[Dxspider-support] CQWW is under attack by bot

[Dirk Koopman]

There is a bot out there that delights in trying to confuse the Contest 
Committee's log checking process and/or causing contestants' problems by 
posting spurious spots using their callsign. It does this by logging in 
to a node, "sniping" a spot and then immediately disconnecting.

Here are some examples:

13:15:59 (progress) CMD: 'show/cluster ' by LZ1JZ ip: 217.61.58.23 1mS
13:16:00 (progress) CMD: 'DX YL2KO 14082.2' by LZ1JZ ip: 217.61.58.23 1mS
13:16:00 (progress) CMD: 'bye ' by LZ1JZ ip: 217.61.58.23 45mS
13:16:25 (progress) CMD: 'show/cluster ' by CT1GFQ ip: 217.61.58.23 0mS
13:16:25 (progress) CMD: 'DX ZF1A 28127.6' by CT1GFQ ip: 217.61.58.23 1mS
13:16:25 (progress) CMD: 'bye ' by CT1GFQ ip: 217.61.58.23 12mS
13:18:18 (progress) CMD: 'show/cluster ' by DK5QN ip: 217.61.58.23 0mS
13:18:18 (progress) CMD: 'DX NY3A 21067.2' by DK5QN ip: 217.61.58.23 1mS
13:18:18 (progress) CMD: 'bye ' by DK5QN ip: 217.61.58.23 13mS
13:55:21 (progress) CMD: 'show/cluster ' by VK6POP ip: 217.61.58.23 0mS
13:55:21 (progress) CMD: 'DX W3UA 21022.5' by VK6POP ip: 217.61.58.23 1mS
13:55:21 (progress) CMD: 'bye ' by VK6POP ip: 217.61.58.23 10mS
13:55:32 (progress) CMD: 'show/cluster ' by EA3HXV ip: 217.61.58.23 0mS
13:55:32 (progress) CMD: 'DX MI5I 14012.5' by EA3HXV ip: 217.61.58.23 2mS
13:55:32 (progress) CMD: 'bye ' by EA3HXV ip: 217.61.58.23 23mS

To try and reduce this as much as possible, please would you block this 
ip address 217.61.58.23 (or its subnet
217.61.58.0/24) using your firewall (in your router). If you are running 
Linux/BSD you could consider installing UFW or similar software to help 
with this task.

73 Dirk G1TLH
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.tobit.co.uk/pipermail/dxspider-support/attachments/20211127/00275caa/attachment.htm>