HELLO, I'm sorry, I did not understand how to check and see where the logs of who accesses the webmail. I HAVE seen in the log the ip that is bothering me, I stop sending this ip?
thanks 2012/5/10 Reindl Harald <h.rei...@thelounge.net>: > > > Am 10.05.2012 14:10, schrieb Giuseppe Perna: >> thanks for repaly, >> this is log foe webmail: >> >> 176.61.140.133 - - [08/May/2012:08:18:41 +0200] "GET >> /src/compose.php?mail_sent=yes HTTP/1.1" 200 556825 >> "https://webmail.esempio.it/src/compose.php"; "Opera/9.80 (Windows NT >> 6.1; U; en) Presto/2.10.229 Version/11.61" >> 176.61.140.133 - - [08/May/2012:08:18:43 +0200] "POST /src/compose.php >> HTTP/1.1" 302 5 "https://webmail.esempio.it/src/compose.php"; >> "Opera/9.80 (Windows NT 6.1; U; en) Presto/2.10.229 Version/11.61" >> 176.61.140.133 - - [08/May/2012:08:18:45 +0200] "POST /src/compose.php >> HTTP/1.1" 302 5 "https://webmail.esempio.it/src/compose.php"; >> "Opera/9.80 (Windows NT 6.1; U; en) Presto/2.10.229 Version/11.61" >> 176.61.140.133 - - [08/May/2012:08:18:47 +0200] "POST /src/compose.php >> HTTP/1.1" 302 5 "https://webmail.esempio.it/src/compose.php"; >> "Opera/9.80 (Windows NT 6.1; U; en) Presto/2.10.229 Version/11.61" >> 176.61.140.133 - - [08/May/2012:08:18:50 +0200] "POST /src/compose.php >> HTTP/1.1" 302 5 "https://webmail.esempio.it/src/compose.php"; >> "Opera/9.80 (Windows NT 6.1; U; en) Presto/2.10.229 Version/11.61" >> >> how can I find the account used to send spam? > > only by compare timestamp since your webmail has no useful log > roundcube logs as you can see below the postfix queue-id > _______________ > > [root@arrakis:~]$ cat /var/log/roundcubemail/sendmail | grep reindl > [05-Mar-2012 12:53:24 +0100]: User h.rei...@thelounge.net [**.0.0.99]; > Message for h.rei...@thelounge.net; 250: > 2.0.0 Ok: queued as 3666DA3 > > >
