GNSO Email Archives: [ga]

ICANN/GNSO GNSO Email List Archives
[ga]

<<< Chronological Index >>> <<< Thread Index >>>
[ga] Re: EarthLink Virus Blocker Alert: Message from ??? <rxpozd@xxxxxxxx> Quarantined

To: john@xxxxxxxxxxxxx, EarthLink Support <support@xxxxxxxxxxxxx>, compliance@xxxxxxxxx, rod_beckstrom@xxxxxxxxx, info@xxxxxxx, abuse@xxxxxxxxxxxxxxxx
Subject: [ga] Re: EarthLink Virus Blocker Alert: Message from ??? <rxpozd@xxxxxxxx> Quarantined
From: "Jeffrey A. Williams" <jwkckid1@xxxxxxxxxxxxx>
Date: Tue, 2 Mar 2010 16:23:24 -0600 (GMT-06:00)
<HEAD>
<STYLE>body{font-family: 
Geneva,Arial,Helvetica,sans-serif;font-size:10pt;font-family:arial,sans-serif;background-color:#ffffff;color:black;}p{margin:0px}</STYLE>

<META content="MSHTML 6.00.6000.16825" name=GENERATOR></HEAD>
<BODY id=compText>
<P>John et., al.,</P>
<P>&nbsp;</P>
<P>&nbsp; You obviously did not read my remarks very closely.&nbsp; Please do 
so again and much more closely</P>
<P>this time if you would be so kind and considerate accordingly.&nbsp; FWIW, 
it appears to me that </P>
<P>Levelbest has, or&nbsp;may have&nbsp;been duped here, and if you had viewed 
the refrence links I provided you would</P>
<P>have been able to determine that.&nbsp; Therefore the comments I provided 
originally accordingly.</P>
<P>&nbsp;</P>
<P>&nbsp; If as you contend that Levelbest is no longer providing DNS services, 
than the WHOIS</P>
<P>listing is inaccurate, which given ICANN SSAC's lack of proper oversight is 
not all that</P>
<P>surprising.&nbsp; See WHOIS: <A 
href="http://www.dnsstuff.com/tools/whois?ip=lopa.net&amp;server=&amp;j=1&amp;email=on";>http://www.dnsstuff.com/tools/whois?ip=lopa.net&amp;server=&amp;j=1&amp;email=on</A></P>
<P>Otherwise you may need to get the WHOIS record updated to reflect your 
contended lack</P>
<P>of association with this errant domain, lopa.net.</P>
<P>&nbsp;</P>
<P>&nbsp; As I originally stated, it appears that "<FONT face="Trebuchet 
MS">000DOM" is the registrar also see</FONT></P>
<P>Registrar:&nbsp;&nbsp;&nbsp;&nbsp; DSTR ACQUISITION. I, LLC DBA 
000DOMAINS.COM<BR>Status:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
clientDeleteProhibited<BR>Dates:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 Created <B>29-sep-1999</B>&nbsp;&nbsp; Updated 23-aug-2006&nbsp; Expires 
<B>29-sep-2011</B><BR>DNS Servers:&nbsp;&nbsp; NS3.SECURESERVER.NET&nbsp; 
NS4.SECURESERVER.NET&nbsp; <BR></P>
<P>&nbsp;and that secureserver.net &lt; a gross misnomer, is providing DNS 
service, see</P>
<P><BR><BR><BR>&nbsp;</P>
<BLOCKQUOTE style="PADDING-LEFT: 5px; MARGIN-LEFT: 0px; BORDER-LEFT: #0000ff 
2px solid">-----Original Message----- <BR>From: John Yaglenski 
<JOHN@xxxxxxxxxxxxxxxxxx><BR>Sent: Mar 1, 2010 3:53 PM <BR>To: "Jeffrey A. 
