[Dxspider-support] fraud detection

[Márkus Béla]

Regarding fraud detection algorithm those IP's are suscipious where 
connection made to different node's with different login calls.

Still it doesn't necessarily fraud, see shared station used by different 
stations. But in this case calls are from the same country. I will 
refine filtering to spot real cases. Lets see the result.

BTW I was thinking to add fraud detection to Slogan but now I see it is 
a different story. Also, it can be done global based on the traffic and 
offered as a WEB service to see actual situation. You need it real time, 
a month later is interesting but nearly useles.

I will put together something dirty, depending on free time.

Regards... Béla, HA5DI

2011.12.12. 1:57 keltezéssel, Philip Gladstone írta:
> The same public IP will not exist in more than one location. However, 
> there can be *lots* of subscribers behind a single IP address 
> (especially in mobile networks). The big carriers use boxes called 
> Carrier Grade NATs to do the translation. Technically they are not NAT 
> boxes but PAT boxes -- i.e. they can map more than one subscriber onto 
> a single address at the same time. This is the same type of system 
> that most people have at home to allow multiple people to connect to 
> the internet from a single house.
>
> IPv6 will help this situation as it gets rolled out -- then each 
> subscriber will get 2^64 addresses (or more) for use inside the house.
>
> Philip
>
> p.s. I am a networking geek.
>
> On 12/11/2011 7:01 PM, EA7UU Jesus wrote:
>> Hello all
>>
>>     I agree with Béla and Roland; Jim I'm not an expert in networking 
>> but it's very strange that same public IP address would coexist in 
>> two or more ISP, but more curious is that different worldwide 
>> callsign share the same IP address and connect at same DXCluster, 
>> magic or IP miracle?.
>>
>>    During this weekend W6MSW was connected in my dxcluster, this 
>> callsign not exist in FCC database and their IP address was from 
>> Dominican Republic. Also, have a look for EA7ST (EA7JTF is his wife).
>>
>>     Sorry for my english.
>>
>>
>> El 11/12/2011 17:23, Jim Bayer escribió:
>>> I'm wondering if there is ISP address munging here.  Perhaps many 
>>> public
>>> addresses are aggregated at the border of an ISP (not country) and 
>>> it makes
>>> it look like all the requests are coming from the same address.  
>>> Like a PAT
>>> address (Public Address Translation) on a grander scale.
>>>
>>> Just a thought...
>>>
>>>
>>> '73
>>> Jim  - KC9AOP
>>>
>>>
>>
>