# Check logins on any domain

To check logins for a domain, open **Reports › Intrusion Detection**, set **From Date** and **To Date**, type the domain name and click the validate button, then click **Search**. When the report is ready, click **History** and open it. The **Successful Login** and **Un-Successful Login** tabs list logins from India and abroad.

## How to check logins on any domain

1. Open **Reports › Intrusion Detection**.
2. Set **From Date** and **To Date** with the calendar buttons.
3. Type the **Domain** name and click the validate button until a green tick appears.
4. Click **Search**. The report is prepared in the background.
5. Click **History**, then click the report you want to open.
6. Switch between **Successful Login** and **Un-Successful Login**. Click **Print Report** if you need paper.

## Fields and buttons

| Control | What it does | Default |
|---|---|---|
| **From Date** / **To Date** | The period for the report. Use the calendar buttons. A future date is refused, and **To Date** cannot be before **From Date**. | Today |
| **Domain** | The domain to check. Type the name and click the validate (magnifier) button. You must see the green tick before **Search** works. | Empty |
| **Search** | Queues the report. | |
| **History** | Opens **List Of Previously Generated Intrusion Reports**, grouped by date. Click a report to open it. The red icons delete a single report or a whole date folder. **Close** shuts the list. | |
| **Successful Login** / **Un-Successful Login** | Tabs on an opened report. | Successful Login |
| **Print Report** | Prints the tab you are viewing. | |

## What the report lists

| Section | Details |
|---|---|
| Header | **Mail Intrusion Detection Monitoring Framework**, with the report date and the period. |
| Successful Login tab | Mails received and sent, total logins, logins from India, logins from abroad, and POP/IMAP logins from India and from abroad. |
| Un-Successful Login tab | Total failed logins, failed logins from India and from abroad, and failed POP/IMAP logins from India and from abroad. |
| **Top 10 Failed Login Attempts** | **Mail ID**, **IP** and **Country**. |
| **Abnormal Variations / Access Location** | **Mail ID**, **IP** and **Country** for logins from unusual places. |

## Example

> Rohit sees a complaint that someone tried to guess passwords for acme.in. He generates the report for the last three days, opens the **Un-Successful Login** tab and finds ten mailboxes with repeated failures from the same foreign IP. He then asks the domain admin to enforce stronger passwords.

## Good to know

- The domain name is required, so run the report once per domain.
- Domain administrators have a separate page limited to their own domain.
- Deleting a report from **History** cannot be undone.

## Common questions

**What does the report count?**

It counts mails received and sent, total logins, and logins from India and from abroad, including POP and IMAP logins. The failed tab adds the top 10 failed login attempts and unusual access locations.


Source: https://docs.xgenplus.com/server/server-intrusion-detection/