[Dxspider-support] Spot with False Origin Nodes

[Luigi Carlotto IK5ZUK]

Hi Keith and all,

as stated here https://hamaward.cloud/wwa all that stuff will be 
repeated form June 30 to July 6 this year, and next year (!!!) from 
January 1 to January 31 and from June 29 to July 5... So it's not finished!

73 Luigi IK5ZUK


Il 29/01/2025 14:58, Keith, G6NHU via Dxspider-support ha scritto:
> Shouldn’t that all be baddx, not badnode?
>
> I’m inclined to agree with Kin here, if these are being generated and 
> fed into the network in the way he’s describing it then it’s 
> fraudulent and we should be blocking it.
>
> This award thing is due to end in a couple of days, it’s been almost 
> double the size this year compared to last year and I’d love to see an 
> analysis of how many ‘WWA’ spots have been posted this month.   They 
> appear to run events all throughout the year (which people pay for), 
> but this is the biggest.
>
> The technology behind it all looks impressive but they do appear to be 
> abusing the cluster network.   The handful of hours of potential 
> self-spotting pales into insignificance compared to this.
>
> With the WWA thing ending in two days, there’s a chance this gets 
> forgotten about until it happens again next year.
>
> 73 Keith.
> On 29 Jan 2025 at 13:38 +0000, Kin via Dxspider-support 
> <dxspider-support at tobit.co.uk>, wrote:
>> I have been analysing the logs, and I can see that the same thing is
>> happening to every node I check.
>> It seems that a list of all active nodes has been generated and is being
>> used as a pool to create spots with fake IPs, and probably with spoofed
>> spotters.
>>
>> So far, I have gathered the following:
>>
>> set/badword WWA
>> set/badnode 8E3R BY8GA BY4DX HB9WWA CR6WWA
>> set/badnode II0WWA II1WWA II2WWA II3WWA II4WWA II5WWA II6WWA II7WWA 
>> II8WWA
>> II9WWA
>> set/badnode EG4WWA II0WWA E7W CQ7WWA GB2WWA DA0WWA EN0U OL5WWA SN4WWA
>> set/badnode WWA 3WWA UP7WWA CR6WWA GB2WWA PA25WWA DA0WWA S53WWA OL5WWA
>> A43WWA
>> set/badnode EG2WWA EG4WWA EG6WWA EG5WWA EG7WWA EG8WWA EG9WWA SN4WWA 
>> HZ1WWA
>>
>>
>> Kin
>>
>>
>> -----Mensaje original-----
>> De: Dxspider-support <dxspider-support-bounces at tobit.co.uk> En nombre 
>> de Kin
>> via Dxspider-support
>> Enviado el: miércoles, 29 de enero de 2025 14:12
>> Para: 'The DXSpider Support list' <dxspider-support at tobit.co.uk>
>> CC: Kin <ea3cv at cronux.net>
>> Asunto: [Dxspider-support] Spot with False Origin Nodes
>>
>> Hi,
>>
>> Since the 27th, I have started seeing spots appearing from my EA3CV-3 
>> node.
>>
>> It is impossible for these spots to have originated from my node, as 
>> it is
>> password-protected.
>> I fear that other nodes may be experiencing the same issue.
>> This started after we raised concerns about a node that couldn't identify
>> its connection and used a time string in the comment field-remember? 
>> Well,
>> now that node is no longer visible, and the spots no longer contain that
>> string, yet multiple spots are still being sent.
>>
>> 1737969291^(chan) <- I PI4CC 
>> PC61^18104.0^II5WWA^27-Jan-2025^0914Z^FT4 award
>> Worldwide^IK5FKE^EA3CV-3^54.7.76.202^H30^~
>> 1737985919^(chan) <- I PI4CC PC61^21031.0^8E3R^27-Jan-2025^1351Z^CW WWA25
>> ham.cm/wwa^YB1CDA^EA3CV-3^24.89.103.72^H30^~
>> 1738058541^(chan) <- I PI4CC PC61^21074.0^8E3R^28-Jan-2025^1002Z^2025 WWA
>> ft8^YB3CUG^EA3CV-3^159.16.127.210^H30^~
>> 1738061474^(chan) <- I PI4CC PC61^14034.0^II4WWA^28-Jan-2025^1051Z^cw 
>> thanks
>> wwa^I4GAD^EA3CV-3^185.120.124.165^H30^~
>> 1738135942^(chan) <- I PI4CC PC61^7162.0^II2WWA^29-Jan-2025^0732Z^
>> ^IK2YCW^EA3CV-3^131.4.148.117^H30^~
>> 1738154649^(chan) <- I PI4CC PC61^28023.0^II3WWA^29-Jan-2025^1244Z^tu
>> wwa^IV3ZXQ^EA3CV-3^218.41.168.166^H30^~
>>
>> I am going to block EVERYTHING related to the event these spots carry,
>> including the DX stations.
>>
>> Kin EA3CV
>>
>>
>>
>>
>> _______________________________________________
>> Dxspider-support mailing list
>> Dxspider-support at tobit.co.uk
>> https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
>>
>>
>> _______________________________________________
>> Dxspider-support mailing list
>> Dxspider-support at tobit.co.uk
>> https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
>
> _______________________________________________
> Dxspider-support mailing list
> Dxspider-support at tobit.co.uk
> https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.tobit.co.uk/pipermail/dxspider-support/attachments/20250129/89683a92/attachment.htm>