[Dshield] SCO still blocked by xo.net

Johannes B. Ullrich jullrich at sans.org
Mon Feb 2 13:25:03 GMT 2004


On Mon, 2004-02-02 at 07:26, Lauro, John wrote:
> Sometime over the night, SCO has changed the IP address of SCO.COM, so
> that it (SCO.COM) is now reachable despite XO.NET's block.  (and I was
> testing directly with SCO's name servers...)

'www.sco.com' no longer resolves. SCO turned this off on their own
yesterday. Other host names ('sco.com','www.caldera.com') still resolve
to the original IP address (216.250.128.21). 

The page does respond reasonably fast if one of the other URLs is 
used.

> I wonder if XO did that on it's own, or in cooperation with SCO...  If
> not in cooperation, I wonder if SCO will sue XO.NET and/or whoever
> their ISP is...  This would be a more legitimate case then going after
> Linux.

Some ISPs may have turned off 'www.sco.com' early on for "self
preservation". I don't think SCO has a case against any of these ISPs,
as SCO doesn't have a contract with them. Only users of these respective
ISPs may have a case depending on how the user agreement is written.

Overall, it is probably reasonable for an ISP to block a smaller site
like www.sco.com if this will protect the ISP's network.

So far, I haven't heard anything about ISPs actually experiencing
problems. However, different ISPs may be affected in different way
depending on subscribers and network layout.


-- 
CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 837 2807                          jullrich at sans.org 

contact details: http://johannes.homepc.org/contact.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20040202/ec34090a/attachment.bin


More information about the list mailing list