Williams" <JWKCKID1@xxxxxxxxxxxxx>, EarthLink Support <SUPPORT@xxxxxxxxxxxxx>, 
compliance@xxxxxxxxx, rod_beckstrom@xxxxxxxxx, info@xxxxxxx <BR>Cc: 
icann-board@xxxxxxxxx, jeffrey@xxxxxxxxx, ga@xxxxxxxxxxxxxx <BR>Subject: Re: 
EarthLink Virus Blocker Alert: Message from ??? <RXPOZD@xxxxxxxx>Quarantined 
<BR><BR><FONT style="FONT-SIZE: 10pt; FONT-FAMILY: Trebuchet MS, 
sans-serif">Jeffrey:<BR><BR>That email did not originate from our email 
server.&nbsp; We only have a limited number of accounts that can send email 
from our domain and guard our server very closely.&nbsp; You should forward you 
issue on to your ISP for investigation, but can assure you that it did not 
originate here.<BR><BR>Lopa.net - while registered by us long ago for a client, 
does not exist on our servers, nor do we own, handle dns, http or mail for the 
domain.&nbsp;In short, we have nothing to do with the domain -&nbsp;We 
terminated all our hosting clients nearly 5 years ago.<BR><BR>A DIG of the 
domain reports back:<BR><BR>
<TABLE cellSpacing=0 cellPadding=0>
<TBODY>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">&lt;&lt;&gt;&gt; DiG 9.2.3 
&lt;&lt;&gt;&gt; @dns1.menandmice.com lopa.net ANY </FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; global options: 
printcmd</FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; Got 
answer:</FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; -&gt;&gt;HEADER&lt;&lt;- 
opcode: QUERY, status: NOERROR, id: 5439</FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; flags: qr rd ra; QUERY: 
1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2</FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt"></FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; QUESTION 
SECTION:</FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;lopa.net. IN 
ANY</FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt"></FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; ANSWER 
SECTION:</FONT></TD></TR>
<TR>
<TD noWrap><A 
onclick="submitDig('/cgi-bin/DoDig?host=&amp;type=IN&amp;domain=lopa.net.&amp;recur=on')"><FONT
 style="FONT-SIZE: 10pt">lopa.net.</FONT></A></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">172800</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">IN</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">NS ns3.secureserver.net. </FONT>
<TD noWrap><FONT style="FONT-SIZE: 10pt"></FONT>
<TR>
<TD noWrap><A 
onclick="submitDig('/cgi-bin/DoDig?host=&amp;type=IN&amp;domain=lopa.net.&amp;recur=on')"><FONT
 style="FONT-SIZE: 10pt">lopa.net.</FONT></A></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">172800</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">IN</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">NS ns4.secureserver.net. </FONT>
<TD noWrap><FONT style="FONT-SIZE: 10pt"></FONT>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt"></FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; AUTHORITY 
SECTION:</FONT></TD></TR>
<TR>
<TD noWrap><A 
onclick="submitDig('/cgi-bin/DoDig?host=&amp;type=IN&amp;domain=lopa.net.&amp;recur=on')"><FONT
 style="FONT-SIZE: 10pt">lopa.net.</FONT></A></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">172800</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">IN</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">NS ns4.secureserver.net. </FONT>
<TD noWrap><FONT style="FONT-SIZE: 10pt"></FONT>
<TR>
<TD noWrap><A 
onclick="submitDig('/cgi-bin/DoDig?host=&amp;type=IN&amp;domain=lopa.net.&amp;recur=on')"><FONT
 style="FONT-SIZE: 10pt">lopa.net.</FONT></A></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">172800</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">IN</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">NS ns3.secureserver.net. </FONT>
<TD noWrap><FONT style="FONT-SIZE: 10pt"></FONT>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt"></FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; ADDITIONAL 
SECTION:</FONT></TD></TR>
<TR>
<TD noWrap><A 
onclick="submitDig('/cgi-bin/DoDig?host=&amp;type=IN&amp;domain=ns3.secureserver.net.&amp;recur=on')"><FONT
 style="FONT-SIZE: 10pt">ns3.secureserver.net.</FONT></A></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">172800</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">IN</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">A 216.69.185.21 </FONT>
<TD noWrap><FONT style="FONT-SIZE: 10pt"></FONT>
<TR>
<TD noWrap><A 
onclick="submitDig('/cgi-bin/DoDig?host=&amp;type=IN&amp;domain=ns4.secureserver.net.&amp;recur=on')"><FONT
 style="FONT-SIZE: 10pt">ns4.secureserver.net.</FONT></A></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">172800</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">IN</FONT></TD>
<TD noWrap><FONT style="FONT-SIZE: 10pt">A 208.109.255.21 </FONT>
<TD noWrap><FONT style="FONT-SIZE: 10pt"></FONT>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt"></FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; Query time: 258 
msec</FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; SERVER: 
