[Dxspider-support] fraud detection

[Jim Bayer]

I'm wondering if there is ISP address munging here.  Perhaps many public
addresses are aggregated at the border of an ISP (not country) and it makes
it look like all the requests are coming from the same address.  Like a PAT
address (Public Address Translation) on a grander scale.

Just a thought...


'73
Jim  - KC9AOP

-----Original Message-----
From: dxspider-support-bounces at dxcluster.org
[mailto:dxspider-support-bounces at dxcluster.org] On Behalf Of Márkus Béla
Sent: Sunday, December 11, 2011 10:01 AM
To: The DXSpider Support list
Subject: [Dxspider-support] fraud detection

Thinking on fraud detection tool made some analysis on November data. It is
interesting to see that in huge number same IP used by different calls.
Usually difference is only SSID. There are club stations sharing
infrastructure, or a team is spending vacation abroad e.g. in EA8 or there
is a typo in call. But there are really interesting cases, few of them
(originating IP and calls used to login).

Regards... Béla, HA5DI


84.194.52.107 (Belgium)
OT4A IK1JUO DF1BO IT9RYH I0ARI IK9SKY I4RER IZ1KDO CI0RCUS JA3ERT G6YUI
ON0LID HA5OKQ JH7LNN IK1ARI JA4CYZ JA4AQC IK0FGL I0NI JA1AQC IT7RYH I5IRE
I0QMN

213.251.189.204 (France)
RD9FD-10 F5UOE-10 F0FIG-10 F6EDO-10 OK2HB-10 LZ1FI-10 UW3QBB-10 F5IEP-10
DK2AI-10 G0API-10 N9SB-10 HA6IAM-10 F5RVI-10 F6KUP-10 F5XX-10 F6CXJ-10
F1HDY-10 9A3ARN-10 ON8VP-10 F8GGV-10 F6INI-10 PD2BA-10 WA6HZY-10
IZ5OVP-10 N6VNO-10 KI7VR-10 GM3UAG-10 F6FRR-10 F5NTV-10 4Z5KO-10
KP4DE-10 RV9DC-10 F2YV-10 DL5DF-10 F8NUH-10 VE2TKH-10 F6BBO-10 DL3HXX-10
UR2VA-10 OK1FHI-10 DK5AI-10 ST0R-10 F4ABC-10 YT1KC-10 ON6MM-10 SP3EA-10
KA5CJJ-10 HA0KLU-10 F4FRG-10 HA8MT-10 K0MGA-10 DO1JWZ-10 G4BAO-10
DJ5DN-10 F5NYZ-10 IK5VLR-10 7X2RO-10 F8GFA-10 DM5BB-10 ON8BB-10 F6FNG-10
RK9JWV-10 DK2CF-10 LU2AJW-10 SM0BRF-10 UT7IA-10 F6EIK-10 OK2QX-10
OE9MON-10 LZ5R-10 F5VLY-10 SQ1DWR-10 E73LM-10 LU8IEZ-10 IW7DEB-10
OK1HB-10 OM7TJ-10 VE3TY-10 PU2YEN-10 VA2RSM-10 F5NAK-10 WA6A-10
SP1JPQ-10 DO8WA-10 M0YMJ-10 OK1AD-10 II2Z-10 F9YR-10 F4FEP-10 ZL2CQ-10
F8CHM-10 F5JNE-10 YU2V-10 IZ8CKT-10 F4FDA-10 OM3ZAS-10 PY4WAS-10 YL1S-10
F3CW-10 RW1AI-10 OK1IO-10 DF3EH-10 YR8B-10 F4CVH-10 G4GVB-10 YL2PP-10
IZ0ABQ-10 F0GHK-10 F4ULC-10 F5TYQ-10 F8FAZ-10 UX0LC-10 F4FIU-10

151.45.45.163 (Italy)
RU3ER DL1WED UX2IT K5DFG EA4DFG KD0KJ K2WE W5DF K4DF N7FG RZ6GHJ UA4CJT
K6JGH K5VB K3VML K8BN N7DJH K2SD K1ASD IZ7FLP

146.48.126.27 (Italy)
IR5PWJ-6 PC5C OE4MDA K1ZM PA2V IK5ZAF PA3CNO LX1CN W0QQ IK5SQS OE6POD OE3BOA
OE4JHW OK1KF DO2XX IZ8EBI OE5GWP K6HJM KF8CE PA3HDM DG4FR SP7TOB

78.111.176.114 (Ukraine)
PA3DER YO3CC PA4FER SM3ERW UX4FC F3TCA RN9ST YO3CD UR5FD YO3KC YO4MM YO9SW
YO8KDD UA0LCC



_______________________________________________
Dxspider-support mailing list
Dxspider-support at dxcluster.org
http://mailman.tobit.co.uk/mailman/listinfo/dxspider-support