<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">It helps also if you set SET/BADWORD.
Blocking the bot from connecting to your cluster is the most
effective method. 94.156.203.117 IP has been in use for several
days. From today he is using also Telecom Italia S.p.A. (Venice,
Italy) IP 79.20.34.246. Check whether it connects to your cluster
node instead.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">SET/BADWORD kills</div>
<div class="moz-cite-prefix">SET/BADWORD ruzzia<br>
SET/BADWORD criminal</div>
<div class="moz-cite-prefix">SET/BADWORD murders<br>
SET/BADWORD nazzists</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">etc....</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">GL Dan</div>
<br>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<blockquote type="cite"
cite="mid:c8156212-a243-071f-bce4-c50d91f0f81d@siol.net">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="moz-cite-prefix">Hi</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Exactly the same bot at work like
last last year with CQWW contest. Already set up iptables
firewall rule rejected subnet 94.156.203.0/24 here.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">GL Dan</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"> <br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<blockquote type="cite"
cite="mid:ef49fd26-cfd9-162d-294a-ce3256235d9c@tobit.co.uk">
<meta http-equiv="content-type" content="text/html;
charset=UTF-8">
<font size="+1"><font face="monospace">There is a bot out there
that delights in trying to confuse the Contest Committee's
log checking process and/or causing contestants' problems by
posting spurious spots using their callsign. It does this by
logging in to a node, "sniping" a spot and then immediately
disconnecting.<br>
<br>
Here are some examples:<br>
<br>
13:15:59 (progress) CMD: 'show/cluster ' by LZ1JZ ip:
217.61.58.23 1mS<br>
13:16:00 (progress) CMD: 'DX YL2KO 14082.2' by LZ1JZ ip:
217.61.58.23 1mS<br>
13:16:00 (progress) CMD: 'bye ' by LZ1JZ ip: 217.61.58.23
45mS<br>
13:16:25 (progress) CMD: 'show/cluster ' by CT1GFQ ip:
217.61.58.23 0mS<br>
13:16:25 (progress) CMD: 'DX ZF1A 28127.6' by CT1GFQ ip:
217.61.58.23 1mS<br>
13:16:25 (progress) CMD: 'bye ' by CT1GFQ ip: 217.61.58.23
12mS<br>
13:18:18 (progress) CMD: 'show/cluster ' by DK5QN ip:
217.61.58.23 0mS<br>
13:18:18 (progress) CMD: 'DX NY3A 21067.2' by DK5QN ip:
217.61.58.23 1mS<br>
13:18:18 (progress) CMD: 'bye ' by DK5QN ip: 217.61.58.23
13mS<br>
13:55:21 (progress) CMD: 'show/cluster ' by VK6POP ip:
217.61.58.23 0mS<br>
13:55:21 (progress) CMD: 'DX W3UA 21022.5' by VK6POP ip:
217.61.58.23 1mS<br>
13:55:21 (progress) CMD: 'bye ' by VK6POP ip: 217.61.58.23
10mS<br>
13:55:32 (progress) CMD: 'show/cluster ' by EA3HXV ip:
217.61.58.23 0mS<br>
13:55:32 (progress) CMD: 'DX MI5I 14012.5' by EA3HXV ip:
217.61.58.23 2mS<br>
13:55:32 (progress) CMD: 'bye ' by EA3HXV ip: 217.61.58.23
23mS<br>
</font></font><br>
<font size="+1" face="monospace">To try and reduce this as much
as possible, please would you block this ip address </font><font
size="+1" face="monospace"><font size="+1"><font
face="monospace">217.61.58.23 </font></font>(or its
subnet </font><br>
<font size="+1" face="monospace"><font size="+1"><font
face="monospace">217.61.58.0/24) using your firewall (in
your router). If you are running Linux/BSD you could
consider installing UFW or similar software to help with
this task. <br>
<br>
</font></font>73 Dirk G1TLH<br>
</font> <br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Dxspider-support mailing list
<a class="moz-txt-link-abbreviated moz-txt-link-freetext" href="mailto:Dxspider-support@tobit.co.uk" moz-do-not-send="true">Dxspider-support@tobit.co.uk</a>
<a class="moz-txt-link-freetext" href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" moz-do-not-send="true">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a>
</pre>
</blockquote>
<br>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Dxspider-support mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dxspider-support@tobit.co.uk">Dxspider-support@tobit.co.uk</a>
<a class="moz-txt-link-freetext" href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a>
</pre>
</blockquote>
<p><br>
</p>
<div class="moz-signature">-- <br>
<a href="https://s50e.si/gorje.html">Gorje, Cerkno h=604m</a></div>
</body>
</html>