[*] Logging output to /var/log/session-audit_20260429_162327.log

[*] Backing up sessions directory...
    Source : /var/cpanel/sessions
    Dest   : /var/cpanel/sessions_backup_20260429_162327

[+] Backup complete.

[*] Verifying backup integrity...
    Live sessions   : 30
    Backup sessions : 30
[+] Backup verified (30 files match).

[*] Scanning for CRITICAL exploitation artifacts...
    (token_denied + injected cp_security_token + badpass origin)

[!] CRITICAL: /var/cpanel/sessions/raw/:3EPPD9NaSmXsK65Z
    User             : root
    cp_security_token: /cpsess8425440013
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:52
    File modified    : 2026-04-29 14:18:52

[!] CRITICAL: /var/cpanel/sessions/raw/:40X3xrR7WeXxtTsF
    User             : root
    cp_security_token: /cpsess1525341340
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:54
    File modified    : 2026-04-29 14:18:54

[!] CRITICAL: /var/cpanel/sessions/raw/:62qPS_S8mJkzvLBl
    User             : root
    cp_security_token: /cpsess1818390012
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:54
    File modified    : 2026-04-29 14:18:54

[!] CRITICAL: /var/cpanel/sessions/raw/:AlaYFIsQ2Q743Ktu
    User             : root
    cp_security_token: /cpsess0091980805
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:19:04
    File modified    : 2026-04-29 14:19:04

[!] CRITICAL: /var/cpanel/sessions/raw/:OFFO3i24zLbPwCdT
    User             : root
    cp_security_token: /cpsess7561492110
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:53
    File modified    : 2026-04-29 14:18:53

[!] CRITICAL: /var/cpanel/sessions/raw/:RSCThsAV2xkoV9l8
    User             : root
    cp_security_token: /cpsess7676241380
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:19:02
    File modified    : 2026-04-29 14:19:02

[!] CRITICAL: /var/cpanel/sessions/raw/:W2_8IHxEWdkzN8Y2
    User             : root
    cp_security_token: /cpsess5696544078
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:58
    File modified    : 2026-04-29 14:18:58

[!] CRITICAL: /var/cpanel/sessions/raw/:WCzCD2MV5f6vg2cN
    User             : root
    cp_security_token: /cpsess4610900954
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:19:05
    File modified    : 2026-04-29 14:19:05

[!] CRITICAL: /var/cpanel/sessions/raw/:b5UjnHPr8Wi8k29z
    User             : root
    cp_security_token: /cpsess5971725214
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:59
    File modified    : 2026-04-29 14:18:59

[!] CRITICAL: /var/cpanel/sessions/raw/:biHUTlgq__XbYZb4
    User             : root
    cp_security_token: /cpsess8457444643
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:51
    File modified    : 2026-04-29 14:18:51

[!] CRITICAL: /var/cpanel/sessions/raw/:cNYFloQqwr4_0y1R
    User             : root
    cp_security_token: /cpsess3237610810
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:59
    File modified    : 2026-04-29 14:18:59

[!] CRITICAL: /var/cpanel/sessions/raw/:eCvr75U8BDO7VF5P
    User             : root
    cp_security_token: /cpsess3983002854
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:19:01
    File modified    : 2026-04-29 14:19:01

[!] CRITICAL: /var/cpanel/sessions/raw/:eYCrYy9P9feLnoUf
    User             : root
    cp_security_token: /cpsess4699778673
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:52
    File modified    : 2026-04-29 14:18:52

[!] CRITICAL: /var/cpanel/sessions/raw/:f2Tiph6TkMMPelr5
    User             : root
    cp_security_token: /cpsess6344274960
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:50
    File modified    : 2026-04-29 14:18:50

[!] CRITICAL: /var/cpanel/sessions/raw/:fDs0BSwQdy42sn_6
    User             : root
    cp_security_token: /cpsess4387330451
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:19:01
    File modified    : 2026-04-29 14:19:01

[!] CRITICAL: /var/cpanel/sessions/raw/:kDBJgpyBCDcu4dgV
    User             : root
    cp_security_token: /cpsess2984062044
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:19:03
    File modified    : 2026-04-29 14:19:03

[!] CRITICAL: /var/cpanel/sessions/raw/:lApwGxe7iS0kI7fj
    User             : root
    cp_security_token: /cpsess5641072691
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:57
    File modified    : 2026-04-29 14:18:57

[!] CRITICAL: /var/cpanel/sessions/raw/:nIqBdDIwdZf7yaQp
    User             : root
    cp_security_token: /cpsess9117626505
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:19:00
    File modified    : 2026-04-29 14:19:00

[!] CRITICAL: /var/cpanel/sessions/raw/:oMdied90RWx16KH0
    User             : root
    cp_security_token: /cpsess4448106344
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:57
    File modified    : 2026-04-29 14:18:57

[!] CRITICAL: /var/cpanel/sessions/raw/:pVGB7uHnXHNofNi3
    User             : root
    cp_security_token: /cpsess1806286850
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:56
    File modified    : 2026-04-29 14:18:56

[!] CRITICAL: /var/cpanel/sessions/raw/:pfC6CPthZXp8x9OU
    User             : root
    cp_security_token: /cpsess0580132119
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:50
    File modified    : 2026-04-29 14:18:50

[!] CRITICAL: /var/cpanel/sessions/raw/:pnhJw5JrLSmSOjvQ
    User             : root
    cp_security_token: /cpsess3704708187
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:56
    File modified    : 2026-04-29 14:18:56

[!] CRITICAL: /var/cpanel/sessions/raw/:rIgmPih097vCURkp
    User             : root
    cp_security_token: /cpsess6663521068
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:19:03
    File modified    : 2026-04-29 14:19:03

[!] CRITICAL: /var/cpanel/sessions/raw/:sZ1MCPe27ey_iiV8
    User             : root
    cp_security_token: /cpsess6758851147
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:19:05
    File modified    : 2026-04-29 14:19:05

[!] CRITICAL: /var/cpanel/sessions/raw/:xgBYazLlWnj9lyuh
    User             : root
    cp_security_token: /cpsess9709502995
    token_denied     : 2
    Origin           : address=3.74.48.121,app=whostmgrd,method=badpass
    File created     : 2026-04-29 14:18:55
    File modified    : 2026-04-29 14:18:55

[*] Clearing all active sessions...
[+] All sessions cleared. All users have been logged out.
[+] cpsrvd restarted cleanly.

[!] ACTION REQUIRED:
    1. Force password reset for root and all WHM users
    2. Review /usr/local/cpanel/logs/cpanel_audit.log for unauthorized actions
    3. Check for persistence (cron, SSH keys, new accounts)

    Sessions cleared. Backup saved to: /var/cpanel/sessions_backup_20260429_162327