Sep  7 23:05:32 nativespace-cdp sshd[3415022]: input_userauth_request: invalid user  [preauth]
Sep  7 23:05:32 nativespace-cdp sshd[3415022]: Connection closed by 47.251.80.203 port 21180 [preauth]
Sep  7 23:06:33 nativespace-cdp sshd[3415324]: Connection closed by 159.100.136.21 port 40868 [preauth]
Sep  7 23:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  7 23:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:34 nativespace-cdp sudo[3415832]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  7 23:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:34 nativespace-cdp sudo[3415837]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  7 23:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:34 nativespace-cdp sudo[3415842]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  7 23:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:34 nativespace-cdp sudo[3415847]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  7 23:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:37 nativespace-cdp sudo[3415853]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  7 23:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:37 nativespace-cdp sudo[3415871]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  7 23:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:37 nativespace-cdp sudo[3415876]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  7 23:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:37 nativespace-cdp sudo[3415881]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  7 23:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:37 nativespace-cdp sudo[3415886]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  7 23:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:37 nativespace-cdp sudo[3415891]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  7 23:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:37 nativespace-cdp sudo[3415898]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  7 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:39 nativespace-cdp sudo[3415908]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  7 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:39 nativespace-cdp sudo[3415914]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=david user-2=careers user-3=nbhavers user-4=mcdermos user-5=chrisdal user-6=jennimil user-7=tomandle user-8=romaldki user-9=branko user-10=outdoorc user-11=hodgsonmail user-12=ranxterc user-13=onlycont user-14=lucy user-15=attlebor user-16=crrtipdl user-17=sosevalu user-18=bakery user-19=boldover user-20=nove user-21=design user-22=kategilpin user-23=dancinggardener user-24=stagingerris user-25=ladburyp user-26=nvihkvu user-27=havantho user-28=cath user-29=sketchy user-30=what user-31=tstardom user-32=oubpgvbx user-33=steve user-34=zebrapho user-35=bwppodcast user-36=sibtoncc user-37=asandcoc user-38=dhyana user-39=darkstar user-40=eatspam user-41=beauty user-42=nsceres user-43=fawcettd user-44=burydropin user-45=tigerlet user-46=barbersh user-47=nomistakes user-48=hidden user-49=isleofwi
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=smrszyqg user-51=steakbridieme user-52=firstre5 user-53=donnychicago user-54=ctedorgu user-55=philmcph user-56=lkpier user-57=leftie user-58=foods user-59=health2045 user-60=fortunaz user-61=nscdp user-62=putterfc user-63=courseme user-64=eugincou user-65=hirefootballgame user-66=cwsocial user-67=howardon user-68=pugwash user-69=paulmca1 user-70=ninejimm user-71=reliable user-72=cambria1 user-73=cathski user-74=highlegh user-75=southlon user-76=firstred user-77=costestimatorco user-78=clarkass user-79=firstrel user-80=coursemc user-81=opaiscyx user-82=firstres user-83=ultbcrra user-84=jonhartl user-85=seftvta user-86=thqkgnbz user-87=connectedshoppin user-88=ianrayne user-89=accooper user-90=fetch user-91=carsinyo user-92=putterfi user-93=hubmaster user-94=elecleis user-95=gilpin user-96=milloyco user-97=bemadonn user-98=newstoda user-99=belle user-100=ggaaorgu user-101=bedfords user-102=oneoarco
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=battlere user-104=vivienn1 user-105=firstre2 user-106=nstriton user-107=brighto1 user-108=nativene user-109=stuartge user-110=askhform user-111=innovat1 user-112=skyfirec user-113=alexadmin user-114=ulsukarm user-115=lbscrmod user-116=maflemin user-117=vantagep user-118=athenare user-119=connect9 user-120=markward user-121=booff user-122=foundation user-123=leereyn1 user-124=stephani user-125=agproduc user-126=still user-127=theblack user-128=hodgesonweb user-129=spectrum user-130=jarvisin user-131=megacards user-132=musorguk user-133=wilsonsw user-134=atestord user-135=sarafoundation user-136=strathar user-137=lakesan1 user-138=brmrjxl user-139=magichat user-140=hhdugcor user-141=lbhyisi user-142=ptkxhsbt user-143=dickemery123 user-144=martsblo feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  7 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:39 nativespace-cdp sudo[3415922]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:39 nativespace-cdp sudo[3415932]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dADHoXBGb4tTUBvi.~
Sep  7 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:39 nativespace-cdp sudo[3415937]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dADHoXBGb4tTUBvi.~'
Sep  7 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:39 nativespace-cdp sudo[3415941]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dADHoXBGb4tTUBvi.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  7 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:39 nativespace-cdp sudo[3415947]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  7 23:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:40 nativespace-cdp sudo[3415952]: pam_unix(sudo:session): session closed for user root
Sep  7 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  7 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  7 23:09:41 nativespace-cdp sudo[3415975]: pam_unix(sudo:session): session closed for user root
Sep  7 23:11:34 nativespace-cdp sshd[3416684]: Connection closed by 159.100.136.21 port 49924 [preauth]
Sep  7 23:16:36 nativespace-cdp sshd[3417692]: Connection closed by 159.100.136.21 port 58854 [preauth]
Sep  7 23:18:47 nativespace-cdp sshd[3418036]: Invalid user miriam from 107.170.241.104 port 60158
Sep  7 23:18:47 nativespace-cdp sshd[3418036]: input_userauth_request: invalid user miriam [preauth]
Sep  7 23:18:47 nativespace-cdp sshd[3418036]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:18:47 nativespace-cdp sshd[3418036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.241.104
Sep  7 23:18:49 nativespace-cdp sshd[3418036]: Failed password for invalid user miriam from 107.170.241.104 port 60158 ssh2
Sep  7 23:18:49 nativespace-cdp sshd[3418036]: Received disconnect from 107.170.241.104 port 60158:11: Bye Bye [preauth]
Sep  7 23:18:49 nativespace-cdp sshd[3418036]: Disconnected from 107.170.241.104 port 60158 [preauth]
Sep  7 23:20:02 nativespace-cdp sshd[3418268]: Invalid user tmax from 68.183.80.132 port 56390
Sep  7 23:20:02 nativespace-cdp sshd[3418268]: input_userauth_request: invalid user tmax [preauth]
Sep  7 23:20:02 nativespace-cdp sshd[3418268]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:20:02 nativespace-cdp sshd[3418268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.80.132
Sep  7 23:20:05 nativespace-cdp sshd[3418268]: Failed password for invalid user tmax from 68.183.80.132 port 56390 ssh2
Sep  7 23:20:06 nativespace-cdp sshd[3418268]: Received disconnect from 68.183.80.132 port 56390:11: Bye Bye [preauth]
Sep  7 23:20:06 nativespace-cdp sshd[3418268]: Disconnected from 68.183.80.132 port 56390 [preauth]
Sep  7 23:21:33 nativespace-cdp sshd[3418651]: Connection closed by 159.100.136.21 port 39662 [preauth]
Sep  7 23:24:18 nativespace-cdp sshd[3419164]: Invalid user padmin from 128.199.30.150 port 49906
Sep  7 23:24:18 nativespace-cdp sshd[3419164]: input_userauth_request: invalid user padmin [preauth]
Sep  7 23:24:18 nativespace-cdp sshd[3419164]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:24:18 nativespace-cdp sshd[3419164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.30.150
Sep  7 23:24:20 nativespace-cdp sshd[3419164]: Failed password for invalid user padmin from 128.199.30.150 port 49906 ssh2
Sep  7 23:24:20 nativespace-cdp sshd[3419164]: Received disconnect from 128.199.30.150 port 49906:11: Bye Bye [preauth]
Sep  7 23:24:20 nativespace-cdp sshd[3419164]: Disconnected from 128.199.30.150 port 49906 [preauth]
