Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Email forwarding

Discussion in 'E-mail Discussions' started by Andras Mezei, Apr 11, 2017.

  1. Andras Mezei

    Andras Mezei Registered

    Joined:
    Apr 11, 2017
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Odorheiu Secuiesc
    cPanel Access Level:
    Root Administrator
    Hello, someone has accessed our cPanel and has forwarded a few email addresses to an outside domain email in order to steal all information. I would like to find out since when are the emails forwarded. Is there a way to find this out, it must be. I have the forwarders file, but that keeps all forwarders in the same file and it has the last modification date what it was me. I have the .lastlogin file, but that isnt looks updated. Is there a way somewhere to get this info? Or any idea to get forward with this investigation?
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    38,658
    Likes Received:
    1,419
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    You could search for the forwarded email address in /var/log/exim_mainlog to see how far back the first emails were forwarded. EX:

    Code:
    exigrep user@forwarded-address.tld /var/log/exim_mainlog*
    Thank you.
     
Loading...

Share This Page