Author |
Message |
merebel Board Member
Joined: 19 Mar 2009
Posts: 12
|
Posted: Mon Sep 13, 2010 12:46 pm Post subject: Mass Email Question |
|
|
Hey guys
Is there anyway to trace who sent a mass email out?
I need to find out who sent one out from our forums this morning
Thanks
Keith |
|
Back to top |
|
|
Acaria Board Member
Joined: 20 Feb 2009
Posts: 238
|
Posted: Mon Sep 13, 2010 4:38 pm Post subject: Re: Mass Email Question |
|
|
Contact your hosting company if you don't have access to the Apache logs. You'll need those to see where the mail was sent from.
This will give you their IP, which is what you can use to track them down.
Alternatively, what was the email about? Do you know how they sent it? This kind of information can be helpful in figuring these things out. :) |
|
Back to top |
|
|
drathbun Board Member
Joined: 24 Jul 2008
Posts: 729 Location: Texas
|
Posted: Mon Sep 13, 2010 6:09 pm Post subject: Re: Mass Email Question |
|
|
The IP address on the email headers is going to be the server address. It will be the same no matter who sent it.
What you need is the time the email was sent, and then you need to check your web server logs to see who was logged into the admin panel at that time. Since phpBB2 does not keep audit information, you'll have to recreate the steps taken by looking in the server logs. You should be able to extract detailed information from the logs around the time the mail was sent out, and look at the IP address related to those transactions, and track it back from there.
If you don't want your "backup" or "junion" administrators to be able to do things like send mass email, there are some fairly easy things you can do to keep that from happening. But that's not your question at the moment. _________________ phpBBDoctor Blog |
|
Back to top |
|
|
Slackervaara Board Member
Joined: 01 Jan 2009
Posts: 70
|
Posted: Tue Sep 14, 2010 12:31 am Post subject: Re: Mass Email Question |
|
|
5-6 years ago an hacker sent a mass mail from my site to all members that the site was hacked. As the language was turkish it was easy to figure out it was the hacker. |
|
Back to top |
|
|
merebel Board Member
Joined: 19 Mar 2009
Posts: 12
|
Posted: Thu Sep 16, 2010 10:39 am Post subject: Re: Mass Email Question |
|
|
Right now we are trying to get the rest of things figured out
but we do know that it as sent from a user xxxx from ip xxxxxxxxx and he posted 30min earlier from a differnt ip.
and that the ip it came from belongs to a total different user yyyyy.
now the big thing is that user xxxx is a full admin and a person with a lot of other rights with in our group. yyyy has some admin stuff but is limited.
now this email sent out private info of other members of the forum and which has caused a total mess with everything.
and each member states they didn't send the mass email out.
really does suck |
|
Back to top |
|
|
Slackervaara Board Member
Joined: 01 Jan 2009
Posts: 70
|
Posted: Thu Sep 16, 2010 11:07 am Post subject: Re: Mass Email Question |
|
|
How did you figure out this? As you know the time the mass email was sent it would be fairly easy to look in the access logs and there see what the mass-mailer did exactly on the site prior to sending. |
|
Back to top |
|
|
merebel Board Member
Joined: 19 Mar 2009
Posts: 12
|
Posted: Thu Sep 16, 2010 1:48 pm Post subject: Re: Mass Email Question |
|
|
we have been looking at post with the ip's and going by time stamps from there and from server logs
Also another question?
the server logs shows id=xxxxxxxxxxxxxx from each ip
does the id=xxxx for each user change when they are on another pc??
Keith |
|
Back to top |
|
|
|