[Dshield] SCO still blocked by xo.net

Lauro, John jlauro at umflint.edu
Mon Feb 2 14:40:16 GMT 2004

Yesturday, SCO.COM was resolving to  And as you
state, they dropped www.sco.com yesterday.

However, sometime over the night, SCO changed SCO.COM's IP to is a *NEW* IP for SCO.COM.
CALDERASYSTEMS.COM still resolves to and so that URL
still does not work.

Do a traceroutes to:,, and and you will see it is clearly XO.NET that is blocking 

> -----Original Message-----
> From: list-bounces at dshield.org 
> [mailto:list-bounces at dshield.org] On Behalf Of Johannes B. Ullrich
> Sent: Monday, February 02, 2004 8:25 AM
> To: General DShield Discussion List
> Subject: Re: [Dshield] SCO still blocked by xo.net
> On Mon, 2004-02-02 at 07:26, Lauro, John wrote:
> > Sometime over the night, SCO has changed the IP address of 
> SCO.COM, so 
> > that it (SCO.COM) is now reachable despite XO.NET's block.  
> (and I was 
> > testing directly with SCO's name servers...)
'www.sco.com' no longer resolves. SCO turned this off on their own
yesterday. Other host names ('sco.com','www.caldera.com') still
resolve to the original IP address ( 

The page does respond reasonably fast if one of the other URLs is 

> I wonder if XO did that on it's own, or in cooperation with SCO...
> not in cooperation, I wonder if SCO will sue XO.NET and/or whoever 
> their ISP is...  This would be a more legitimate case then going
> Linux.

Some ISPs may have turned off 'www.sco.com' early on for "self
preservation". I don't think SCO has a case against any of these ISPs,
as SCO doesn't have a contract with them. Only users of these
respective ISPs may have a case depending on how the user agreement is

Overall, it is probably reasonable for an ISP to block a smaller site
like www.sco.com if this will protect the ISP's network.

So far, I haven't heard anything about ISPs actually experiencing
problems. However, different ISPs may be affected in different way
depending on subscribers and network layout.

CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 837 2807                          jullrich at sans.org 

contact details: http://johannes.homepc.org/contact.htm

More information about the list mailing list