<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>absolutely understood. The CIDR question was just a question out of curiosity. Of course, I am aware about the dynamic address issue. But as you see, in our existing example this wouldn't be a problem because he is using a static address (I checked the history back to lots of months).</div>
<div> </div>
<div>Related to the badword command, this will work as long as he doesn't touch the "comment" field. Whenever he would use a new spotter callsign and remove its callsign from the SDR...comment field your set/badword command won't be effective any more, unfortunately. That's why I asked for an IP address ban.</div>
<div> </div>
<div>
<div>Thanks for the hint about "set/badwords wpmcq" didn't know that this covers regex, too. Nice one! But this will be really effective if ALL DXspider sysops are aware of this and execute this command. Best of all it would be if you could globally set this but certainly this is not possible? let's say you could set a "set/badword wpmcq" globally, then we just need to look for something similar for the CC and AR cluster network and forward this information to them. AR dev is not possible :/ I know, but as more sysops will implement this checks the better for the DX cluster quality.</div>
<div> </div>
<div>Thanks for your efforts and thoughts Dirk</div>
<div> </div>
<div>73</div>
<div>Saki, DD5XX</div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Gesendet:</b> Mittwoch, 04. März 2020 um 14:36 Uhr<br/>
<b>Von:</b> "Dirk Koopman via Dxspider-support" <dxspider-support@tobit.co.uk><br/>
<b>An:</b> "dd5xx--- via Dxspider-support" <dxspider-support@tobit.co.uk><br/>
<b>Cc:</b> "Dirk Koopman" <djk@tobit.co.uk><br/>
<b>Betreff:</b> Re: [Dxspider-support] F8DGY spammer ist back as F8SDR</div>
<div name="quoted-content">
<div class="moz-cite-prefix">No, but I have been thinking about this. The problem is that a significant number of DSL lines still use dynamic addresses, even if they don't change very often - but they DO change. Remember also that IPV6 really is starting to take off and local address randomisation will also stop that working reliably. Equally, with CIDR ranges this risks clobbering lots of unsuspecting people and - more importantly - risks me have to diagnose extremely infrequent "random" connection problems which, needless to say, I don't want to get into. <br/>
<br/>
Interestingly, after I put out my suggestion of using badwords I haven't seen a spot from him.<br/>
<br/>
I have another suggestion for badword based exclusions: set/badword wpmcq<br/>
<br/>
This hits the 'WPM CQ' part of the comment of an RBN spot. Remember badwords target contiguous patterns not the bare word (regex is <tt>m{W+\s*P+\s*M+\s*C+\s*Q+}i</tt>) so it will match 'wwwWWPppp Mmmm CQqqq' as well as plain 'WPM CQ'.<br/>
<br/>
What hacks me off about this, is that RBN spots have a '<spotterl>-#' pattern which is rejected as an invalid spot on an incoming user input, PC11 or PC61. For the same reason spots from DXS (which come out as '<spotter-@') are also rejected on input. This means that F8DGY is deliberately doing this - he has clearly written a script to strip off the '-#' and then injecting that now valid spot, automatically, into an unsuspecting node.<br/>
<br/>
In the meantime I have added 'wpmcq' to my badwords list and we'll see a) whether it works and/or b) it stops F8DGY's antisocial behaviour. It will certainly slow him down if he connects to a DXSpider node as it will disconnect him "for swearing" after every 4th spot :-)<br/>
<br/>
73 Dirk G1TLH<br/>
<br/>
On 04/03/2020 11:29, dd5xx--- via Dxspider-support wrote:</div>
<blockquote>
