[Dshield] SCO still blocked by xo.net
Johannes B. Ullrich
jullrich at sans.org
Mon Feb 2 13:25:03 GMT 2004
On Mon, 2004-02-02 at 07:26, Lauro, John wrote:
> Sometime over the night, SCO has changed the IP address of SCO.COM, so
> that it (SCO.COM) is now reachable despite XO.NET's block. (and I was
> testing directly with SCO's name servers...)
'www.sco.com' no longer resolves. SCO turned this off on their own
yesterday. Other host names ('sco.com','www.caldera.com') still resolve
to the original IP address (22.214.171.124).
The page does respond reasonably fast if one of the other URLs is
> I wonder if XO did that on it's own, or in cooperation with SCO... If
> not in cooperation, I wonder if SCO will sue XO.NET and/or whoever
> their ISP is... This would be a more legitimate case then going after
Some ISPs may have turned off 'www.sco.com' early on for "self
preservation". I don't think SCO has a case against any of these ISPs,
as SCO doesn't have a contract with them. Only users of these respective
ISPs may have a case depending on how the user agreement is written.
Overall, it is probably reasonable for an ISP to block a smaller site
like www.sco.com if this will protect the ISP's network.
So far, I haven't heard anything about ISPs actually experiencing
problems. However, different ISPs may be affected in different way
depending on subscribers and network layout.
CTO SANS Internet Storm Center http://isc.sans.org
phone: (617) 837 2807 jullrich at sans.org
contact details: http://johannes.homepc.org/contact.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20040202/ec34090a/attachment.bin
More information about the list