Sep  7 23:25:47 nativespace-cdp sshd[3419702]: Invalid user michal from 154.201.91.250 port 53820
Sep  7 23:25:47 nativespace-cdp sshd[3419702]: input_userauth_request: invalid user michal [preauth]
Sep  7 23:25:47 nativespace-cdp sshd[3419702]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:25:47 nativespace-cdp sshd[3419702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.201.91.250
Sep  7 23:25:49 nativespace-cdp sshd[3419702]: Failed password for invalid user michal from 154.201.91.250 port 53820 ssh2
Sep  7 23:25:49 nativespace-cdp sshd[3419702]: Received disconnect from 154.201.91.250 port 53820:11: Bye Bye [preauth]
Sep  7 23:25:49 nativespace-cdp sshd[3419702]: Disconnected from 154.201.91.250 port 53820 [preauth]
Sep  7 23:26:12 nativespace-cdp sshd[3419767]: Invalid user tv from 107.170.241.104 port 59084
Sep  7 23:26:12 nativespace-cdp sshd[3419767]: input_userauth_request: invalid user tv [preauth]
Sep  7 23:26:12 nativespace-cdp sshd[3419767]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:26:12 nativespace-cdp sshd[3419767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.241.104
Sep  7 23:26:13 nativespace-cdp sshd[3419767]: Failed password for invalid user tv from 107.170.241.104 port 59084 ssh2
Sep  7 23:26:13 nativespace-cdp sshd[3419767]: Received disconnect from 107.170.241.104 port 59084:11: Bye Bye [preauth]
Sep  7 23:26:13 nativespace-cdp sshd[3419767]: Disconnected from 107.170.241.104 port 59084 [preauth]
Sep  7 23:26:36 nativespace-cdp sshd[3419860]: Connection closed by 159.100.136.21 port 48160 [preauth]
Sep  7 23:26:46 nativespace-cdp sshd[3419940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.113.18.137  user=root
Sep  7 23:26:46 nativespace-cdp sshd[3419940]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 23:26:48 nativespace-cdp sshd[3419956]: Invalid user aziz from 210.164.66.50 port 50650
Sep  7 23:26:48 nativespace-cdp sshd[3419956]: input_userauth_request: invalid user aziz [preauth]
Sep  7 23:26:48 nativespace-cdp sshd[3419956]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:26:48 nativespace-cdp sshd[3419956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.164.66.50
Sep  7 23:26:48 nativespace-cdp sshd[3419940]: Failed password for root from 138.113.18.137 port 38164 ssh2
Sep  7 23:26:49 nativespace-cdp sshd[3419940]: Received disconnect from 138.113.18.137 port 38164:11: Bye Bye [preauth]
Sep  7 23:26:49 nativespace-cdp sshd[3419940]: Disconnected from 138.113.18.137 port 38164 [preauth]
Sep  7 23:26:50 nativespace-cdp sshd[3419956]: Failed password for invalid user aziz from 210.164.66.50 port 50650 ssh2
Sep  7 23:26:55 nativespace-cdp sshd[3419956]: Received disconnect from 210.164.66.50 port 50650:11: Bye Bye [preauth]
Sep  7 23:26:55 nativespace-cdp sshd[3419956]: Disconnected from 210.164.66.50 port 50650 [preauth]
Sep  7 23:26:57 nativespace-cdp sshd[3419989]: Invalid user backoffice from 92.222.181.7 port 49978
Sep  7 23:26:57 nativespace-cdp sshd[3419989]: input_userauth_request: invalid user backoffice [preauth]
Sep  7 23:26:57 nativespace-cdp sshd[3419989]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:26:57 nativespace-cdp sshd[3419989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.181.7
Sep  7 23:26:58 nativespace-cdp sshd[3419993]: Invalid user nav from 107.170.241.104 port 44138
Sep  7 23:26:58 nativespace-cdp sshd[3419993]: input_userauth_request: invalid user nav [preauth]
Sep  7 23:26:58 nativespace-cdp sshd[3419993]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:26:58 nativespace-cdp sshd[3419993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.241.104
Sep  7 23:26:59 nativespace-cdp sshd[3419989]: Failed password for invalid user backoffice from 92.222.181.7 port 49978 ssh2
Sep  7 23:26:59 nativespace-cdp sshd[3419989]: Received disconnect from 92.222.181.7 port 49978:11: Bye Bye [preauth]
Sep  7 23:26:59 nativespace-cdp sshd[3419989]: Disconnected from 92.222.181.7 port 49978 [preauth]
Sep  7 23:27:00 nativespace-cdp sshd[3419993]: Failed password for invalid user nav from 107.170.241.104 port 44138 ssh2
Sep  7 23:27:27 nativespace-cdp sshd[3420107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.80.132  user=root
Sep  7 23:27:27 nativespace-cdp sshd[3420107]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 23:27:28 nativespace-cdp sshd[3420107]: Failed password for root from 68.183.80.132 port 60762 ssh2
Sep  7 23:27:35 nativespace-cdp sshd[3420107]: Received disconnect from 68.183.80.132 port 60762:11: Bye Bye [preauth]
Sep  7 23:27:35 nativespace-cdp sshd[3420107]: Disconnected from 68.183.80.132 port 60762 [preauth]
Sep  7 23:27:47 nativespace-cdp sshd[3420158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.113.18.137  user=nobody
Sep  7 23:27:47 nativespace-cdp sshd[3420158]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "nobody"
Sep  7 23:27:49 nativespace-cdp sshd[3420158]: Failed password for nobody from 138.113.18.137 port 54406 ssh2
Sep  7 23:27:51 nativespace-cdp sshd[3420158]: Received disconnect from 138.113.18.137 port 54406:11: Bye Bye [preauth]
Sep  7 23:27:51 nativespace-cdp sshd[3420158]: Disconnected from 138.113.18.137 port 54406 [preauth]
Sep  7 23:27:57 nativespace-cdp sshd[3420197]: Invalid user tableau from 128.199.30.150 port 55748
Sep  7 23:27:57 nativespace-cdp sshd[3420197]: input_userauth_request: invalid user tableau [preauth]
Sep  7 23:27:57 nativespace-cdp sshd[3420197]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:27:57 nativespace-cdp sshd[3420197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.30.150
Sep  7 23:27:59 nativespace-cdp sshd[3420197]: Failed password for invalid user tableau from 128.199.30.150 port 55748 ssh2
Sep  7 23:27:59 nativespace-cdp sshd[3420197]: Received disconnect from 128.199.30.150 port 55748:11: Bye Bye [preauth]
Sep  7 23:27:59 nativespace-cdp sshd[3420197]: Disconnected from 128.199.30.150 port 55748 [preauth]
Sep  7 23:28:11 nativespace-cdp sshd[3420230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.80.132  user=root
Sep  7 23:28:11 nativespace-cdp sshd[3420230]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 23:28:14 nativespace-cdp sshd[3420230]: Failed password for root from 68.183.80.132 port 48860 ssh2
Sep  7 23:28:17 nativespace-cdp sshd[3420230]: Received disconnect from 68.183.80.132 port 48860:11: Bye Bye [preauth]
Sep  7 23:28:17 nativespace-cdp sshd[3420230]: Disconnected from 68.183.80.132 port 48860 [preauth]
Sep  7 23:28:36 nativespace-cdp sshd[3420307]: Invalid user tmax from 128.199.30.150 port 49060
Sep  7 23:28:36 nativespace-cdp sshd[3420307]: input_userauth_request: invalid user tmax [preauth]
Sep  7 23:28:36 nativespace-cdp sshd[3420307]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:28:36 nativespace-cdp sshd[3420307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.30.150
Sep  7 23:28:39 nativespace-cdp sshd[3420321]: Invalid user ftptest from 92.222.181.7 port 45044
Sep  7 23:28:39 nativespace-cdp sshd[3420321]: input_userauth_request: invalid user ftptest [preauth]
Sep  7 23:28:39 nativespace-cdp sshd[3420321]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:28:39 nativespace-cdp sshd[3420321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.181.7
Sep  7 23:28:39 nativespace-cdp sshd[3420307]: Failed password for invalid user tmax from 128.199.30.150 port 49060 ssh2
Sep  7 23:28:39 nativespace-cdp sshd[3420307]: Received disconnect from 128.199.30.150 port 49060:11: Bye Bye [preauth]
Sep  7 23:28:39 nativespace-cdp sshd[3420307]: Disconnected from 128.199.30.150 port 49060 [preauth]
Sep  7 23:28:41 nativespace-cdp sshd[3420321]: Failed password for invalid user ftptest from 92.222.181.7 port 45044 ssh2
Sep  7 23:28:43 nativespace-cdp sshd[3420321]: Received disconnect from 92.222.181.7 port 45044:11: Bye Bye [preauth]
Sep  7 23:28:43 nativespace-cdp sshd[3420321]: Disconnected from 92.222.181.7 port 45044 [preauth]
Sep  7 23:28:45 nativespace-cdp sshd[3420323]: Invalid user zhangwei from 138.113.18.137 port 49076
Sep  7 23:28:45 nativespace-cdp sshd[3420323]: input_userauth_request: invalid user zhangwei [preauth]
Sep  7 23:28:45 nativespace-cdp sshd[3420323]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:28:45 nativespace-cdp sshd[3420323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.113.18.137
Sep  7 23:28:47 nativespace-cdp sshd[3420323]: Failed password for invalid user zhangwei from 138.113.18.137 port 49076 ssh2
