[Dshield] SCO still blocked by xo.net

Johannes B. Ullrich jullrich at sans.org
Mon Feb 2 13:25:03 GMT 2004

On Mon, 2004-02-02 at 07:26, Lauro, John wrote:
> Sometime over the night, SCO has changed the IP address of SCO.COM, so
> that it (SCO.COM) is now reachable despite XO.NET's block.  (and I was
> testing directly with SCO's name servers...)

'www.sco.com' no longer resolves. SCO turned this off on their own
yesterday. Other host names ('sco.com','www.caldera.com') still resolve
to the original IP address ( 

The page does respond reasonably fast if one of the other URLs is 

> I wonder if XO did that on it's own, or in cooperation with SCO...  If
> not in cooperation, I wonder if SCO will sue XO.NET and/or whoever
> their ISP is...  This would be a more legitimate case then going after
> Linux.

Some ISPs may have turned off 'www.sco.com' early on for "self
preservation". I don't think SCO has a case against any of these ISPs,
as SCO doesn't have a contract with them. Only users of these respective
ISPs may have a case depending on how the user agreement is written.

Overall, it is probably reasonable for an ISP to block a smaller site
like www.sco.com if this will protect the ISP's network.

So far, I haven't heard anything about ISPs actually experiencing
problems. However, different ISPs may be affected in different way
depending on subscribers and network layout.

CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 837 2807                          jullrich at sans.org 

contact details: http://johannes.homepc.org/contact.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20040202/ec34090a/attachment.bin

More information about the list mailing list