# Logs WHM/cPanel
echo "=== WHM access ==="
grep -h "5.230.103.2" /usr/local/cpanel/logs/access_log /usr/local/cpanel/logs/login_log 2>/dev/null
zgrep -h "5.230.103.2" /usr/local/cpanel/logs/access_log.*.gz /usr/local/cpanel/logs/login_log.*.gz 2>/dev/null

echo "=== Apache domlogs ==="  
grep -rh "^5.230.103.2" /etc/apache2/logs/domlogs/ 2>/dev/null | wc -l
grep -rh "^5.230.103.2" /etc/apache2/logs/domlogs/ 2>/dev/null | head -30

echo "=== Otras IPs de GHOSTnet 5.230.x.x ==="
grep -rhE "^5\.230\.[0-9]+\.[0-9]+ " /etc/apache2/logs/domlogs/ 2>/dev/null | awk '{print $1}' | sort -u

echo "=== SSH auth ==="
grep "5.230.103.2" /var/log/secure* 2>/dev/null | tail -30

echo "=== Sessions WHM activas ==="
ls -la /var/cpanel/sessions/raw/ 2>/dev/null
grep -rl "5.230.103.2" /var/cpanel/sessions/ 2>/dev/null