Sep  7 23:29:19 nativespace-cdp sshd[3420487]: Invalid user family from 92.222.181.7 port 35840
Sep  7 23:29:19 nativespace-cdp sshd[3420487]: input_userauth_request: invalid user family [preauth]
Sep  7 23:29:19 nativespace-cdp sshd[3420487]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:29:19 nativespace-cdp sshd[3420487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.181.7
Sep  7 23:29:20 nativespace-cdp sshd[3420487]: Failed password for invalid user family from 92.222.181.7 port 35840 ssh2
Sep  7 23:29:20 nativespace-cdp sshd[3420487]: Received disconnect from 92.222.181.7 port 35840:11: Bye Bye [preauth]
Sep  7 23:29:20 nativespace-cdp sshd[3420487]: Disconnected from 92.222.181.7 port 35840 [preauth]
Sep  7 23:29:28 nativespace-cdp sshd[3420501]: Invalid user zhangwei from 154.201.91.250 port 56808
Sep  7 23:29:28 nativespace-cdp sshd[3420501]: input_userauth_request: invalid user zhangwei [preauth]
Sep  7 23:29:28 nativespace-cdp sshd[3420501]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:29:28 nativespace-cdp sshd[3420501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.201.91.250
Sep  7 23:29:30 nativespace-cdp sshd[3420501]: Failed password for invalid user zhangwei from 154.201.91.250 port 56808 ssh2
Sep  7 23:29:30 nativespace-cdp sshd[3420501]: Received disconnect from 154.201.91.250 port 56808:11: Bye Bye [preauth]
Sep  7 23:29:30 nativespace-cdp sshd[3420501]: Disconnected from 154.201.91.250 port 56808 [preauth]
Sep  7 23:30:07 nativespace-cdp sshd[3420802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.201.91.250  user=root
Sep  7 23:30:07 nativespace-cdp sshd[3420802]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 23:30:09 nativespace-cdp sshd[3420802]: Failed password for root from 154.201.91.250 port 39978 ssh2
Sep  7 23:30:09 nativespace-cdp sshd[3420802]: Received disconnect from 154.201.91.250 port 39978:11: Bye Bye [preauth]
Sep  7 23:30:09 nativespace-cdp sshd[3420802]: Disconnected from 154.201.91.250 port 39978 [preauth]
Sep  7 23:31:33 nativespace-cdp sshd[3421093]: Connection closed by 159.100.136.21 port 57398 [preauth]
Sep  7 23:34:18 nativespace-cdp sshd[3421595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.164.66.50  user=root
Sep  7 23:34:18 nativespace-cdp sshd[3421595]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  7 23:34:20 nativespace-cdp sshd[3421595]: Failed password for root from 210.164.66.50 port 49280 ssh2
Sep  7 23:34:20 nativespace-cdp sshd[3421595]: Received disconnect from 210.164.66.50 port 49280:11: Bye Bye [preauth]
Sep  7 23:34:20 nativespace-cdp sshd[3421595]: Disconnected from 210.164.66.50 port 49280 [preauth]
Sep  7 23:35:35 nativespace-cdp sshd[3421932]: Invalid user devtest from 210.164.66.50 port 60608
Sep  7 23:35:35 nativespace-cdp sshd[3421932]: input_userauth_request: invalid user devtest [preauth]
Sep  7 23:35:35 nativespace-cdp sshd[3421932]: pam_unix(sshd:auth): check pass; user unknown
Sep  7 23:35:35 nativespace-cdp sshd[3421932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.164.66.50
Sep  7 23:35:37 nativespace-cdp sshd[3421932]: Failed password for invalid user devtest from 210.164.66.50 port 60608 ssh2
Sep  7 23:41:37 nativespace-cdp sshd[3423295]: Connection closed by 159.100.136.21 port 46590 [preauth]
Sep  7 23:46:35 nativespace-cdp sshd[3424380]: Connection closed by 159.100.136.21 port 55912 [preauth]
Sep  7 23:51:35 nativespace-cdp sshd[3425263]: Connection closed by 159.100.136.21 port 36858 [preauth]
Sep  7 23:56:34 nativespace-cdp sshd[3426427]: Connection closed by 159.100.136.21 port 46358 [preauth]
Sep  8 00:01:33 nativespace-cdp sshd[3427601]: Connection closed by 159.100.136.21 port 55500 [preauth]
Sep  8 00:06:35 nativespace-cdp sshd[3428604]: Connection closed by 159.100.136.21 port 37042 [preauth]
Sep  8 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:34 nativespace-cdp sudo[3429197]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:34 nativespace-cdp sudo[3429202]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:35 nativespace-cdp sudo[3429207]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 00:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:35 nativespace-cdp sudo[3429212]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 00:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:36 nativespace-cdp sudo[3429218]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 00:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:36 nativespace-cdp sudo[3429230]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 00:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:36 nativespace-cdp sudo[3429235]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 00:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:36 nativespace-cdp sudo[3429240]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 00:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:36 nativespace-cdp sudo[3429245]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 00:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:36 nativespace-cdp sudo[3429250]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 00:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:36 nativespace-cdp sudo[3429256]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 00:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:37 nativespace-cdp sudo[3429268]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 00:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:38 nativespace-cdp sudo[3429274]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lbhyisi user-2=hhdugcor user-3=magichat user-4=martsblo user-5=dickemery123 user-6=ptkxhsbt user-7=wilsonsw user-8=musorguk user-9=megacards user-10=lakesan1 user-11=brmrjxl user-12=strathar user-13=sarafoundation user-14=atestord user-15=still user-16=agproduc user-17=stephani user-18=leereyn1 user-19=jarvisin user-20=spectrum user-21=theblack user-22=hodgesonweb user-23=ulsukarm user-24=booff user-25=markward user-26=foundation user-27=connect9 user-28=athenare user-29=vantagep user-30=maflemin user-31=lbscrmod user-32=innovat1 user-33=stuartge user-34=askhform user-35=nativene user-36=alexadmin user-37=skyfirec user-38=bedfords user-39=belle user-40=ggaaorgu user-41=newstoda user-42=bemadonn user-43=brighto1 user-44=nstriton user-45=firstre2 user-46=vivienn1 user-47=battlere user-48=oneoarco
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=accooper user-50=ianrayne user-51=connectedshoppin user-52=thqkgnbz user-53=milloyco user-54=gilpin user-55=elecleis user-56=hubmaster user-57=putterfi user-58=carsinyo user-59=fetch user-60=firstrel user-61=clarkass user-62=costestimatorco user-63=firstred user-64=southlon user-65=highlegh user-66=seftvta user-67=jonhartl user-68=ultbcrra user-69=firstres user-70=coursemc user-71=opaiscyx user-72=hirefootballgame user-73=eugincou user-74=courseme user-75=cambria1 user-76=cathski user-77=ninejimm user-78=reliable user-79=howardon user-80=pugwash user-81=paulmca1 user-82=cwsocial user-83=smrszyqg user-84=isleofwi user-85=hidden user-86=nomistakes user-87=tigerlet user-88=barbersh user-89=putterfc user-90=nscdp user-91=health2045 user-92=fortunaz user-93=foods user-94=leftie user-95=lkpier user-96=ctedorgu user-97=philmcph user-98=steakbridieme user-99=firstre5 user-100=donnychicago user-101=beauty
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=eatspam user-103=darkstar user-104=dhyana user-105=burydropin user-106=fawcettd user-107=nsceres user-108=bwppodcast user-109=zebrapho user-110=steve user-111=asandcoc user-112=sibtoncc user-113=ladburyp user-114=stagingerris user-115=dancinggardener user-116=kategilpin user-117=design user-118=oubpgvbx user-119=tstardom user-120=what user-121=cath user-122=sketchy user-123=havantho user-124=nvihkvu user-125=bakery user-126=sosevalu user-127=crrtipdl user-128=nove user-129=boldover user-130=outdoorc user-131=ranxterc user-132=hodgsonmail user-133=branko user-134=romaldki user-135=attlebor user-136=lucy user-137=onlycont user-138=chrisdal user-139=mcdermos user-140=nbhavers user-141=careers user-142=david user-143=tomandle user-144=jennimil feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 00:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:38 nativespace-cdp sudo[3429281]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 00:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:38 nativespace-cdp sudo[3429288]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GMQstlsZlVZQUheN.~
