I have been studying the W2xxxxxx.log file. Hopefully you can shed some light on these couple of things in these log files.
In the first log entry, there is a chgpass.xxxxx.cgi. Why is one of the entries chgpass.xxxxx.cgi whereas the entry after is chgpassweb.cgi? What is the difference between chgpass.xxxxx.cgi and chgpassweb.cgi? How can I tell if cm1msol changed their password or someone elses? The last entry is for a chgfwd.cgi. Is the mailbox that made the forward change the rb2msol mailbox? And did they forward their own mail or someone elses? Thanks Samantha 20040105 185542 Info - 64.139.64.163 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) GET /Xa0409bce9998929993ea21ea09/chgpass.49328.cgi?uid=cm1msol&mbx=Main HTTP/1.1. 20040105 185613 Info - 64.139.64.163 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) http://apollo.misd.net:8383/Xa0409bce9998929993ea21ea09/chgpass.49328.cg i?uid=cm1msol&mbx=Main POST /Xa0409bce9998929993ea21ea09/chgpassweb.cgi HTTP/1.1. 20040102 091537 Info - 68.61.135.109 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322) http://apollo.misd.net:8383/Xb879cc92cb9e9f9d9aee972dc7/chgfwd.18224.cgi ?uid=rb2msol&mbx=Main POST /Xb879cc92cb9e9f9d9aee972dc7/chgfwd.cgi HTTP/1.1. -----Original Message----- From: Panda Consulting S.A. Luis Alberto Arango [mailto:[EMAIL PROTECTED] Sent: Thursday, January 08, 2004 3:22 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Mail Forwarding Question Here is what I would do in your case I would test changing the forwarding information of a mailbox via webmail. Then in the webmail logs -Files in the spool directory that start with WXXXXXXX.log- I would locate today's webmail log file and study the effect of the change made in the testing mailbox. As for today log file name is W2040108.log I am pretty sure that you will find the cgi file that is called via webmail and the information of the user, ip, etc. Then just look for the cgi file called or other information unique to that change in the logs within the date range that the user think his account was used by the intruder. You may find at the end the IP that made that change. From that point on it will take a lot of time and effort to track down who was using that IP at the time. I hope it helps. Luis Arango -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bridges, Samantha Sent: Thursday, January 08, 2004 11:01 AM To: [EMAIL PROTECTED] Subject: [IMail Forum] Mail Forwarding Question Hello All. I have a user that suspects that another user got in to her mailbox via the web and changed her forwarding information. Would this be logged anywhere that this change occurred and at what time? Also which log would it be in. Samantha Samantha Bridges Communications Technician Macomb Intermediate School District 44001 Garfield Road Clinton Township MI 48038-1100 (586) 228-3300 [EMAIL PROTECTED] http://www.misd.net CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ ______ [Email scanned for viruses by Panda Consulting -www.pandacons.com-] [Email escaneado contra virus por Panda Consulting -www.pandacons.com-] ______ [Email scanned for viruses by Panda Consulting -www.pandacons.com-] [Email escaneado contra virus por Panda Consulting -www.pandacons.com-] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