<div style="font-family: Verdana;font-size: 12.0px;">
<div>Hi Dirk,</div>
<div> </div>
<div>is there a command to block his IP address ? something like "set/badipaddr 83.114.21.17"</div>
<div>
<div>
<div>or even block a small range of his ISP address range (asking just out of curiosity) "set/badipcidr 83.114.21.0\/24"</div>
<div> </div>
<div> </div>
<div style="margin: 10.0px 5.0px 5.0px 10.0px;padding: 10.0px 0 10.0px 10.0px;border-left: 2.0px solid rgb(195,217,229);">
<div style="margin: 0 0 10.0px 0;"><b>Gesendet:</b> Dienstag, 03. März 2020 um 23:38 Uhr<br/>
<b>Von:</b> "Dirk Koopman via Dxspider-support" <a class="moz-txt-link-rfc2396E" href="mailto:dxspider-support@tobit.co.uk" onclick="parent.window.location.href='mailto:dxspider-support@tobit.co.uk'; return false;" target="_blank"><dxspider-support@tobit.co.uk></a><br/>
<b>An:</b> "dd5xx--- via Dxspider-support" <a class="moz-txt-link-rfc2396E" href="mailto:dxspider-support@tobit.co.uk" onclick="parent.window.location.href='mailto:dxspider-support@tobit.co.uk'; return false;" target="_blank"><dxspider-support@tobit.co.uk></a><br/>
<b>Cc:</b> "Dirk Koopman" <a class="moz-txt-link-rfc2396E" href="mailto:djk@tobit.co.uk" onclick="parent.window.location.href='mailto:djk@tobit.co.uk'; return false;" target="_blank"><djk@tobit.co.uk></a><br/>
<b>Betreff:</b> Re: [Dxspider-support] F8DGY spammer ist back as F8SDR</div>
<div>A suggestion, try: set/badword f8dgy<br/>
<br/>
I've had it running on gb7djk for a while, but it appears that he has<br/>
stopped for the evening. This should stop any spots where he has signed<br/>
his "work".<br/>
<br/>
Dirk G1TLH<br/>
<br/>
On 03/03/2020 18:33, dd5xx--- via Dxspider-support wrote:<br/>
> which shows us that this strange guy is using various WAN connections<br/>
> to pollute the DX cluster network:<br/>
> 83.114.21.17 = lfbn-idf3-1-427-17.w83-114.abo.wanadoo.fr = ASN 3215<br/>
> Orange = Cable/DSL = Melun/France<br/>
> 92.170.169.241 = lfbn-idf3-1-1231-241.w92-170.abo.wanadoo.fr = ASN<br/>
> 3215 Orange = Cable/DSL = Melun/France<br/>
> 51.68.11.211 = gwc.cluster010.hosting.ovh.net = ASN 16276 which<br/>
> belongs to ISP OVH SAS, obviously a virtual or root server hosted there<br/>
> 89.94.146.92 = static-89-94-146-92.axione.abo.bbox.fr = ASN 5410<br/>
> (Bouygues Telecom SA) = Cable/DSL = 87400 Saint-Leonard-de-Noblat,<br/>
> Nouvelle-Aquitaine, France<br/>
> I don't understand this guy, he is obviously disturbing the ham radio<br/>
> community. He must have real problems in life. He knows he's<br/>
> disturbing but continues his game. -facepalm-<br/>
<br/>
<br/>
_______________________________________________<br/>
Dxspider-support mailing list<br/>
<a class="moz-txt-link-abbreviated" href="mailto:Dxspider-support@tobit.co.uk" onclick="parent.window.location.href='mailto:Dxspider-support@tobit.co.uk'; return false;" target="_blank">Dxspider-support@tobit.co.uk</a><br/>
<a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a></div>
</div>
</div>
</div>
</div>
<fieldset class="mimeAttachmentHeader"> </fieldset>
<pre class="moz-quote-pre">_______________________________________________
Dxspider-support mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dxspider-support@tobit.co.uk" onclick="parent.window.location.href='mailto:Dxspider-support@tobit.co.uk'; return false;" target="_blank">Dxspider-support@tobit.co.uk</a>
<a class="moz-txt-link-freetext" href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a>
</pre>
</blockquote>
<br/>
_______________________________________________ Dxspider-support mailing list Dxspider-support@tobit.co.uk <a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a></div>
</div>
</div></div></body></html>