Sep  8 00:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:38 nativespace-cdp sudo[3429293]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GMQstlsZlVZQUheN.~'
Sep  8 00:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:38 nativespace-cdp sudo[3429297]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GMQstlsZlVZQUheN.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 00:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:38 nativespace-cdp sudo[3429303]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 00:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:38 nativespace-cdp sudo[3429309]: pam_unix(sudo:session): session closed for user root
Sep  8 00:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 00:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 00:09:53 nativespace-cdp sudo[3429365]: pam_unix(sudo:session): session closed for user root
Sep  8 00:11:37 nativespace-cdp sshd[3430066]: Connection closed by 159.100.136.21 port 46232 [preauth]
Sep  8 00:16:37 nativespace-cdp sshd[3431052]: Connection closed by 159.100.136.21 port 55624 [preauth]
Sep  8 00:21:35 nativespace-cdp sshd[3432010]: Connection closed by 159.100.136.21 port 36350 [preauth]
Sep  8 00:26:33 nativespace-cdp sshd[3433122]: Connection closed by 159.100.136.21 port 46170 [preauth]
Sep  8 00:31:37 nativespace-cdp sshd[3434106]: Connection closed by 159.100.136.21 port 55408 [preauth]
Sep  8 00:36:33 nativespace-cdp sshd[3435085]: Connection closed by 159.100.136.21 port 35914 [preauth]
Sep  8 00:41:36 nativespace-cdp sshd[3436168]: Connection closed by 159.100.136.21 port 45100 [preauth]
Sep  8 00:46:33 nativespace-cdp sshd[3437308]: Connection closed by 159.100.136.21 port 54738 [preauth]
Sep  8 00:51:33 nativespace-cdp sshd[3438240]: Connection closed by 159.100.136.21 port 35574 [preauth]
Sep  8 00:56:33 nativespace-cdp sshd[3439473]: Connection closed by 159.100.136.21 port 45236 [preauth]
Sep  8 01:01:34 nativespace-cdp sshd[3440674]: Connection closed by 159.100.136.21 port 54982 [preauth]
Sep  8 01:06:33 nativespace-cdp sshd[3441725]: Connection closed by 159.100.136.21 port 36892 [preauth]
Sep  8 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:34 nativespace-cdp sudo[3442287]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:34 nativespace-cdp sudo[3442290]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:34 nativespace-cdp sudo[3442293]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:34 nativespace-cdp sudo[3442296]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:35 nativespace-cdp sudo[3442300]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 01:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:36 nativespace-cdp sudo[3442307]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 01:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:36 nativespace-cdp sudo[3442310]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 01:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:36 nativespace-cdp sudo[3442313]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 01:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:36 nativespace-cdp sudo[3442318]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 01:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:36 nativespace-cdp sudo[3442321]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 01:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:36 nativespace-cdp sudo[3442324]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 01:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:37 nativespace-cdp sudo[3442337]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 01:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:37 nativespace-cdp sudo[3442341]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=elecleis user-2=milloyco user-3=gilpin user-4=fetch user-5=carsinyo user-6=putterfi user-7=hubmaster user-8=ianrayne user-9=accooper user-10=thqkgnbz user-11=connectedshoppin user-12=firstres user-13=ultbcrra user-14=seftvta user-15=jonhartl user-16=coursemc user-17=opaiscyx user-18=costestimatorco user-19=clarkass user-20=firstrel user-21=highlegh user-22=southlon user-23=firstred user-24=alexadmin user-25=skyfirec user-26=stuartge user-27=askhform user-28=innovat1 user-29=nativene user-30=nstriton user-31=brighto1 user-32=oneoarco user-33=battlere user-34=vivienn1 user-35=firstre2 user-36=bedfords user-37=bemadonn user-38=newstoda user-39=ggaaorgu user-40=belle user-41=jarvisin user-42=hodgesonweb user-43=theblack user-44=spectrum user-45=agproduc user-46=still user-47=leereyn1
Sep  8 01:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=stephani user-49=foundation user-50=booff user-51=markward user-52=lbscrmod user-53=maflemin user-54=vantagep user-55=athenare user-56=connect9 user-57=ulsukarm user-58=martsblo user-59=ptkxhsbt user-60=dickemery123 user-61=hhdugcor user-62=lbhyisi user-63=magichat user-64=brmrjxl user-65=lakesan1 user-66=atestord user-67=sarafoundation user-68=strathar user-69=wilsonsw user-70=megacards user-71=musorguk user-72=lucy user-73=attlebor user-74=onlycont user-75=branko user-76=ranxterc user-77=outdoorc user-78=hodgsonmail user-79=romaldki user-80=tomandle user-81=jennimil user-82=mcdermos user-83=chrisdal user-84=david user-85=nbhavers user-86=careers user-87=what user-88=oubpgvbx user-89=tstardom user-90=nvihkvu user-91=havantho user-92=cath user-93=sketchy user-94=kategilpin user-95=dancinggardener user-96=stagingerris user-97=ladburyp user-98=design user-99=nove user-100=boldover user-101=crrtipdl
Sep  8 01:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sosevalu user-103=bakery user-104=fawcettd user-105=burydropin user-106=nsceres user-107=darkstar user-108=eatspam user-109=beauty user-110=dhyana user-111=asandcoc user-112=sibtoncc user-113=zebrapho user-114=bwppodcast user-115=steve user-116=ninejimm user-117=reliable user-118=cambria1 user-119=cathski user-120=cwsocial user-121=pugwash user-122=howardon user-123=paulmca1 user-124=hirefootballgame user-125=courseme user-126=eugincou user-127=leftie user-128=foods user-129=fortunaz user-130=health2045 user-131=nscdp user-132=putterfc user-133=steakbridieme user-134=firstre5 user-135=donnychicago user-136=ctedorgu user-137=philmcph user-138=lkpier user-139=smrszyqg user-140=isleofwi user-141=barbersh user-142=tigerlet user-143=nomistakes user-144=hidden feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  8 01:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 01:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:38 nativespace-cdp sudo[3442346]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 01:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:38 nativespace-cdp sudo[3442351]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4hvwfRRyoTpNx1Or.~
Sep  8 01:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:38 nativespace-cdp sudo[3442354]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4hvwfRRyoTpNx1Or.~'
Sep  8 01:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:38 nativespace-cdp sudo[3442357]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4hvwfRRyoTpNx1Or.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 01:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:38 nativespace-cdp sudo[3442361]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 01:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:38 nativespace-cdp sudo[3442364]: pam_unix(sudo:session): session closed for user root
Sep  8 01:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 01:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 01:09:45 nativespace-cdp sudo[3442398]: pam_unix(sudo:session): session closed for user root
Sep  8 01:11:34 nativespace-cdp sshd[3442800]: Connection closed by 159.100.136.21 port 46640 [preauth]
Sep  8 01:16:34 nativespace-cdp sshd[3444276]: Connection closed by 159.100.136.21 port 55910 [preauth]
Sep  8 01:21:36 nativespace-cdp sshd[3445325]: Connection closed by 159.100.136.21 port 36904 [preauth]
Sep  8 01:24:12 nativespace-cdp sshd[3445797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.247.10.82  user=root
Sep  8 01:24:12 nativespace-cdp sshd[3445797]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 01:24:14 nativespace-cdp sshd[3445797]: Failed password for root from 180.247.10.82 port 42970 ssh2
Sep  8 01:24:34 nativespace-cdp sshd[3445797]: Received disconnect from 180.247.10.82 port 42970:11: Bye Bye [preauth]
Sep  8 01:24:34 nativespace-cdp sshd[3445797]: Disconnected from 180.247.10.82 port 42970 [preauth]
