www.sco.com no longer has an DNS A record
Asia (remember the international date line) started on MyDoom already, although some reports said the worm used 1609 GMT to start its attack. SCO appears to have deleted the A record for www.sco.com from their DNS about 1 hour ago. I don't know how often MyDoom does the DNS lookup, so it may not stop things. As far as I can tell, no third-party ISP is blocking traffic to SCO. Traceroutes by IP address continue to nearly their last upstream hop. SCO's immediate upstream providers are probably helping.
SCO appears to have deleted the A record for www.sco.com from their DNS about 1 hour ago. I don't know how often MyDoom does the DNS lookup, so it may not stop things.
As of 1:33AM CST, www.sco.com is still resolving... however their A record has a TTL of 60 seconds. I even queried ns.calderasystems.com directly and it still answers for www.sco.com and sco.com Thanks -a- ---------------------------------------------------- Adam 'Starblazer' Romberg Appleton: 920-738-9032 System Administrator Valley Fair: 920-968-7713 ExtremePC LLC -=- http://www.extremepcgaming.net
On Sun, 1 Feb 2004, Adam 'Starblazer' Romberg wrote:
SCO appears to have deleted the A record for www.sco.com from their DNS about 1 hour ago. I don't know how often MyDoom does the DNS lookup, so it may not stop things.
As of 1:33AM CST, www.sco.com is still resolving... however their A record has a TTL of 60 seconds. I even queried ns.calderasystems.com directly and it still answers for www.sco.com and sco.com
Looks like SCO has added the records back. I queried ns.calderasystems.com directly. Here is what it looked like earlier: $ORIGIN sco.com. ;www 5931 IN SOA ns.calderasystems.com. hostmaster.caldera.com. ( ; 2004013103 3600 900 604800 21600 );sco.com.;NXDOMAIN ;-$ ;Cr=auth [216.250.130.1]
On Sat, 2004-01-31 at 22:55, Sean Donelan wrote:
On Sun, 1 Feb 2004, Adam 'Starblazer' Romberg wrote:
SCO appears to have deleted the A record for www.sco.com from their DNS about 1 hour ago. I don't know how often MyDoom does the DNS lookup, so it may not stop things.
As of 1:33AM CST, www.sco.com is still resolving... however their A record has a TTL of 60 seconds. I even queried ns.calderasystems.com directly and it still answers for www.sco.com and sco.com
Looks like SCO has added the records back. I queried ns.calderasystems.com directly. Here is what it looked like earlier:
$ORIGIN sco.com. ;www 5931 IN SOA ns.calderasystems.com. hostmaster.caldera.com. ( ; 2004013103 3600 900 604800 21600 );sco.com.;NXDOMAIN ;-$ ;Cr=auth [216.250.130.1]
Odd ....it does not resolve for me. http://www.sco.com Dee -- W.D.McKinney (Dee) Alaska Wireless Systems http://www.akwireless.net (907)349-4308 Office (907)349-2226 Fax
On Sat, 31 Jan 2004, W.D.McKinney wrote:
Odd ....it does not resolve for me. http://www.sco.com
Not being involved I'd guess SCO is adding/removing the record as the attack waxes and wanes? Trying to keep the number of attackers bouncing around some?
Odd ....it does not resolve for me. http://www.sco.com
Not being involved I'd guess SCO is adding/removing the record as the attack waxes and wanes? Trying to keep the number of attackers bouncing around some?
So, SCO has accused ISPs of dropping its traffic and has not made any effort to work with the community on this. Seems they want to take care of this all by themselves and have no interest in whatever assistance may have been available from the community. With that in mind, I'm wondering why folks are bothering to care?! Steve
Hi!
Looks like SCO has added the records back. I queried ns.calderasystems.com directly. Here is what it looked like earlier:
$ORIGIN sco.com. ;www 5931 IN SOA ns.calderasystems.com. hostmaster.caldera.com. ( ; 2004013103 3600 900 604800 21600 );sco.com.;NXDOMAIN ;-$ ;Cr=auth [216.250.130.1]
Odd ....it does not resolve for me. http://www.sco.com
Perhaps they put netblocks in and out allowed to do lookups once they see heavy traffic towards www.sco from specific blocks ? Bye, Raymond.
participants (6)
-
Adam 'Starblazer' Romberg -
Christopher L. Morrow -
Raymond Dijkxhoorn -
Sean Donelan -
Stephen J. Wilcox -
W.D.McKinney