The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Inbox suddenly empty, any log trace to check?

Discussion in 'E-mail Discussions' started by iso99, Nov 4, 2014.

  1. iso99

    iso99 Well-Known Member

    Joined:
    Jan 5, 2011
    Messages:
    89
    Likes Received:
    2
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hi guys,

    I'm at lost here. One of my client's inbox just got suddenly empty. Fortunately there were backups although a week late. The day the most recent backup run was the day the inbox got empty.

    Now, I have a suspicion that the client used a POP3 connection from another device. Still checking on that.

    Is there a way I can trace back in the logs if the emails got deleted manually by someone, or some script pruned that certain inbox?

    Thank you.


    UPDATE:

    There were a lot of incoming POP3 connections from the server IP to this email account (according to /var/log/maillog). What script is accessing this?
     
    #1 iso99, Nov 4, 2014
    Last edited: Nov 4, 2014
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Yes, /var/log/maillog is the log file you should review to review the POP3 connections. There's no way to know what exact POP3 email application was accessed, but you may want to review their account to see if any custom webmail scripts were installed.

    Thank you.
     
  3. iso99

    iso99 Well-Known Member

    Joined:
    Jan 5, 2011
    Messages:
    89
    Likes Received:
    2
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Update: A certain Wordpress newsletter plugin is accessing her email via POP3. That is the local IP access I'm seeing from the logs.

    Issue resolved.
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
Loading...

Share This Page