Sep  8 01:26:33 nativespace-cdp sshd[3446504]: Connection closed by 159.100.136.21 port 45672 [preauth]
Sep  8 01:31:32 nativespace-cdp sshd[3447513]: Connection closed by 180.247.10.82 port 36094 [preauth]
Sep  8 01:31:33 nativespace-cdp sshd[3447521]: Connection closed by 159.100.136.21 port 54728 [preauth]
Sep  8 01:32:22 nativespace-cdp sshd[3447632]: Invalid user webdev from 180.247.10.82 port 41068
Sep  8 01:32:22 nativespace-cdp sshd[3447632]: input_userauth_request: invalid user webdev [preauth]
Sep  8 01:32:22 nativespace-cdp sshd[3447632]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 01:32:22 nativespace-cdp sshd[3447632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.247.10.82
Sep  8 01:32:23 nativespace-cdp sshd[3447632]: Failed password for invalid user webdev from 180.247.10.82 port 41068 ssh2
Sep  8 01:32:24 nativespace-cdp sshd[3447632]: Received disconnect from 180.247.10.82 port 41068:11: Bye Bye [preauth]
Sep  8 01:32:24 nativespace-cdp sshd[3447632]: Disconnected from 180.247.10.82 port 41068 [preauth]
Sep  8 01:33:12 nativespace-cdp sshd[3447833]: Invalid user chirag from 180.247.10.82 port 60080
Sep  8 01:33:12 nativespace-cdp sshd[3447833]: input_userauth_request: invalid user chirag [preauth]
Sep  8 01:33:12 nativespace-cdp sshd[3447833]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 01:33:12 nativespace-cdp sshd[3447833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.247.10.82
Sep  8 01:33:14 nativespace-cdp sshd[3447833]: Failed password for invalid user chirag from 180.247.10.82 port 60080 ssh2
Sep  8 01:33:14 nativespace-cdp sshd[3447833]: Received disconnect from 180.247.10.82 port 60080:11: Bye Bye [preauth]
Sep  8 01:33:14 nativespace-cdp sshd[3447833]: Disconnected from 180.247.10.82 port 60080 [preauth]
Sep  8 01:36:36 nativespace-cdp sshd[3448474]: Connection closed by 159.100.136.21 port 34988 [preauth]
Sep  8 01:41:33 nativespace-cdp sshd[3449559]: Connection closed by 159.100.136.21 port 44134 [preauth]
Sep  8 01:46:33 nativespace-cdp sshd[3450656]: Connection closed by 159.100.136.21 port 53710 [preauth]
Sep  8 01:51:36 nativespace-cdp sshd[3451697]: Connection closed by 159.100.136.21 port 34958 [preauth]
Sep  8 01:53:08 nativespace-cdp sshd[3451990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.110.238.50  user=root
Sep  8 01:53:08 nativespace-cdp sshd[3451990]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 01:53:10 nativespace-cdp sshd[3451990]: Failed password for root from 187.110.238.50 port 54946 ssh2
Sep  8 01:53:13 nativespace-cdp sshd[3451990]: Received disconnect from 187.110.238.50 port 54946:11: Bye Bye [preauth]
Sep  8 01:53:13 nativespace-cdp sshd[3451990]: Disconnected from 187.110.238.50 port 54946 [preauth]
Sep  8 01:54:33 nativespace-cdp sshd[3452190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.218.225.78  user=root
Sep  8 01:54:33 nativespace-cdp sshd[3452190]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 01:54:35 nativespace-cdp sshd[3452190]: Failed password for root from 202.218.225.78 port 60005 ssh2
Sep  8 01:54:39 nativespace-cdp sshd[3452190]: Received disconnect from 202.218.225.78 port 60005:11: Bye Bye [preauth]
Sep  8 01:54:39 nativespace-cdp sshd[3452190]: Disconnected from 202.218.225.78 port 60005 [preauth]
Sep  8 01:56:10 nativespace-cdp sshd[3452782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.213.238.91  user=root
Sep  8 01:56:10 nativespace-cdp sshd[3452782]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 01:56:12 nativespace-cdp sshd[3452782]: Failed password for root from 103.213.238.91 port 51988 ssh2
Sep  8 01:56:12 nativespace-cdp sshd[3452782]: Received disconnect from 103.213.238.91 port 51988:11: Bye Bye [preauth]
Sep  8 01:56:12 nativespace-cdp sshd[3452782]: Disconnected from 103.213.238.91 port 51988 [preauth]
Sep  8 01:56:22 nativespace-cdp sshd[3452829]: Invalid user robert from 188.166.217.179 port 33742
Sep  8 01:56:22 nativespace-cdp sshd[3452829]: input_userauth_request: invalid user robert [preauth]
Sep  8 01:56:22 nativespace-cdp sshd[3452829]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 01:56:22 nativespace-cdp sshd[3452829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.217.179
Sep  8 01:56:24 nativespace-cdp sshd[3452829]: Failed password for invalid user robert from 188.166.217.179 port 33742 ssh2
Sep  8 01:56:25 nativespace-cdp sshd[3452829]: Received disconnect from 188.166.217.179 port 33742:11: Bye Bye [preauth]
Sep  8 01:56:25 nativespace-cdp sshd[3452829]: Disconnected from 188.166.217.179 port 33742 [preauth]
Sep  8 01:56:32 nativespace-cdp sshd[3452849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.184.119.22  user=root
Sep  8 01:56:32 nativespace-cdp sshd[3452849]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 01:56:33 nativespace-cdp sshd[3452859]: Connection closed by 159.100.136.21 port 44756 [preauth]
Sep  8 01:56:34 nativespace-cdp sshd[3452849]: Failed password for root from 112.184.119.22 port 34512 ssh2
Sep  8 01:56:34 nativespace-cdp sshd[3452849]: Received disconnect from 112.184.119.22 port 34512:11: Bye Bye [preauth]
Sep  8 01:56:34 nativespace-cdp sshd[3452849]: Disconnected from 112.184.119.22 port 34512 [preauth]
Sep  8 01:56:44 nativespace-cdp sshd[3452882]: Invalid user radix from 187.62.88.136 port 60332
Sep  8 01:56:44 nativespace-cdp sshd[3452882]: input_userauth_request: invalid user radix [preauth]
Sep  8 01:56:44 nativespace-cdp sshd[3452882]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 01:56:44 nativespace-cdp sshd[3452882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.62.88.136
Sep  8 01:56:46 nativespace-cdp sshd[3452882]: Failed password for invalid user radix from 187.62.88.136 port 60332 ssh2
Sep  8 01:56:50 nativespace-cdp sshd[3452882]: Received disconnect from 187.62.88.136 port 60332:11: Bye Bye [preauth]
Sep  8 01:56:50 nativespace-cdp sshd[3452882]: Disconnected from 187.62.88.136 port 60332 [preauth]
Sep  8 01:57:42 nativespace-cdp sshd[3453067]: Invalid user test from 51.195.118.78 port 42584
Sep  8 01:57:42 nativespace-cdp sshd[3453067]: input_userauth_request: invalid user test [preauth]
Sep  8 01:57:42 nativespace-cdp sshd[3453067]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 01:57:42 nativespace-cdp sshd[3453067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.118.78
Sep  8 01:57:44 nativespace-cdp sshd[3453067]: Failed password for invalid user test from 51.195.118.78 port 42584 ssh2
Sep  8 01:57:44 nativespace-cdp sshd[3453067]: Received disconnect from 51.195.118.78 port 42584:11: Bye Bye [preauth]
Sep  8 01:57:44 nativespace-cdp sshd[3453067]: Disconnected from 51.195.118.78 port 42584 [preauth]
Sep  8 01:59:15 nativespace-cdp sshd[3453354]: Invalid user jorge from 103.213.238.91 port 48620
Sep  8 01:59:15 nativespace-cdp sshd[3453354]: input_userauth_request: invalid user jorge [preauth]
Sep  8 01:59:15 nativespace-cdp sshd[3453354]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 01:59:15 nativespace-cdp sshd[3453354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.213.238.91
Sep  8 01:59:17 nativespace-cdp sshd[3453354]: Failed password for invalid user jorge from 103.213.238.91 port 48620 ssh2
Sep  8 01:59:20 nativespace-cdp sshd[3453354]: Received disconnect from 103.213.238.91 port 48620:11: Bye Bye [preauth]
Sep  8 01:59:20 nativespace-cdp sshd[3453354]: Disconnected from 103.213.238.91 port 48620 [preauth]
Sep  8 02:00:00 nativespace-cdp sshd[3453459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.213.238.91  user=root
Sep  8 02:00:00 nativespace-cdp sshd[3453459]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:00:02 nativespace-cdp sshd[3453459]: Failed password for root from 103.213.238.91 port 59008 ssh2
Sep  8 02:00:06 nativespace-cdp sshd[3453459]: Received disconnect from 103.213.238.91 port 59008:11: Bye Bye [preauth]
Sep  8 02:00:06 nativespace-cdp sshd[3453459]: Disconnected from 103.213.238.91 port 59008 [preauth]
Sep  8 02:00:37 nativespace-cdp sshd[3453802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.184.119.22  user=root
Sep  8 02:00:37 nativespace-cdp sshd[3453802]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:00:37 nativespace-cdp sshd[3453805]: Invalid user rune from 103.245.236.208 port 56612
Sep  8 02:00:37 nativespace-cdp sshd[3453805]: input_userauth_request: invalid user rune [preauth]
