[Dshield] SCO still blocked by xo.net
jlauro at umflint.edu
Mon Feb 2 14:40:16 GMT 2004
Yesturday, SCO.COM was resolving to 22.214.171.124... And as you
state, they dropped www.sco.com yesterday.
However, sometime over the night, SCO changed SCO.COM's IP to
126.96.36.199. 188.8.131.52 is a *NEW* IP for SCO.COM.
CALDERASYSTEMS.COM still resolves to 184.108.40.206 and so that URL
still does not work.
Do a traceroutes to: 220.127.116.11, 18.104.22.168, and
22.214.171.124 and you will see it is clearly XO.NET that is blocking
> -----Original Message-----
> From: list-bounces at dshield.org
> [mailto:list-bounces at dshield.org] On Behalf Of Johannes B. Ullrich
> Sent: Monday, February 02, 2004 8:25 AM
> To: General DShield Discussion List
> Subject: Re: [Dshield] SCO still blocked by xo.net
> On Mon, 2004-02-02 at 07:26, Lauro, John wrote:
> > Sometime over the night, SCO has changed the IP address of
> SCO.COM, so
> > that it (SCO.COM) is now reachable despite XO.NET's block.
> (and I was
> > testing directly with SCO's name servers...)
'www.sco.com' no longer resolves. SCO turned this off on their own
yesterday. Other host names ('sco.com','www.caldera.com') still
resolve to the original IP address (126.96.36.199).
The page does respond reasonably fast if one of the other URLs is
> I wonder if XO did that on it's own, or in cooperation with SCO...
> not in cooperation, I wonder if SCO will sue XO.NET and/or whoever
> their ISP is... This would be a more legitimate case then going
Some ISPs may have turned off 'www.sco.com' early on for "self
preservation". I don't think SCO has a case against any of these ISPs,
as SCO doesn't have a contract with them. Only users of these
respective ISPs may have a case depending on how the user agreement is
Overall, it is probably reasonable for an ISP to block a smaller site
like www.sco.com if this will protect the ISP's network.
So far, I haven't heard anything about ISPs actually experiencing
problems. However, different ISPs may be affected in different way
depending on subscribers and network layout.
CTO SANS Internet Storm Center http://isc.sans.org
phone: (617) 837 2807 jullrich at sans.org
contact details: http://johannes.homepc.org/contact.htm
More information about the list