The strange case of disappearing Russian servers (isc.sans.edu)

Might they have a zero-day vulnerability on CWMP and blocking the port on their servers before launching it on the rest of the world?