Email forwarding

Andras Mezei

• April 11, 2017 01:09

Hello, someone has accessed our cPanel and has forwarded a few email addresses to an outside domain email in order to steal all information. I would like to find out since when are the emails forwarded. Is there a way to find this out, it must be. I have the forwarders file, but that keeps all forwarders in the same file and it has the last modification date what it was me. I have the .lastlogin file, but that isnt looks updated. Is there a way somewhere to get this info? Or any idea to get forward with this investigation?

• 

  cPanelMichael

  • April 11, 2017 14:23

  Hello, You could search for the forwarded email address in /var/log/exim_mainlog to see how far back the first emails were forwarded. EX:
  exigrep user@forwarded-address.tld /var/log/exim_mainlog*
  Thank you.

  0

Please sign in to leave a comment.