[Dxspider-support] Spot with False Origin Nodes

[Anthony (N2KI)]

With all the fraud being reported and what should be blocked and how, I
,for one, would appreciate a list of items to be blocked and the command to
use to do so.  I am not as astute in linux as most.  Thank you.




*Regards,Anthony *
*   N2KI*









On Wed, Jan 29, 2025 at 8:58 AM Keith, G6NHU via Dxspider-support <
dxspider-support at tobit.co.uk> wrote:

> Shouldn’t that all be baddx, not badnode?
>
> I’m inclined to agree with Kin here, if these are being generated and fed
> into the network in the way he’s describing it then it’s fraudulent and we
> should be blocking it.
>
> This award thing is due to end in a couple of days, it’s been almost
> double the size this year compared to last year and I’d love to see an
> analysis of how many ‘WWA’ spots have been posted this month.   They appear
> to run events all throughout the year (which people pay for), but this is
> the biggest.
>
> The technology behind it all looks impressive but they do appear to be
> abusing the cluster network.   The handful of hours of potential
> self-spotting pales into insignificance compared to this.
>
> With the WWA thing ending in two days, there’s a chance this gets
> forgotten about until it happens again next year.
>
> 73 Keith.
> On 29 Jan 2025 at 13:38 +0000, Kin via Dxspider-support <
> dxspider-support at tobit.co.uk>, wrote:
>
> I have been analysing the logs, and I can see that the same thing is
> happening to every node I check.
> It seems that a list of all active nodes has been generated and is being
> used as a pool to create spots with fake IPs, and probably with spoofed
> spotters.
>
> So far, I have gathered the following:
>
> set/badword WWA
> set/badnode 8E3R BY8GA BY4DX HB9WWA CR6WWA
> set/badnode II0WWA II1WWA II2WWA II3WWA II4WWA II5WWA II6WWA II7WWA II8WWA
> II9WWA
> set/badnode EG4WWA II0WWA E7W CQ7WWA GB2WWA DA0WWA EN0U OL5WWA SN4WWA
> set/badnode WWA 3WWA UP7WWA CR6WWA GB2WWA PA25WWA DA0WWA S53WWA OL5WWA
> A43WWA
> set/badnode EG2WWA EG4WWA EG6WWA EG5WWA EG7WWA EG8WWA EG9WWA SN4WWA HZ1WWA
>
>
> Kin
>
>
> -----Mensaje original-----
> De: Dxspider-support <dxspider-support-bounces at tobit.co.uk> En nombre de
> Kin
> via Dxspider-support
> Enviado el: miércoles, 29 de enero de 2025 14:12
> Para: 'The DXSpider Support list' <dxspider-support at tobit.co.uk>
> CC: Kin <ea3cv at cronux.net>
> Asunto: [Dxspider-support] Spot with False Origin Nodes
>
> Hi,
>
> Since the 27th, I have started seeing spots appearing from my EA3CV-3 node.
>
> It is impossible for these spots to have originated from my node, as it is
> password-protected.
> I fear that other nodes may be experiencing the same issue.
> This started after we raised concerns about a node that couldn't identify
> its connection and used a time string in the comment field-remember? Well,
> now that node is no longer visible, and the spots no longer contain that
> string, yet multiple spots are still being sent.
>
> 1737969291^(chan) <- I PI4CC PC61^18104.0^II5WWA^27-Jan-2025^0914Z^FT4
> award
> Worldwide^IK5FKE^EA3CV-3^54.7.76.202^H30^~
> 1737985919^(chan) <- I PI4CC PC61^21031.0^8E3R^27-Jan-2025^1351Z^CW WWA25
> ham.cm/wwa^YB1CDA^EA3CV-3^24.89.103.72^H30^~
> 1738058541^(chan) <- I PI4CC PC61^21074.0^8E3R^28-Jan-2025^1002Z^2025 WWA
> ft8^YB3CUG^EA3CV-3^159.16.127.210^H30^~
> 1738061474^(chan) <- I PI4CC PC61^14034.0^II4WWA^28-Jan-2025^1051Z^cw
> thanks
> wwa^I4GAD^EA3CV-3^185.120.124.165^H30^~
> 1738135942^(chan) <- I PI4CC PC61^7162.0^II2WWA^29-Jan-2025^0732Z^
> ^IK2YCW^EA3CV-3^131.4.148.117^H30^~
> 1738154649^(chan) <- I PI4CC PC61^28023.0^II3WWA^29-Jan-2025^1244Z^tu
> wwa^IV3ZXQ^EA3CV-3^218.41.168.166^H30^~
>
> I am going to block EVERYTHING related to the event these spots carry,
> including the DX stations.
>
> Kin EA3CV
>
>
>
>
> _______________________________________________
> Dxspider-support mailing list
> Dxspider-support at tobit.co.uk
> https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
>
>
> _______________________________________________
> Dxspider-support mailing list
> Dxspider-support at tobit.co.uk
> https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
>
> _______________________________________________
> Dxspider-support mailing list
> Dxspider-support at tobit.co.uk
> https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.tobit.co.uk/pipermail/dxspider-support/attachments/20250129/de45bc16/attachment-0001.htm>