[Scspamcop] Re: Network Solutions turned off my domain

[Mike Easter]

V Meyers wrote:
> "Mike Easter"
>> V Meyers wrote:
>>> Hello, Yesterday afternoon at about tea time, Network Solutions
>>> locked my domain name.
>>
>> A domainname can be associated with a website.

The website was http://www.pjmorgan.com/ -- it is not currently possible
to tell what that site's IP was.

>> A domainname can be
>> associated with email addresses.

68.15.233.248 rDNS mail.pjmorgan.com

... and here's how that nameservice works:

How I am searching:
   Asking a.root-servers.net for 248.233.15.68.in-addr.arpa PTR record:
       a.root-servers.net says to go to dill.arin.net. (zone:
68.in-addr.arpa.)
   Asking dill.arin.net. for 248.233.15.68.in-addr.arpa PTR record:
       dill.arin.net [192.35.51.32] says to go to NS.EAST.COX.NET.
(zone: 15.68.in-addr.arpa.)
   Asking NS.EAST.COX.NET. for 248.233.15.68.in-addr.arpa PTR record:
       ns.east.cox.net [68.1.16.101] says to go to ns2.coxmail.com.
(zone: 233.15.68.in-addr.arpa.)
   Asking ns2.coxmail.com. for 248.233.15.68.in-addr.arpa PTR record:
Reports mail.pjmorgan.com. [from 68.111.106.75]

Answer:
   68.15.233.248 PTR record: mail.pjmorgan.com. [TTL 3600s] [A=None]
*ERROR* There is no A record for mail.pjmorgan.com.

>> So far I can't tell just what is
>> going on.  Locked up can mean that a domainname lost its nameservice
>> so that it doesn't resolve for a website IP address or a MX IP
>> address.

... and currently the name has lost its nameservice

   Searching for pjmorgan.com A record at c.root-servers.net Got
referral to D.GTLD-SERVERS.NET. [took 6 ms]
   Searching for pjmorgan.com A record at D.GTLD-SERVERS.NET. Reports no
A records (NXDOMAIN). 30ms.

>> I think I'm going to guess that a website lost its nameservice.
>>
>>> I called Network Solutions of course, and the only information that
>>> I have is that they received a 'report' from spamcop.net and that
>>> was enough for them to disable my domain (this is for a long
>>> standing local retail company).

/If/ your website had been at 68.15.233.248 - which condition is not
possible to tell at this stage, the normal spamcop parsing algorithm
would not have notified NetSol about that site being spamvertised,
because netsol does not control that IP.

SC's system does not notify a domainname registrar.  SC's system
notifies the provider for the IP's block, which in this case if that
*is* the IP which I don't know, then SC would have notified cox, not
netsol.

If any spamcop related function notified an entity which was *just* a
domainname registrar, it would have to be a reporter creating an
'additional notified'.

However, if some IP which you haven't named were involved with the
website or with being a source of spam, then the spamcop process
would/could have notified the provider for that IP address.  Altho'
netsol's primary business is domainname registration, it does have some
netspace allocated.

NetSol Internet 38.216.110.0 - 38.216.110.255
NetSol Internet  38.216.111.0 - 38.216.111.255
NetSol Internet 38.216.112.0 - 38.216.112.255
NetSol Internet 38.185.32.0 - 38.185.32.255
NetSol Internet 38.185.33.0 - 38.185.33.255
NetSol Internet 38.185.34.0 - 38.185.34.255
NetSol Internet 38.185.35.0 - 38.185.35.255
NetSol Internet  38.187.68.0 - 38.187.68.255
NetSol Internet 38.187.69.0 - 38.187.69.255
NetSol Internet 38.185.64.0 - 38.185.64.255
NetSol Internet 38.186.145.0 - 38.186.145.255
NetSol Internet 38.186.146.0 - 38.186.146.255
NetSol Internet 38.186.147.0 - 38.186.147.255
NetSol Internet 38.186.148.0 - 38.186.148.255
NetSol Internet 38.170.16.0 - 38.170.16.255
NETSOL 38.216.109.0 - 38.216.109.255

> I have no 'services' with NetSol, just the domain registration. Cox
> is my DNS

It would appear that Cox should be your nameservice according to netsol.

>> SpamCop's actions are based on IP addresses, not domainnames.  You
>> haven't even named a domainname, much less an IP address.
>
> The IP address is 68.15.233.248 the domain is pjmorgan.com
> I ran it through http://www.web-max.ca/tools/ (and others) and it was
> (Friday afternoon) and is still all green!

If there were a SC report about 68.15.233.248 the SC notify would go to
abuse at cox.net  -- not netsol

> All of the information that I have is that Network Solutions told me
> that they disabled my domain name because of a report from spamcop.

So far that doesn't even make any sense;  based on the IP information
you have given, SC wouldn't notify netsol about that IP.

If there is some other IP involved with your site or email, then that is
another matter.



-- 
Mike Easter
kibitzer, not SC admin