webauth.att.net/auth/webmail/login

webauth.att.net/auth/webmail/login
Links: home · search · speed test · login · more ·

Links: Reply New Topic
Forums » AT&T » AT&T Northeast » webauth.att.net/auth/webmail/login

Sheryltoo @ 22nd Sep 07:33PM:
webauth.att.net/auth/webmail/login

I got an e-mail saying I was suppose to go to that site to verify my e-mail account or reply to the e-mail to verify it within the next 48 hours or my account will be erased from their data base.
I've never seen this before so I'm not sure if it's legit.
Could someone please tell me if this is a legitimate e-mail?
Thanks.
reply

MrFixitSC @ 22nd Sep 08:52PM:
Re: webauth.att.net/auth/webmail/login

feel free to fwd to me for investigation however I greatly suspect it's bogus, especially if it asks for passwords...
reply

easyed @ 22nd Sep 09:06PM:
Re: webauth.att.net/auth/webmail/login

I concur with Mr Fix It CT (oops now, SC). This appears to be another scam operation in the works which is looking for SS numbers. I've been with SNET-SBC and now AT & T for over a decade and not once had been asked for any such verification.
reply

Sheryltoo @ 22nd Sep 10:30PM:
Re: webauth.att.net/auth/webmail/login

I forwarded the e-mail to two of your e-mail addresses by mistake.
Thanks for looking into this for me.
Sheryl
reply

DrStrange @ 23rd Sep 12:45AM:
Re: webauth.att.net/auth/webmail/login

Hmph. Looks decidedly odd to me...

--- 09/23/09 00:08:35 Eastern Daylight Time
--- resolving host "webauth.att.net", please wait...

webauth.att.net [204.127.218.22]

************************************
--- 09/23/09 00:06:00 Eastern Daylight Time
--- resolving IP [204.127.218.22], please wait...

webauth.bellsouth.net [204.127.218.22]

****************************
1 [ 192.168.xx.xx] home 1 ms
2 [ 67.101.157.1] h-67-101-157-1.nycmny83.dynamic.covad.net 19 ms
3 [ 192.168.13.137] 192.168.13.137 19 ms
4 [ 63.209.170.233] unknown.Level3.net 18 ms
5 [ 4.68.16.126] vlan79.csw2.NewYork1.Level3.net 29 ms
6 [ 4.69.134.69] ae-71-71.ebr1.NewYork1.Level3.net 17 ms
7 [ 4.69.132.98] ae-2-2.ebr1.Newark1.Level3.net 19 ms
8 [ 4.68.99.8] ae-14-51.car4.Newark1.Level3.net 17 ms
9 [ 151.164.89.249] ex1-tg2-0.eqnwnj.sbcglobal.net 17 ms
10 [ 151.164.95.113] ded2-p8-0.snfcca.sbcglobal.net 90 ms
11 [ 64.172.39.78] ATTSI-2of2-San-Francisco-1155380.cust-rtr.pacbell.net 95 ms
12 [ 207.115.16.50] 207.115.16.50 92 ms
13. *
14 [ 204.127.218.22] webauth.bellsouth.net 94 ms

***********************************

--- 09/23/09 00:14:00 Eastern Daylight Time
--- reading URL 204.127.218.22
--- contacting host [204.127.218.22] on port 80

HTTP/1.1 200 OK
Server: Sun-ONE-Web-Server/6.1
Date: Wed, 23 Sep 2009 04:13:48 GMT
Content-length: 153
Content-type: text/html
Last-modified: Thu, 19 Jul 2007 18:27:44 GMT
Etag: "99-469fad20"
Accept-ranges: bytes
Connection: close
[HTML]
[HEAD]
[TITLE]AT&T Message Center[/TITLE]
[META HTTP-EQUIV="Refresh" CONTENT="0; URL=/auth/webmail/login"]
[/HEAD]

[BODY]

[/BODY]
[/HTML]
*******************************************

Found 7 domains hosted on the same web server as 204.127.218.22.

admin.stage.att.net
dailynews.att.net
miportal.att.net
my.att.net
smallbusiness.att.net
webmail.att.net
webnews.att.net

*****************************************

Found 1 domain hosted on the same web server as 204.127.218.20.

webmail.bellsouth.net

************************************
Found 3 domains hosted on the same web server as 204.127.218.21.

maillink.prodigy.net
webmail.att.net
worldnet.att.net

*************************************

/auth/webmail/login redirects to webmail.att.net [204.127.218.20 OR .22], which is also known as webmail.bellsouth.net [.22 only] ... still traces to pacbell...

That's just REALLY odd. Domains only resolve for ATT and Bellsouth, not for Ameritech, SNET, sbcglobal etc. I found another IP in between that resolves for Worldnet and Prodigy. If this is legit, it's the dodgiest legit setup I've ever seen. What is this, Room 641A in San Fransisco? I'm confused now, so I'm going to sleep early. ;-)
reply