dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
1159
share rss forum feed


forgotten21

@telus.net

[AB] Shaw webmail discrepancy

Hello,

I have a business account with Shaw. A few weeks ago I had some security certificates issues with their webmail servers. I called Shaw and asked them why they had expired certificates, I was informed that they were migrating their servers.

Today I noticed that there is two different URLs for the webmail, one is »webmail3.shawcable.com/ the other is »webmail.shawcable.com/ --- this one, I think was the old webmail server.

I did some reverse DNS searches on both URLS and then some IP whois's on the IPS. The URL »webmail.shawcable.com/ is registered to a website in fort lauderdale to a company called internetnamesforbusiness.com and the URL »webmail3.shawcable.com/ is registered to Shaw Cable in Calgary.

My concern is, is »webmail.shawcable.com/ a fake URL that is phishing for Shaw webmail accounts, or is it just the old server that use to be used for Shaw's webmail and hasn't been taken down yet.

Thanks

kevinds
Premium
join:2003-05-01
Calgary, AB
kudos:3
Reviews:
·Shaw
Only matters the last two parts, shawcable.com

that is the registered domain, no matter what you lookup about the domain, that should be the same.

Subdomains, webmail, webmail3, www, mail, really doesn't matter, somebody who has control of the NS server for shawcable.com set them up.

It is possible it is an off-network backup for redundancy.

But definitely setup by Shaw.

If it was webmail.shawcable.com.phishing.canoe.ca Then I would be concerned.
--
Yes, I am not employed and looking for IT work. Have passport, will travel.


forgotten21

@telus.net
cool, thank you for the reply, learned something new.

have a nice day.

tlhIngan

join:2002-07-08
Richmond, BC
kudos:1
reply to forgotten21
Don't forget that IPs are traded quite frequently - as we're officially out of IPs, spare IPs are being traded on the free market.

Just because an IP says it's somewhere else, it just means the registries haven't updated the new location of the IP address yet. Shaw can give you a new IP and for a few days to weeks the databases can point to the old owner of the IP. ARIN will probably have the updates the quickest, but the various IP geolocation databases will take much longer.

E.g., sometimes Shaw opens up a new block to customers, and their IPs can run all over the place. When I first got Shaw 10 years ago, the IP geolocated me to Toronto. Heck, this IP I'm using for the first few days was unlisted and unknown.

stolen

join:2004-04-12
Calgary, AB
kudos:2
said by tlhIngan:

Don't forget that IPs are traded quite frequently - as we're officially out of IPs, spare IPs are being traded on the free market.

We're not out of IPv4 addresses, only at the IANA level are they exhausted.

ARIN has 5.32 /8's available yet:
»www.arin.net/resources/request/i···ion.html
which translates to about 89,254,778 IP addresses that they have to give out to ISPs yet.

Geolocation databases are notoriously bad in general for new IP blocks. They aren't using any previous user data, most of the /8s ARIN has have never been assigned (Except the one that was returned last year).