[Dxspider-support] Spot with False Origin Nodes

Wed Jan 29 17:10:19 GMT 2025

If anyone is interested in seeing what is going on in their node (and possibly with their node's callsign):
But it is necessary to have had “nologchan” activated:
(set/debug nologchan)

cd /spider/local_data/debug/2025
grep -i wwa 029.dat | grep "<\- I PI4CC" | grep "PC[61|11]"

PI4CC should be replaced by one of your partners.

Kin

De: Dxspider-support <dxspider-support-bounces at tobit.co.uk> En nombre de Kin via Dxspider-support
Enviado el: miércoles, 29 de enero de 2025 15:14
Para: 'The DXSpider Support list' <dxspider-support at tobit.co.uk>
CC: Kin <ea3cv at cronux.net>
Asunto: Re: [Dxspider-support] Spot with False Origin Nodes

I don't think it will stop, Keith.
As you said, it's a business and for it to be attractive, broadcasting the spots is necessary, although not in the way they are doing it.

And yes, I was wrong, set/baddx should be used.

Kin

PS

We have a new build, 549 which I just installed.

De: Dxspider-support <dxspider-support-bounces at tobit.co.uk <mailto:dxspider-support-bounces at tobit.co.uk> > En nombre de Keith, G6NHU via Dxspider-support
Enviado el: miércoles, 29 de enero de 2025 14:58
Para: The DXSpider Support list <dxspider-support at tobit.co.uk <mailto:dxspider-support at tobit.co.uk> >
CC: Keith, G6NHU <g6nhu at me.com <mailto:g6nhu at me.com> >
Asunto: Re: [Dxspider-support] Spot with False Origin Nodes

Shouldn’t that all be baddx, not badnode?

I’m inclined to agree with Kin here, if these are being generated and fed into the network in the way he’s describing it then it’s fraudulent and we should be blocking it.

This award thing is due to end in a couple of days, it’s been almost double the size this year compared to last year and I’d love to see an analysis of how many ‘WWA’ spots have been posted this month.   They appear to run events all throughout the year (which people pay for), but this is the biggest.

The technology behind it all looks impressive but they do appear to be abusing the cluster network.   The handful of hours of potential self-spotting pales into insignificance compared to this.

With the WWA thing ending in two days, there’s a chance this gets forgotten about until it happens again next year.

73 Keith.
On 29 Jan 2025 at 13:38 +0000, Kin via Dxspider-support <dxspider-support at tobit.co.uk <mailto:dxspider-support at tobit.co.uk> >, wrote:

I have been analysing the logs, and I can see that the same thing is
happening to every node I check.
It seems that a list of all active nodes has been generated and is being
used as a pool to create spots with fake IPs, and probably with spoofed
spotters.

So far, I have gathered the following:

set/badword WWA
set/badnode 8E3R BY8GA BY4DX HB9WWA CR6WWA
set/badnode II0WWA II1WWA II2WWA II3WWA II4WWA II5WWA II6WWA II7WWA II8WWA
II9WWA
set/badnode EG4WWA II0WWA E7W CQ7WWA GB2WWA DA0WWA EN0U OL5WWA SN4WWA
set/badnode WWA 3WWA UP7WWA CR6WWA GB2WWA PA25WWA DA0WWA S53WWA OL5WWA
A43WWA
set/badnode EG2WWA EG4WWA EG6WWA EG5WWA EG7WWA EG8WWA EG9WWA SN4WWA HZ1WWA

Kin

-----Mensaje original-----
De: Dxspider-support <dxspider-support-bounces at tobit.co.uk <mailto:dxspider-support-bounces at tobit.co.uk> > En nombre de Kin
via Dxspider-support
Enviado el: miércoles, 29 de enero de 2025 14:12
Para: 'The DXSpider Support list' <dxspider-support at tobit.co.uk <mailto:dxspider-support at tobit.co.uk> >
CC: Kin <ea3cv at cronux.net <mailto:ea3cv at cronux.net> >
Asunto: [Dxspider-support] Spot with False Origin Nodes

Hi,

Since the 27th, I have started seeing spots appearing from my EA3CV-3 node.

It is impossible for these spots to have originated from my node, as it is
password-protected.
I fear that other nodes may be experiencing the same issue.
This started after we raised concerns about a node that couldn't identify
its connection and used a time string in the comment field-remember? Well,
now that node is no longer visible, and the spots no longer contain that
string, yet multiple spots are still being sent.

1737969291^(chan) <- I PI4CC PC61^18104.0^II5WWA^27-Jan-2025^0914Z^FT4 award
Worldwide^IK5FKE^EA3CV-3^54.7.76.202^H30^~
1737985919^(chan) <- I PI4CC PC61^21031.0^8E3R^27-Jan-2025^1351Z^CW WWA25
ham.cm/wwa^YB1CDA^EA3CV-3^24.89.103.72^H30^~
1738058541^(chan) <- I PI4CC PC61^21074.0^8E3R^28-Jan-2025^1002Z^2025 WWA
ft8^YB3CUG^EA3CV-3^159.16.127.210^H30^~
1738061474^(chan) <- I PI4CC PC61^14034.0^II4WWA^28-Jan-2025^1051Z^cw thanks
wwa^I4GAD^EA3CV-3^185.120.124.165^H30^~
1738135942^(chan) <- I PI4CC PC61^7162.0^II2WWA^29-Jan-2025^0732Z^
^IK2YCW^EA3CV-3^131.4.148.117^H30^~
1738154649^(chan) <- I PI4CC PC61^28023.0^II3WWA^29-Jan-2025^1244Z^tu
wwa^IV3ZXQ^EA3CV-3^218.41.168.166^H30^~

I am going to block EVERYTHING related to the event these spots carry,
including the DX stations.

Kin EA3CV

_______________________________________________
Dxspider-support mailing list
Dxspider-support at tobit.co.uk <mailto:Dxspider-support at tobit.co.uk> 
https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support

_______________________________________________
Dxspider-support mailing list
Dxspider-support at tobit.co.uk <mailto:Dxspider-support at tobit.co.uk> 
https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.tobit.co.uk/pipermail/dxspider-support/attachments/20250129/259b8a5d/attachment-0001.htm>