[Dxspider-support] Rogue connections from WB0OEW

Thu Nov 30 20:17:07 GMT 2023

Hi all,

I’ve noticed for the last week that I’ve had a connection from WB0OEW which has been continually disconnecting and reconnecting every few seconds.  WB0OEW is Elwood, the author of HamClock and we’ve spoken a lot in the past so I emailed him, asking if he was testing something.

It’s not him, he’s confirmed it’s not him making the connection to my node.  In fact, he said that apart from a brief test earlier today, he hasn’t connected to any DXCluster for a long time.

Here’s a sample from the log.

1701369894^DXProt^PC92A WB0OEW -> 38.141.240.105 on G6NHU-2
1701369894^DXCommand^WB0OEW connected from 38.141.240.105 cols 80
1701369910^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369910^DXCommand^WB0OEW disconnected
1701369910^DXProt^PC92A WB0OEW -> 172.103.22.172 on G6NHU-2
1701369910^DXCommand^WB0OEW connected from 172.103.22.172 cols 80
1701369918^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369918^DXCommand^WB0OEW disconnected
1701369918^DXProt^PC92A WB0OEW -> 38.141.240.105 on G6NHU-2
1701369918^DXCommand^WB0OEW connected from 38.141.240.105 cols 80
1701369931^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369931^DXCommand^WB0OEW disconnected
1701369931^DXProt^PC92A WB0OEW -> 172.103.22.172 on G6NHU-2
1701369931^DXCommand^WB0OEW connected from 172.103.22.172 cols 80
1701369948^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369948^DXCommand^WB0OEW disconnected
1701369948^DXProt^PC92A WB0OEW -> 38.141.240.105 on G6NHU-2
1701369948^DXCommand^WB0OEW connected from 38.141.240.105 cols 80
1701369949^DXProt^PC92A WB0OEW-1 -> 173.242.242.20 on WB3FFV-2
1701369961^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369961^DXCommand^WB0OEW disconnected
1701369961^DXProt^PC92A WB0OEW -> 172.103.22.172 on G6NHU-2
1701369961^DXCommand^WB0OEW connected from 172.103.22.172 cols 80
1701369976^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369976^DXCommand^WB0OEW disconnected
1701369976^DXProt^PC92A WB0OEW -> 38.141.240.105 on G6NHU-2
1701369976^DXCommand^WB0OEW connected from 38.141.240.105 cols 80
1701369990^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369990^DXCommand^WB0OEW disconnected
1701369990^DXProt^PC92A WB0OEW -> 172.103.22.172 on G6NHU-2
1701369990^DXCommand^WB0OEW connected from 172.103.22.172 cols 80
1701370003^^WB0OEW bumped off by 172.103.22.172, disconnected
1701370003^DXCommand^WB0OEW disconnected
1701370003^DXProt^PC92A WB0OEW -> 38.141.240.105 on G6NHU-2
1701370003^DXCommand^WB0OEW connected from 38.141.240.105 cols 80
1701370009^DXProt^PC92A WB0OEW-1 -> 173.242.242.20 on WB3FFV-2
1701370017^^WB0OEW bumped off by 38.141.240.105, disconnected
1701370017^DXCommand^WB0OEW disconnected
1701370017^DXProt^PC92A WB0OEW -> 172.103.22.172 on G6NHU-2
1701370017^DXCommand^WB0OEW connected from 172.103.22.172 cols 80
1701370024^^WB0OEW bumped off by 172.103.22.172, disconnected
1701370024^DXCommand^WB0OEW disconnected
1701370024^DXProt^PC92A WB0OEW -> 38.141.240.105 on G6NHU-2
1701370024^DXCommand^WB0OEW connected from 38.141.240.105 cols 80
1701370033^^WB0OEW bumped off by 38.141.240.105, disconnected
1701370033^DXCommand^WB0OEW disconnected
1701370033^DXProt^PC92A WB0OEW -> 172.103.22.172 on G6NHU-2
1701370033^DXCommand^WB0OEW connected from 172.103.22.172 cols 80
1701370047^^WB0OEW bumped off by 172.103.22.172, disconnected
1701370047^DXCommand^WB0OEW disconnected

Doing a search on ‘bumped off by’ gives me this:

1701369602^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369617^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369629^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369636^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369643^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369656^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369672^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369679^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369687^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369697^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369705^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369715^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369725^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369740^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369755^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369769^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369783^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369795^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369804^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369815^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369828^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369841^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369858^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369867^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369879^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369894^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369910^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369918^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369931^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369948^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369961^^WB0OEW bumped off by 38.141.240.105, disconnected
1701369976^^WB0OEW bumped off by 172.103.22.172, disconnected
1701369990^^WB0OEW bumped off by 38.141.240.105, disconnected
1701370003^^WB0OEW bumped off by 172.103.22.172, disconnected
1701370017^^WB0OEW bumped off by 38.141.240.105, disconnected
1701370024^^WB0OEW bumped off by 172.103.22.172, disconnected
1701370033^^WB0OEW bumped off by 38.141.240.105, disconnected
1701370047^^WB0OEW bumped off by 172.103.22.172, disconnected
1701370061^^WB0OEW bumped off by 38.141.240.105, disconnected
1701370068^^WB0OEW bumped off by 172.103.22.172, disconnected
1701370083^^WB0OEW bumped off by 38.141.240.105, disconnected
1701370099^^WB0OEW bumped off by 172.103.22.172, disconnected
1701370116^^WB0OEW bumped off by 38.141.240.105, disconnected
1701370125^^WB0OEW bumped off by 172.103.22.172, disconnected

Because WB3FFV-2 appears in the initial search, I connected to Howard’s node and can see a connection there from WB0OEW-1 via 174.175.165.122 (Elwood has also confirmed this isn’t him) which is doing the same thing - It’s disconnecting and reconnecting continually.

So it looks like someone is messing about using Elwood’s callsign for multiple connections.  Both are static IP addresses which is a bit odd.

Because the connection to Howard’s node is still bouncing, I suspect this is connected to multiple other nodes as well.  Please take a look at your user list and see if you can see any trace of WB0OEW and can perhaps shed some more light on this.

In the meantime, I’ve blocked the two IP addresses in my firewall.

73 Keith G6NHU

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.tobit.co.uk/pipermail/dxspider-support/attachments/20231130/468b0286/attachment-0001.htm>