WHM/cPanel has a service, protected from Brute Force attack, which is called “cPHulk Brute Force Protection”.
If someone several times enters an incorrect password then cPHulk blocks its IP and sends message to the root contact on the server.
If cPHulk blocks your IP you can add it to white list:
via WHM:
Go to WHM Main, then to Security Center, and select cPHulk Brute Force Protection.
Go to “White/Black List Management” Tab.
Enter the IP in “White List (Trusted IP List)” and press “Quick Add”.
If someone else tried to log into your WHM you should log in to WHM and check the IP:
Go to WHM Main, then to Security Center, and choose cPHulk Brute Force Protection.
Go to “Login/Brute History Report” Tab.
You can see “User” and “IP” where someone tried to connect. You should block this IP if you don’t know it via “White/Black List Management” Tab then go to “Black List (Rejected IP List)”.
Remove cPHulk Brute Force blocked ip address Via MYSQL
-bash-4.1# mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 216694
Server version: 5.1.70-cll MySQL Community Server (GPL)
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.
mysql>
mysql> use cphulkd
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> SELECT * FROM `brutes` WHERE `IP`=’YourIP’;
If your ip address found brutes tables, then use the following command to remove it.
mysql> DELETE FROM `brutes` WHERE `IP`=’82.80.248.107′;
Query OK, 1 rows affected (0.00 sec)
mysql> DELETE FROM `logins` WHERE `IP`=’82.80.248.107′;
Query OK, 1 rows affected (0.00 sec)
mysql> quit
Try to login your WHM now.