Hack accounts cpanel

Hello! Friends, I had such a problem. ?Panel hosts over a hundred sites on my server. And some of them started breaking in, uploading malicious phishing code. The logs indicate that this is not a hacking of the site itself, but the panel. Because they change the password for the account. 105.112.70.195 - - [09/02/2020:11:36:36 -0000] "GET /cPanel_magic_revision_1590741503/unprotected/cpanel/style_v2_optimized.css HTTP/1.1" 200 0 "examle.com:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:36 -0000] "GET /cPanel_magic_revision_1386192030/unprotected/cpanel/fonts/open_sans/open_sans.min.css HTTP/1.1" 200 0 "examle.com:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:37 -0000] "GET /cPanel_magic_revision_1533566265/unprotected/cpanel/images/cpanel-logo.svg HTTP/1.1" 200 0 "examle.com:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:37 -0000] "GET /cPanel_magic_revision_1533566265/unprotected/cpanel/images/icon-username.png HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1590741503/unprotected/cpanel/style_v2_optimized.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:37 -0000] "GET /cPanel_magic_revision_1533566265/unprotected/cpanel/images/notice-error.png HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1590741503/unprotected/cpanel/style_v2_optimized.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:38 -0000] "GET /cPanel_magic_revision_1386192033/unprotected/cpanel/fonts/open_sans/OpenSans-Regular-webfont.woff HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1386192030/unprotected/cpanel/fonts/open_sans/open_sans.min.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:38 -0000] "GET /cPanel_magic_revision_1386192033/unprotected/cpanel/fonts/open_sans/OpenSans-Semibold-webfont.woff HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1386192030/unprotected/cpanel/fonts/open_sans/open_sans.min.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:38 -0000] "GET /cPanel_magic_revision_1386192031/unprotected/cpanel/fonts/open_sans/OpenSans-Bold-webfont.woff HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1386192030/unprotected/cpanel/fonts/open_sans/open_sans.min.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:38 -0000] "GET /cPanel_magic_revision_1533566265/unprotected/cpanel/images/cp-logo.svg HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1590741503/unprotected/cpanel/style_v2_optimized.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:38 -0000] "GET /cPanel_magic_revision_1533566265/unprotected/cpanel/images/icon-password.png HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1590741503/unprotected/cpanel/style_v2_optimized.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:38 -0000] "GET /cPanel_magic_revision_1533566265/unprotected/cpanel/images/notice-info.png HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1590741503/unprotected/cpanel/style_v2_optimized.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:38 -0000] "GET /cPanel_magic_revision_1533566265/unprotected/cpanel/images/warning.png HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1590741503/unprotected/cpanel/style_v2_optimized.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - - [09/02/2020:11:36:38 -0000] "GET /cPanel_magic_revision_1533566265/unprotected/cpanel/images/notice-success.png HTTP/1.1" 200 0 "examle.com:2083/cPanel_magic_revision_1590741503/unprotected/cpanel/style_v2_optimized.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - username [09/02/2020:11:36:38 -0000] "POST /login/?login_only=1 HTTP/1.1" 401 0 "examle.com:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - username [09/02/2020:11:37:10 -0000] "POST /login/?login_only=1 HTTP/1.1" 301 0 "examle.com:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "-" "-" 2083 105.112.70.195 - username [09/02/2020:11:37:10 -0000] "GET /cpsess6866842361/frontend/paper_lantern/index.html?login=1&post_login=88884925054760 HTTP/1.1" 200 0 "examle.com:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "s" "-" 2083