Hotmail Proxy Details (Whodunnit)

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

I think we're talking at cross purposes here.

We already know they were both logged onto their workstations at the time the email was sent from hotmail. We also know that they were both accessing hotmail at the time the email was sent. But the proxy logs dont tell us which one of them sent the email, nor which one was logged onto the account.

For example, say the email was sent at 24/06/2008 14:07, the proxy logs show:

24/06/2008 14:07 joe.bloggs (D10114) - <hotmail access>
24/06/2008 14:07 joe.schmo (D10115) - <hotmail access>

ie, we know that they were both doing things on hotmail at the time the email was sent. We know what machine they were on, but we need to narrow it down to which one of the two users who were concurrently accessing hotmail, actually sent the email.

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Ahhhh - NOW I get you!

Unfortunately, without more detailed logs (say from an IDS or a layer 7 proxy that can act as an SSL intermediary) you probably won't be able to do anything about it now. You could, however, run a sniffer on both workstations or at switch level if you suspect this is likely to happen again.

 

Chances are that the person created the account at the same time as sending the email, so what you will be looking for on the proxy is what computer accessed the "signup page" on hotmail.

The url you get directed to straight after saying you want to create an account is:
http://get.live.com/mail/options