217.151.171.7#53(dns1.menandmice.com)</FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; WHEN: Mon Mar 1 21:49:23 
2010</FONT></TD></TR>
<TR>
<TD noWrap colSpan=4><FONT style="FONT-SIZE: 10pt">;; MSG SIZE rcvd: 
135</FONT></TD></TR></TBODY></TABLE><BR><BR>Sincerely,<BR>John 
Yaglenski<BR><BR><FONT face="Trebuchet MS, Tahoma, Arial"><FONT 
color=#336699><FONT size=2>- - - -</FONT><SPAN style="FONT-WEIGHT: 700; 
FONT-SIZE: 11pt"><BR>John Yaglenski</SPAN></FONT><BR><FONT style="FONT-SIZE: 
10pt"><FONT style="FONT-SIZE: 10pt" color=#336699>President / Chief Executive 
Officer<BR>Levelbest Communications</FONT></FONT><FONT style="FONT-SIZE: 
10pt"><FONT style="FONT-SIZE: 10pt"><BR></FONT><BR></FONT></FONT><FONT 
style="FONT-SIZE: 7pt" face=Arial color=#999999>This e-mail message and any 
attachments are confidential and may be privileged. <BR>If you are not the 
intended recipient, please notify Levelbest immediately -- by replying<BR>to 
this message or by sending an e-mail to john@xxxxxxxxxxxxx -- and destroy all 
copies<BR>of this message and any attachments. Thank 
you.<BR></FONT><BR><BR><FONT face="Tahoma, Arial, Sans-Serif" size=2>
<HR align=center width="100%" SIZE=2>
<B>From</B>: "Jeffrey A. Williams" 
&lt;jwkckid1@xxxxxxxxxxxxx&gt;<BR><B>Sent</B>: Monday, March 01, 2010 4:37 
PM<BR><B>To</B>: "EarthLink Support" &lt;support@xxxxxxxxxxxxx&gt;, 
john@xxxxxxxxxxxxx, dnsadmin@xxxxxxxxxxxxx, compliance@xxxxxxxxx, 
rod_beckstrom@xxxxxxxxx, info@xxxxxxx<BR><B>Subject</B>: Re: EarthLink Virus 
Blocker Alert: Message from ??? &lt;rxpozd@xxxxxxxx&gt; 
Quarantined</FONT><BR><BR>Earthlink support et., al.,<BR><BR>Thank you 
Earthlink support for this notification and blocking<BR>of this obviously 
errant sender.<BR><BR>It appears that "Levelbest.com" has a miscrient in their 
midst<BR>and would be well advised to eradicate themselves of this 
<BR>despicable menace immediately!<BR><BR>It would also seem to me to be well 
advised that ICANN's<BR>registrar for this errant domain, lopa.net which 
appears to<BR>be 000DOM, 
see:http://www.dnsstuff.com/tools/whois?ip=lopa.net&amp;server=&amp;j=1&amp;email=on<BR>suspend
 this domain if "Levelbest" is unable or unwilling to<BR>take appropriate and 
decisive action post haste. In any event<BR>I will be blocking any and all 
access from lopa.net for the time<BR>being and/or until or unless I recieve an 
"All clear" from<BR>ICANN's compliance department or Rod Beckstrom himself. I 
also<BR>am of the advance opinion that all INEGroup members will do the<BR>same 
accordingly.<BR><BR><BR><BR>-----Original Message-----<BR>&gt;From: EarthLink 
Support <SUPPORT@xxxxxxxxxxxxx><BR>&gt;Sent: Mar 1, 2010 12:41 AM<BR>&gt;To: 
jwkckid1@xxxxxxxxxxxxx<BR>&gt;Subject: EarthLink Virus Blocker Alert: Message 
from ??? 
<RXPOZD@xxxxxxxx>Quarantined<BR>&gt;<BR>&gt;**************************************<BR>&gt;EARTHLINK
 VIRUS BLOCKER MESSAGE 
STATUS<BR>&gt;**************************************<BR>&gt;<BR>&gt;MESSAGE 
QUARANTINED<BR>&gt;<BR>&gt;Virus Detected: 
CMU-R691-1267424320<BR>&gt;<BR>&gt;Message Details:<BR>&gt;From: ??? 
<RXPOZD@xxxxxxxx><BR>&gt;Subject: PMC?~?~?~?~?50?<BR>&gt;Date: Mon, 1 Mar 2010 
14:40:54 +0800<BR>&gt;<BR>&gt;For your protection, EarthLink Virus Blocker has 
quarantined a message sent to you because it contains a 
virus.<BR>&gt;<BR>&gt;Note: We do not recommend that you view a message that 
has a virus attached, even if you have up-to-date antivirus software. However, 
if you choose to view it anyway, you can: Sign in to Web Mail 
(https://webmail.earthlink.net), then click the Virus Blocker folder on the 
left.<BR>&gt;<BR>&gt;Sincerely,<BR>&gt;<BR>&gt;EarthLink 
Support<BR>&gt;<BR>&gt;*********************************************************************<BR>&gt;This
 is an Administrative Message from EarthLink. It is not spam.<BR>&gt;From time 
to time, EarthLink will send you such messages in order<BR>&gt;to communicate 
important information about your 
subscription.<BR>&gt;*********************************************************************<BR><BR>Regards,<BR><BR>Jeffrey
 A. Williams<BR>Spokesman for INEGroup LLA. - (Over 294k members/stakeholders 
and growing, strong!)<BR>"Obedience of the law is the greatest freedom" 
-<BR>&nbsp;&nbsp; Abraham Lincoln<BR><BR>"Credit should go with the performance 
of duty and not with what is very<BR>often the accident of glory" - Theodore 
Roosevelt<BR><BR>"If the probability be called P; the injury, L; and the 
burden, B; liability<BR>depends upon whether B is less than L multiplied 
by<BR>P: i.e., whether B is less than PL."<BR>United States v. Carroll 
Towing&nbsp; (159 F.2d 169 [2d Cir. 
1947]<BR>===============================================================<BR>Updated
 1/26/04<BR>CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. 
div. of<BR>Information Network Eng.&nbsp; INEG. INC.<BR>ABA member in good 
standing member ID 01257402 E-Mail jwkckid1@xxxxxxxxxxxxx<BR>Phone: 
214-244-4827<BR></FONT></BLOCKQUOTE></BODY>
<<< Chronological Index >>> <<< Thread Index >>>