phpBB2Refugees.com Logo
Not affiliated with or endorsed by the phpBB Group

Register •  Login 

Continue the legacy...

Welcome to all phpBB2 Refugees!Wave Smilie

This site is intended to continue support for the legacy 2.x line of the phpBB2 bulletin board package. If you are a fan of phpBB2, please, by all means register, post, and help us out by offering your suggestions. We are primarily a community and support network. Our secondary goal is to provide a phpBB2 MOD Author and Styles area.

Mass Email Question


 
Search this topic... | Search phpBB2 Discussion... | Search Box
Register or Login to Post    Index » phpBB2 Discussion  Previous TopicPrint TopicNext Topic
Author Message
merebel
Board Member



Joined: 19 Mar 2009

Posts: 12



PostPosted: Mon Sep 13, 2010 12:46 pm 
Post subject: Mass Email Question

Hey guys
Is there anyway to trace who sent a mass email out?
I need to find out who sent one out from our forums this morning

Thanks
Keith
Back to top
Acaria
Board Member



Joined: 20 Feb 2009

Posts: 238



PostPosted: Mon Sep 13, 2010 4:38 pm 
Post subject: Re: Mass Email Question

Contact your hosting company if you don't have access to the Apache logs. You'll need those to see where the mail was sent from.

This will give you their IP, which is what you can use to track them down.

Alternatively, what was the email about? Do you know how they sent it? This kind of information can be helpful in figuring these things out. :)
Back to top
drathbun
Board Member



Joined: 24 Jul 2008

Posts: 729
Location: Texas


flag
PostPosted: Mon Sep 13, 2010 6:09 pm 
Post subject: Re: Mass Email Question

The IP address on the email headers is going to be the server address. It will be the same no matter who sent it.

What you need is the time the email was sent, and then you need to check your web server logs to see who was logged into the admin panel at that time. Since phpBB2 does not keep audit information, you'll have to recreate the steps taken by looking in the server logs. You should be able to extract detailed information from the logs around the time the mail was sent out, and look at the IP address related to those transactions, and track it back from there.

If you don't want your "backup" or "junion" administrators to be able to do things like send mass email, there are some fairly easy things you can do to keep that from happening. But that's not your question at the moment. icon_smile.gif

_________________
phpBBDoctor Blog
Back to top
Slackervaara
Board Member



Joined: 01 Jan 2009

Posts: 70



PostPosted: Tue Sep 14, 2010 12:31 am 
Post subject: Re: Mass Email Question

5-6 years ago an hacker sent a mass mail from my site to all members that the site was hacked. As the language was turkish it was easy to figure out it was the hacker.
Back to top
merebel
Board Member



Joined: 19 Mar 2009

Posts: 12



PostPosted: Thu Sep 16, 2010 10:39 am 
Post subject: Re: Mass Email Question

Right now we are trying to get the rest of things figured out
but we do know that it as sent from a user xxxx from ip xxxxxxxxx and he posted 30min earlier from a differnt ip.
and that the ip it came from belongs to a total different user yyyyy.
now the big thing is that user xxxx is a full admin and a person with a lot of other rights with in our group. yyyy has some admin stuff but is limited.

now this email sent out private info of other members of the forum and which has caused a total mess with everything.

and each member states they didn't send the mass email out.

really does suck
Back to top
Slackervaara
Board Member



Joined: 01 Jan 2009

Posts: 70



PostPosted: Thu Sep 16, 2010 11:07 am 
Post subject: Re: Mass Email Question

How did you figure out this? As you know the time the mass email was sent it would be fairly easy to look in the access logs and there see what the mass-mailer did exactly on the site prior to sending.
Back to top
merebel
Board Member



Joined: 19 Mar 2009

Posts: 12



PostPosted: Thu Sep 16, 2010 1:48 pm 
Post subject: Re: Mass Email Question

we have been looking at post with the ip's and going by time stamps from there and from server logs

Also another question?
the server logs shows id=xxxxxxxxxxxxxx from each ip
does the id=xxxx for each user change when they are on another pc??

Keith
Back to top
Display posts from previous:   
Register or Login to Post    Index » phpBB2 Discussion  Previous TopicPrint TopicNext Topic
Page 1 of 1 All times are GMT - 4 Hours
 
Jump to:  

Index • About • FAQ • Rules • Privacy • Search •  Register •  Login 
Not affiliated with or endorsed by the phpBB Group
Powered by phpBB2 © phpBB Group
Generated in 0.0502 seconds using 17 queries. (SQL 0.0119 Parse 0.0006 Other 0.0376)
phpBB Customizations by the phpBBDoctor.com
Template Design by DeLFlo and MomentsOfLight.com Moments of Light Logo