Sep  8 02:00:37 nativespace-cdp sshd[3453805]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:00:37 nativespace-cdp sshd[3453805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.236.208
Sep  8 02:00:39 nativespace-cdp sshd[3453802]: Failed password for root from 112.184.119.22 port 50861 ssh2
Sep  8 02:00:40 nativespace-cdp sshd[3453802]: Received disconnect from 112.184.119.22 port 50861:11: Bye Bye [preauth]
Sep  8 02:00:40 nativespace-cdp sshd[3453802]: Disconnected from 112.184.119.22 port 50861 [preauth]
Sep  8 02:00:40 nativespace-cdp sshd[3453805]: Failed password for invalid user rune from 103.245.236.208 port 56612 ssh2
Sep  8 02:00:40 nativespace-cdp sshd[3453805]: Received disconnect from 103.245.236.208 port 56612:11: Bye Bye [preauth]
Sep  8 02:00:40 nativespace-cdp sshd[3453805]: Disconnected from 103.245.236.208 port 56612 [preauth]
Sep  8 02:00:51 nativespace-cdp sshd[3453833]: Invalid user jorge from 188.166.217.179 port 45448
Sep  8 02:00:51 nativespace-cdp sshd[3453833]: input_userauth_request: invalid user jorge [preauth]
Sep  8 02:00:51 nativespace-cdp sshd[3453833]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:00:51 nativespace-cdp sshd[3453833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.217.179
Sep  8 02:00:53 nativespace-cdp sshd[3453833]: Failed password for invalid user jorge from 188.166.217.179 port 45448 ssh2
Sep  8 02:00:53 nativespace-cdp sshd[3453833]: Received disconnect from 188.166.217.179 port 45448:11: Bye Bye [preauth]
Sep  8 02:00:53 nativespace-cdp sshd[3453833]: Disconnected from 188.166.217.179 port 45448 [preauth]
Sep  8 02:00:58 nativespace-cdp sshd[3453847]: Invalid user valli from 202.218.225.78 port 50874
Sep  8 02:00:58 nativespace-cdp sshd[3453847]: input_userauth_request: invalid user valli [preauth]
Sep  8 02:00:58 nativespace-cdp sshd[3453847]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:00:58 nativespace-cdp sshd[3453847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.218.225.78
Sep  8 02:01:00 nativespace-cdp sshd[3453847]: Failed password for invalid user valli from 202.218.225.78 port 50874 ssh2
Sep  8 02:01:01 nativespace-cdp sshd[3453847]: Received disconnect from 202.218.225.78 port 50874:11: Bye Bye [preauth]
Sep  8 02:01:01 nativespace-cdp sshd[3453847]: Disconnected from 202.218.225.78 port 50874 [preauth]
Sep  8 02:01:06 nativespace-cdp sshd[3453886]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.118.78  user=root
Sep  8 02:01:06 nativespace-cdp sshd[3453886]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:01:08 nativespace-cdp sshd[3453893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.110.238.50  user=root
Sep  8 02:01:08 nativespace-cdp sshd[3453893]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:01:08 nativespace-cdp sshd[3453886]: Failed password for root from 51.195.118.78 port 58576 ssh2
Sep  8 02:01:08 nativespace-cdp sshd[3453886]: Received disconnect from 51.195.118.78 port 58576:11: Bye Bye [preauth]
Sep  8 02:01:08 nativespace-cdp sshd[3453886]: Disconnected from 51.195.118.78 port 58576 [preauth]
Sep  8 02:01:11 nativespace-cdp sshd[3453893]: Failed password for root from 187.110.238.50 port 55760 ssh2
Sep  8 02:01:11 nativespace-cdp sshd[3453900]: Invalid user keycloak from 187.62.88.136 port 35526
Sep  8 02:01:11 nativespace-cdp sshd[3453900]: input_userauth_request: invalid user keycloak [preauth]
Sep  8 02:01:11 nativespace-cdp sshd[3453900]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:01:11 nativespace-cdp sshd[3453900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.62.88.136
Sep  8 02:01:11 nativespace-cdp sshd[3453893]: Received disconnect from 187.110.238.50 port 55760:11: Bye Bye [preauth]
Sep  8 02:01:11 nativespace-cdp sshd[3453893]: Disconnected from 187.110.238.50 port 55760 [preauth]
Sep  8 02:01:12 nativespace-cdp sshd[3453900]: Failed password for invalid user keycloak from 187.62.88.136 port 35526 ssh2
Sep  8 02:01:12 nativespace-cdp sshd[3453900]: Received disconnect from 187.62.88.136 port 35526:11: Bye Bye [preauth]
Sep  8 02:01:12 nativespace-cdp sshd[3453900]: Disconnected from 187.62.88.136 port 35526 [preauth]
Sep  8 02:01:22 nativespace-cdp sshd[3453953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.184.119.22  user=root
Sep  8 02:01:22 nativespace-cdp sshd[3453953]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:01:24 nativespace-cdp sshd[3453953]: Failed password for root from 112.184.119.22 port 57022 ssh2
Sep  8 02:01:25 nativespace-cdp sshd[3453953]: Received disconnect from 112.184.119.22 port 57022:11: Bye Bye [preauth]
Sep  8 02:01:25 nativespace-cdp sshd[3453953]: Disconnected from 112.184.119.22 port 57022 [preauth]
Sep  8 02:01:33 nativespace-cdp sshd[3454015]: Connection closed by 159.100.136.21 port 53720 [preauth]
Sep  8 02:01:42 nativespace-cdp sshd[3454048]: Invalid user database from 51.195.118.78 port 36956
Sep  8 02:01:42 nativespace-cdp sshd[3454048]: input_userauth_request: invalid user database [preauth]
Sep  8 02:01:42 nativespace-cdp sshd[3454048]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:01:42 nativespace-cdp sshd[3454048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.118.78
Sep  8 02:01:44 nativespace-cdp sshd[3454048]: Failed password for invalid user database from 51.195.118.78 port 36956 ssh2
Sep  8 02:01:44 nativespace-cdp sshd[3454048]: Received disconnect from 51.195.118.78 port 36956:11: Bye Bye [preauth]
Sep  8 02:01:44 nativespace-cdp sshd[3454048]: Disconnected from 51.195.118.78 port 36956 [preauth]
Sep  8 02:01:45 nativespace-cdp sshd[3454054]: Invalid user dokku from 188.166.217.179 port 55862
Sep  8 02:01:45 nativespace-cdp sshd[3454054]: input_userauth_request: invalid user dokku [preauth]
Sep  8 02:01:45 nativespace-cdp sshd[3454054]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:01:45 nativespace-cdp sshd[3454054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.217.179
Sep  8 02:01:47 nativespace-cdp sshd[3454054]: Failed password for invalid user dokku from 188.166.217.179 port 55862 ssh2
Sep  8 02:01:47 nativespace-cdp sshd[3454098]: Invalid user osboxes from 202.218.225.78 port 63508
Sep  8 02:01:47 nativespace-cdp sshd[3454098]: input_userauth_request: invalid user osboxes [preauth]
Sep  8 02:01:47 nativespace-cdp sshd[3454098]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:01:47 nativespace-cdp sshd[3454098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.218.225.78
Sep  8 02:01:49 nativespace-cdp sshd[3454098]: Failed password for invalid user osboxes from 202.218.225.78 port 63508 ssh2
Sep  8 02:01:52 nativespace-cdp sshd[3454098]: Received disconnect from 202.218.225.78 port 63508:11: Bye Bye [preauth]
Sep  8 02:01:52 nativespace-cdp sshd[3454098]: Disconnected from 202.218.225.78 port 63508 [preauth]
Sep  8 02:02:02 nativespace-cdp sshd[3454142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.236.208  user=root
Sep  8 02:02:02 nativespace-cdp sshd[3454142]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:02:02 nativespace-cdp sshd[3454166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.110.238.50  user=root
Sep  8 02:02:02 nativespace-cdp sshd[3454166]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:02:04 nativespace-cdp sshd[3454176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.62.88.136  user=root
Sep  8 02:02:04 nativespace-cdp sshd[3454176]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:02:05 nativespace-cdp sshd[3454142]: Failed password for root from 103.245.236.208 port 56688 ssh2
Sep  8 02:02:05 nativespace-cdp sshd[3454166]: Failed password for root from 187.110.238.50 port 40632 ssh2
Sep  8 02:02:05 nativespace-cdp sshd[3454142]: Received disconnect from 103.245.236.208 port 56688:11: Bye Bye [preauth]
Sep  8 02:02:05 nativespace-cdp sshd[3454142]: Disconnected from 103.245.236.208 port 56688 [preauth]
Sep  8 02:02:05 nativespace-cdp sshd[3454166]: Received disconnect from 187.110.238.50 port 40632:11: Bye Bye [preauth]
Sep  8 02:02:05 nativespace-cdp sshd[3454166]: Disconnected from 187.110.238.50 port 40632 [preauth]
Sep  8 02:02:06 nativespace-cdp sshd[3454176]: Failed password for root from 187.62.88.136 port 52110 ssh2
Sep  8 02:02:06 nativespace-cdp sshd[3454176]: Received disconnect from 187.62.88.136 port 52110:11: Bye Bye [preauth]
Sep  8 02:02:06 nativespace-cdp sshd[3454176]: Disconnected from 187.62.88.136 port 52110 [preauth]
Sep  8 02:02:55 nativespace-cdp sshd[3454350]: Invalid user jorge from 103.245.236.208 port 56738
Sep  8 02:02:55 nativespace-cdp sshd[3454350]: input_userauth_request: invalid user jorge [preauth]
