[Dxspider-support] Spot with False Origin Nodes

Wed Jan 29 14:22:44 GMT 2025

Hi Kin and all,

please note that the HamAward system has a cluster node: it is IU1NSA-6.
Probably through that node, they put into the network the fraudulent spots.

73 Luigi IK5ZUK

Il 29/01/2025 15:14, Kin via Dxspider-support ha scritto:
>
> I don't think it will stop, Keith.
>
> As you said, it's a business and for it to be attractive, broadcasting 
> the spots is necessary, although not in the way they are doing it.
>
> And yes, I was wrong, set/baddx should be used.
>
> Kin
>
> PS
>
> Wehave a new build, 549 which I just installed.
>
> *De:*Dxspider-support <dxspider-support-bounces at tobit.co.uk> *En 
> nombre de *Keith, G6NHU via Dxspider-support
> *Enviado el:* miércoles, 29 de enero de 2025 14:58
> *Para:* The DXSpider Support list <dxspider-support at tobit.co.uk>
> *CC:* Keith, G6NHU <g6nhu at me.com>
> *Asunto:* Re: [Dxspider-support] Spot with False Origin Nodes
>
> Shouldn’t that all be baddx, not badnode?
>
> I’m inclined to agree with Kin here, if these are being generated and 
> fed into the network in the way he’s describing it then it’s 
> fraudulent and we should be blocking it.
>
> This award thing is due to end in a couple of days, it’s been almost 
> double the size this year compared to last year and I’d love to see an 
> analysis of how many ‘WWA’ spots have been posted this month.   They 
> appear to run events all throughout the year (which people pay for), 
> but this is the biggest.
>
> The technology behind it all looks impressive but they do appear to be 
> abusing the cluster network.   The handful of hours of potential 
> self-spotting pales into insignificance compared to this.
>
> With the WWA thing ending in two days, there’s a chance this gets 
> forgotten about until it happens again next year.
>
> 73 Keith.
>
> On 29 Jan 2025 at 13:38 +0000, Kin via Dxspider-support 
> <dxspider-support at tobit.co.uk>, wrote:
>
>     I have been analysing the logs, and I can see that the same thing is
>     happening to every node I check.
>     It seems that a list of all active nodes has been generated and is
>     being
>     used as a pool to create spots with fake IPs, and probably with
>     spoofed
>     spotters.
>
>     So far, I have gathered the following:
>
>     set/badword WWA
>     set/badnode 8E3R BY8GA BY4DX HB9WWA CR6WWA
>     set/badnode II0WWA II1WWA II2WWA II3WWA II4WWA II5WWA II6WWA
>     II7WWA II8WWA
>     II9WWA
>     set/badnode EG4WWA II0WWA E7W CQ7WWA GB2WWA DA0WWA EN0U OL5WWA SN4WWA
>     set/badnode WWA 3WWA UP7WWA CR6WWA GB2WWA PA25WWA DA0WWA S53WWA OL5WWA
>     A43WWA
>     set/badnode EG2WWA EG4WWA EG6WWA EG5WWA EG7WWA EG8WWA EG9WWA
>     SN4WWA HZ1WWA
>
>
>     Kin
>
>
>     -----Mensaje original-----
>     De: Dxspider-support <dxspider-support-bounces at tobit.co.uk> En
>     nombre de Kin
>     via Dxspider-support
>     Enviado el: miércoles, 29 de enero de 2025 14:12
>     Para: 'The DXSpider Support list' <dxspider-support at tobit.co.uk>
>     CC: Kin <ea3cv at cronux.net>
>     Asunto: [Dxspider-support] Spot with False Origin Nodes
>
>     Hi,
>
>     Since the 27th, I have started seeing spots appearing from my
>     EA3CV-3 node.
>
>     It is impossible for these spots to have originated from my node,
>     as it is
>     password-protected.
>     I fear that other nodes may be experiencing the same issue.
>     This started after we raised concerns about a node that couldn't
>     identify
>     its connection and used a time string in the comment
>     field-remember? Well,
>     now that node is no longer visible, and the spots no longer
>     contain that
>     string, yet multiple spots are still being sent.
>
>     1737969291^(chan) <- I PI4CC
>     PC61^18104.0^II5WWA^27-Jan-2025^0914Z^FT4 award
>     Worldwide^IK5FKE^EA3CV-3^54.7.76.202^H30^~
>     1737985919^(chan) <- I PI4CC
>     PC61^21031.0^8E3R^27-Jan-2025^1351Z^CW WWA25
>     ham.cm/wwa^YB1CDA^EA3CV-3^24.89.103.72^H30^~
>     1738058541^(chan) <- I PI4CC
>     PC61^21074.0^8E3R^28-Jan-2025^1002Z^2025 WWA
>     ft8^YB3CUG^EA3CV-3^159.16.127.210^H30^~
>     1738061474^(chan) <- I PI4CC
>     PC61^14034.0^II4WWA^28-Jan-2025^1051Z^cw thanks
>     wwa^I4GAD^EA3CV-3^185.120.124.165^H30^~
>     1738135942^(chan) <- I PI4CC PC61^7162.0^II2WWA^29-Jan-2025^0732Z^
>     ^IK2YCW^EA3CV-3^131.4.148.117^H30^~
>     1738154649^(chan) <- I PI4CC PC61^28023.0^II3WWA^29-Jan-2025^1244Z^tu
>     wwa^IV3ZXQ^EA3CV-3^218.41.168.166^H30^~
>
>     I am going to block EVERYTHING related to the event these spots carry,
>     including the DX stations.
>
>     Kin EA3CV
>
>
>
>
>     _______________________________________________
>     Dxspider-support mailing list
>     Dxspider-support at tobit.co.uk
>     https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
>
>
>     _______________________________________________
>     Dxspider-support mailing list
>     Dxspider-support at tobit.co.uk
>     https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
>
>
> _______________________________________________
> Dxspider-support mailing list
> Dxspider-support at tobit.co.uk
> https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.tobit.co.uk/pipermail/dxspider-support/attachments/20250129/364f891f/attachment-0001.htm>