I'm Abdellah, a Junior System & Cybersecurity Analyst based in Milan.
Here I share my labs and what I learn along the way.
about / Abdellah
I’m based in Milan and work in IT. Here I share what I’m learning about systems, networks and security.
Most of these projects start with a question: why did a login fail, is this email suspicious, or who received it? I build a small lab, check the logs and write up the results.
I analysed an email impersonating Microsoft, checking its headers, reply address and links alongside domain reputation. I then ran a separate, harmless local simulation and used Postfix logs to confirm which of five test mailboxes received it.
I built a Windows lab in Hyper-V and compared successful logons with incorrect passwords and unknown users. Using Event Viewer, I examined events 4624 and 4625 and the status codes that explain each failure.
I configured an Ubuntu mail server for local delivery and sent a test email to five accounts. I followed its Message-ID through SMTP output, Postfix logs and Maildir copies to identify every recipient, including those missing from To and Cc.
Start with the email or log and understand what I’m looking at.
Follow message IDs, accounts and timestamps across the records.
Check what the evidence shows and what I still can’t answer.
Save the source files and write down the steps and findings.
