[Dshield] SCO still blocked by xo.net

Lauro, John jlauro at umflint.edu
Mon Feb 2 14:40:16 GMT 2004


Yesturday, SCO.COM was resolving to 216.250.128.12...  And as you
state, they dropped www.sco.com yesterday.

However, sometime over the night, SCO changed SCO.COM's IP to
216.250.128.21.  216.250.128.21 is a *NEW* IP for SCO.COM.
CALDERASYSTEMS.COM still resolves to 216.250.128.12 and so that URL
still does not work.

Do a traceroutes to: 216.250.128.11, 216.250.128.12, and
216.250.128.13 and you will see it is clearly XO.NET that is blocking
216.250.128.12. 



> -----Original Message-----
> From: list-bounces at dshield.org 
> [mailto:list-bounces at dshield.org] On Behalf Of Johannes B. Ullrich
> Sent: Monday, February 02, 2004 8:25 AM
> To: General DShield Discussion List
> Subject: Re: [Dshield] SCO still blocked by xo.net
> 
> 
> On Mon, 2004-02-02 at 07:26, Lauro, John wrote:
> > Sometime over the night, SCO has changed the IP address of 
> SCO.COM, so 
> > that it (SCO.COM) is now reachable despite XO.NET's block.  
> (and I was 
> > testing directly with SCO's name servers...)
> 
'www.sco.com' no longer resolves. SCO turned this off on their own
yesterday. Other host names ('sco.com','www.caldera.com') still
resolve to the original IP address (216.250.128.21). 

The page does respond reasonably fast if one of the other URLs is 
used.

> I wonder if XO did that on it's own, or in cooperation with SCO...
If 
> not in cooperation, I wonder if SCO will sue XO.NET and/or whoever 
> their ISP is...  This would be a more legitimate case then going
after 
> Linux.

Some ISPs may have turned off 'www.sco.com' early on for "self
preservation". I don't think SCO has a case against any of these ISPs,
as SCO doesn't have a contract with them. Only users of these
respective ISPs may have a case depending on how the user agreement is
written.

Overall, it is probably reasonable for an ISP to block a smaller site
like www.sco.com if this will protect the ISP's network.

So far, I haven't heard anything about ISPs actually experiencing
problems. However, different ISPs may be affected in different way
depending on subscribers and network layout.


-- 
CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 837 2807                          jullrich at sans.org 

contact details: http://johannes.homepc.org/contact.htm




More information about the list mailing list