Sep  8 02:02:55 nativespace-cdp sshd[3454350]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:02:55 nativespace-cdp sshd[3454350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.236.208
Sep  8 02:02:57 nativespace-cdp sshd[3454350]: Failed password for invalid user jorge from 103.245.236.208 port 56738 ssh2
Sep  8 02:06:33 nativespace-cdp sshd[3455170]: Connection closed by 159.100.136.21 port 35128 [preauth]
Sep  8 02:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 02:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:36 nativespace-cdp sudo[3455715]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 02:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:36 nativespace-cdp sudo[3455718]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 02:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:37 nativespace-cdp sudo[3455721]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 02:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:37 nativespace-cdp sudo[3455729]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 02:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:38 nativespace-cdp sudo[3455733]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 02:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:38 nativespace-cdp sudo[3455746]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 02:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:38 nativespace-cdp sudo[3455749]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 02:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:38 nativespace-cdp sudo[3455752]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 02:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:39 nativespace-cdp sudo[3455755]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 02:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:39 nativespace-cdp sudo[3455758]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 02:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:39 nativespace-cdp sudo[3455761]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 02:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:55 nativespace-cdp sudo[3455804]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:55 nativespace-cdp sudo[3455808]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lkpier user-2=ctedorgu user-3=philmcph user-4=firstre5 user-5=donnychicago user-6=steakbridieme user-7=putterfc user-8=nscdp user-9=fortunaz user-10=health2045 user-11=foods user-12=leftie user-13=hidden user-14=nomistakes user-15=tigerlet user-16=barbersh user-17=isleofwi user-18=smrszyqg user-19=howardon user-20=pugwash user-21=paulmca1 user-22=cwsocial user-23=cambria1 user-24=cathski user-25=ninejimm user-26=reliable user-27=eugincou user-28=courseme user-29=hirefootballgame user-30=sibtoncc user-31=asandcoc user-32=steve user-33=bwppodcast user-34=zebrapho user-35=nsceres user-36=burydropin user-37=fawcettd user-38=dhyana user-39=beauty user-40=eatspam user-41=darkstar user-42=boldover user-43=nove user-44=bakery user-45=sosevalu user-46=crrtipdl user-47=sketchy user-48=cath
Sep  8 02:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=havantho user-50=nvihkvu user-51=tstardom user-52=oubpgvbx user-53=what user-54=design user-55=ladburyp user-56=stagingerris user-57=dancinggardener user-58=kategilpin user-59=jennimil user-60=tomandle user-61=nbhavers user-62=careers user-63=david user-64=chrisdal user-65=mcdermos user-66=onlycont user-67=attlebor user-68=lucy user-69=romaldki user-70=ranxterc user-71=outdoorc user-72=hodgsonmail user-73=branko user-74=strathar user-75=sarafoundation user-76=atestord user-77=brmrjxl user-78=lakesan1 user-79=musorguk user-80=megacards user-81=wilsonsw user-82=dickemery123 user-83=ptkxhsbt user-84=martsblo user-85=magichat user-86=lbhyisi user-87=hhdugcor user-88=connect9 user-89=athenare user-90=vantagep user-91=maflemin user-92=lbscrmod user-93=markward user-94=foundation user-95=booff user-96=ulsukarm user-97=spectrum user-98=theblack user-99=hodgesonweb user-100=jarvisin user-101=stephani
Sep  8 02:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=leereyn1 user-103=still user-104=agproduc user-105=firstre2 user-106=vivienn1 user-107=battlere user-108=oneoarco user-109=brighto1 user-110=nstriton user-111=ggaaorgu user-112=belle user-113=newstoda user-114=bemadonn user-115=bedfords user-116=alexadmin user-117=skyfirec user-118=nativene user-119=innovat1 user-120=stuartge user-121=askhform user-122=opaiscyx user-123=coursemc user-124=seftvta user-125=jonhartl user-126=ultbcrra user-127=firstres user-128=firstred user-129=southlon user-130=highlegh user-131=clarkass user-132=firstrel user-133=costestimatorco user-134=hubmaster user-135=putterfi user-136=carsinyo user-137=fetch user-138=gilpin user-139=milloyco user-140=elecleis user-141=connectedshoppin user-142=thqkgnbz user-143=accooper user-144=ianrayne feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  8 02:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:56 nativespace-cdp sudo[3455813]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:56 nativespace-cdp sudo[3455818]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2xHll65cdKkmC7Cg.~
Sep  8 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:56 nativespace-cdp sudo[3455821]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2xHll65cdKkmC7Cg.~'
Sep  8 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:56 nativespace-cdp sudo[3455824]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2xHll65cdKkmC7Cg.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:56 nativespace-cdp sudo[3455829]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:56 nativespace-cdp sudo[3455832]: pam_unix(sudo:session): session closed for user root
Sep  8 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 02:09:57 nativespace-cdp sudo[3455856]: pam_unix(sudo:session): session closed for user root
Sep  8 02:11:33 nativespace-cdp sshd[3456347]: Connection closed by 159.100.136.21 port 43734 [preauth]
Sep  8 02:16:33 nativespace-cdp sshd[3457766]: Connection closed by 159.100.136.21 port 53288 [preauth]
Sep  8 02:21:34 nativespace-cdp sshd[3458974]: Connection closed by 159.100.136.21 port 33458 [preauth]
Sep  8 02:26:35 nativespace-cdp sshd[3460332]: Connection closed by 159.100.136.21 port 43070 [preauth]
Sep  8 02:31:33 nativespace-cdp sshd[3461442]: Connection closed by 159.100.136.21 port 52268 [preauth]
Sep  8 02:35:27 nativespace-cdp sshd[3462406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.213.29  user=root
Sep  8 02:35:27 nativespace-cdp sshd[3462406]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:35:28 nativespace-cdp sshd[3462406]: Failed password for root from 161.35.213.29 port 38720 ssh2
Sep  8 02:35:28 nativespace-cdp sshd[3462406]: Received disconnect from 161.35.213.29 port 38720:11: Bye Bye [preauth]
Sep  8 02:35:28 nativespace-cdp sshd[3462406]: Disconnected from 161.35.213.29 port 38720 [preauth]
Sep  8 02:36:33 nativespace-cdp sshd[3462685]: Connection closed by 159.100.136.21 port 33176 [preauth]
Sep  8 02:37:20 nativespace-cdp sshd[3462819]: Invalid user ossuser from 52.187.9.8 port 54070
Sep  8 02:37:20 nativespace-cdp sshd[3462819]: input_userauth_request: invalid user ossuser [preauth]
Sep  8 02:37:20 nativespace-cdp sshd[3462819]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:37:20 nativespace-cdp sshd[3462819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.9.8
Sep  8 02:37:22 nativespace-cdp sshd[3462819]: Failed password for invalid user ossuser from 52.187.9.8 port 54070 ssh2
Sep  8 02:37:22 nativespace-cdp sshd[3462819]: Received disconnect from 52.187.9.8 port 54070:11: Bye Bye [preauth]
Sep  8 02:37:22 nativespace-cdp sshd[3462819]: Disconnected from 52.187.9.8 port 54070 [preauth]
Sep  8 02:37:35 nativespace-cdp sshd[3462869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.213.29  user=root
Sep  8 02:37:35 nativespace-cdp sshd[3462869]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:37:37 nativespace-cdp sshd[3462869]: Failed password for root from 161.35.213.29 port 42682 ssh2
Sep  8 02:37:40 nativespace-cdp sshd[3462869]: Received disconnect from 161.35.213.29 port 42682:11: Bye Bye [preauth]
Sep  8 02:37:40 nativespace-cdp sshd[3462869]: Disconnected from 161.35.213.29 port 42682 [preauth]
Sep  8 02:38:05 nativespace-cdp sshd[3462954]: Invalid user castle from 161.35.213.29 port 44986
Sep  8 02:38:05 nativespace-cdp sshd[3462954]: input_userauth_request: invalid user castle [preauth]
Sep  8 02:38:05 nativespace-cdp sshd[3462954]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 02:38:05 nativespace-cdp sshd[3462954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.213.29
Sep  8 02:38:07 nativespace-cdp sshd[3462954]: Failed password for invalid user castle from 161.35.213.29 port 44986 ssh2
Sep  8 02:38:07 nativespace-cdp sshd[3462954]: Received disconnect from 161.35.213.29 port 44986:11: Bye Bye [preauth]
Sep  8 02:38:07 nativespace-cdp sshd[3462954]: Disconnected from 161.35.213.29 port 44986 [preauth]
Sep  8 02:41:33 nativespace-cdp sshd[3464081]: Connection closed by 159.100.136.21 port 42508 [preauth]
Sep  8 02:42:48 nativespace-cdp sshd[3464308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.9.8  user=root
Sep  8 02:42:48 nativespace-cdp sshd[3464308]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:42:50 nativespace-cdp sshd[3464308]: Failed password for root from 52.187.9.8 port 49552 ssh2
Sep  8 02:42:50 nativespace-cdp sshd[3464308]: Received disconnect from 52.187.9.8 port 49552:11: Bye Bye [preauth]
Sep  8 02:42:50 nativespace-cdp sshd[3464308]: Disconnected from 52.187.9.8 port 49552 [preauth]
Sep  8 02:43:37 nativespace-cdp sshd[3464561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.9.8  user=root
Sep  8 02:43:37 nativespace-cdp sshd[3464561]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 02:43:39 nativespace-cdp sshd[3464561]: Failed password for root from 52.187.9.8 port 57448 ssh2
Sep  8 02:46:35 nativespace-cdp sshd[3465291]: Connection closed by 159.100.136.21 port 51412 [preauth]
Sep  8 02:51:33 nativespace-cdp sshd[3466464]: Connection closed by 159.100.136.21 port 60322 [preauth]
Sep  8 02:56:34 nativespace-cdp sshd[3467888]: Connection closed by 159.100.136.21 port 40438 [preauth]
Sep  8 03:01:34 nativespace-cdp sshd[3469032]: Connection closed by 159.100.136.21 port 49186 [preauth]
Sep  8 03:06:33 nativespace-cdp sshd[3470045]: Connection closed by 159.100.136.21 port 58774 [preauth]
Sep  8 03:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 03:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:34 nativespace-cdp sudo[3470617]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 03:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:34 nativespace-cdp sudo[3470620]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 03:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:35 nativespace-cdp sudo[3470623]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 03:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:35 nativespace-cdp sudo[3470627]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 03:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:36 nativespace-cdp sudo[3470630]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 03:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:36 nativespace-cdp sudo[3470637]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 03:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:36 nativespace-cdp sudo[3470640]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 03:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:37 nativespace-cdp sudo[3470643]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 03:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:37 nativespace-cdp sudo[3470646]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 03:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:37 nativespace-cdp sudo[3470649]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 03:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:37 nativespace-cdp sudo[3470652]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 03:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:38 nativespace-cdp sudo[3470665]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 03:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:39 nativespace-cdp sudo[3470672]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=connectedshoppin user-2=thqkgnbz user-3=accooper user-4=ianrayne user-5=hubmaster user-6=putterfi user-7=fetch user-8=carsinyo user-9=milloyco user-10=gilpin user-11=elecleis user-12=firstred user-13=highlegh user-14=southlon user-15=firstrel user-16=clarkass user-17=costestimatorco user-18=opaiscyx user-19=coursemc user-20=ultbcrra user-21=jonhartl user-22=seftvta user-23=firstres user-24=nativene user-25=innovat1 user-26=stuartge user-27=askhform user-28=alexadmin user-29=skyfirec user-30=newstoda user-31=ggaaorgu user-32=belle user-33=bemadonn user-34=bedfords user-35=vivienn1 user-36=firstre2 user-37=oneoarco user-38=battlere user-39=nstriton user-40=brighto1 user-41=stephani user-42=leereyn1 user-43=agproduc user-44=still user-45=spectrum user-46=theblack user-47=hodgesonweb
Sep  8 03:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=jarvisin user-49=ulsukarm user-50=vantagep user-51=connect9 user-52=athenare user-53=lbscrmod user-54=maflemin user-55=markward user-56=foundation user-57=booff user-58=magichat user-59=hhdugcor user-60=lbhyisi user-61=dickemery123 user-62=ptkxhsbt user-63=martsblo user-64=megacards user-65=musorguk user-66=wilsonsw user-67=strathar user-68=atestord user-69=sarafoundation user-70=lakesan1 user-71=brmrjxl user-72=romaldki user-73=outdoorc user-74=ranxterc user-75=hodgsonmail user-76=branko user-77=onlycont user-78=lucy user-79=attlebor user-80=david user-81=nbhavers user-82=careers user-83=chrisdal user-84=mcdermos user-85=jennimil user-86=tomandle user-87=design user-88=dancinggardener user-89=stagingerris user-90=ladburyp user-91=kategilpin user-92=havantho user-93=sketchy user-94=cath user-95=nvihkvu user-96=oubpgvbx user-97=tstardom user-98=what user-99=bakery user-100=crrtipdl user-101=sosevalu
Sep  8 03:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=boldover user-103=nove user-104=dhyana user-105=beauty user-106=darkstar user-107=eatspam user-108=nsceres user-109=fawcettd user-110=burydropin user-111=steve user-112=bwppodcast user-113=zebrapho user-114=sibtoncc user-115=asandcoc user-116=eugincou user-117=courseme user-118=hirefootballgame user-119=cwsocial user-120=pugwash user-121=howardon user-122=paulmca1 user-123=cambria1 user-124=cathski user-125=reliable user-126=ninejimm user-127=nomistakes user-128=hidden user-129=barbersh user-130=tigerlet user-131=isleofwi user-132=smrszyqg user-133=lkpier user-134=donnychicago user-135=firstre5 user-136=steakbridieme user-137=ctedorgu user-138=philmcph user-139=nscdp user-140=putterfc user-141=foods user-142=leftie user-143=health2045 user-144=fortunaz feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 03:09:39 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 03:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:39 nativespace-cdp sudo[3470678]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 03:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:39 nativespace-cdp sudo[3470684]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YYP788RTIylnSakp.~
Sep  8 03:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:39 nativespace-cdp sudo[3470688]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YYP788RTIylnSakp.~'
Sep  8 03:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:39 nativespace-cdp sudo[3470691]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YYP788RTIylnSakp.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 03:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:39 nativespace-cdp sudo[3470695]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 03:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:39 nativespace-cdp sudo[3470698]: pam_unix(sudo:session): session closed for user root
Sep  8 03:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 03:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 03:09:41 nativespace-cdp sudo[3470723]: pam_unix(sudo:session): session closed for user root
Sep  8 03:11:35 nativespace-cdp sshd[3471231]: Connection closed by 159.100.136.21 port 39772 [preauth]
Sep  8 03:16:36 nativespace-cdp sshd[3472479]: Connection closed by 159.100.136.21 port 48296 [preauth]
Sep  8 03:21:33 nativespace-cdp sshd[3473508]: Connection closed by 159.100.136.21 port 57184 [preauth]
Sep  8 03:26:33 nativespace-cdp sshd[3474785]: Connection closed by 159.100.136.21 port 38040 [preauth]
Sep  8 03:31:33 nativespace-cdp sshd[3475849]: Connection closed by 159.100.136.21 port 47272 [preauth]
Sep  8 03:36:34 nativespace-cdp sshd[3476915]: Connection closed by 159.100.136.21 port 55968 [preauth]
