<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Hi</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Exactly the same bot at work like last
last year with CQWW contest. Already set up iptables firewall rule
rejected subnet 94.156.203.0/24 here.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">GL Dan</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"> <br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<blockquote type="cite"
cite="mid:ef49fd26-cfd9-162d-294a-ce3256235d9c@tobit.co.uk">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<font size="+1"><font face="monospace">There is a bot out there
that delights in trying to confuse the Contest Committee's log
checking process and/or causing contestants' problems by
posting spurious spots using their callsign. It does this by
logging in to a node, "sniping" a spot and then immediately
disconnecting.<br>
<br>
Here are some examples:<br>
<br>
13:15:59 (progress) CMD: 'show/cluster ' by LZ1JZ ip:
217.61.58.23 1mS<br>
13:16:00 (progress) CMD: 'DX YL2KO 14082.2' by LZ1JZ ip:
217.61.58.23 1mS<br>
13:16:00 (progress) CMD: 'bye ' by LZ1JZ ip: 217.61.58.23 45mS<br>
13:16:25 (progress) CMD: 'show/cluster ' by CT1GFQ ip:
217.61.58.23 0mS<br>
13:16:25 (progress) CMD: 'DX ZF1A 28127.6' by CT1GFQ ip:
217.61.58.23 1mS<br>
13:16:25 (progress) CMD: 'bye ' by CT1GFQ ip: 217.61.58.23
12mS<br>
13:18:18 (progress) CMD: 'show/cluster ' by DK5QN ip:
217.61.58.23 0mS<br>
13:18:18 (progress) CMD: 'DX NY3A 21067.2' by DK5QN ip:
217.61.58.23 1mS<br>
13:18:18 (progress) CMD: 'bye ' by DK5QN ip: 217.61.58.23 13mS<br>
13:55:21 (progress) CMD: 'show/cluster ' by VK6POP ip:
217.61.58.23 0mS<br>
13:55:21 (progress) CMD: 'DX W3UA 21022.5' by VK6POP ip:
217.61.58.23 1mS<br>
13:55:21 (progress) CMD: 'bye ' by VK6POP ip: 217.61.58.23
10mS<br>
13:55:32 (progress) CMD: 'show/cluster ' by EA3HXV ip:
217.61.58.23 0mS<br>
13:55:32 (progress) CMD: 'DX MI5I 14012.5' by EA3HXV ip:
217.61.58.23 2mS<br>
13:55:32 (progress) CMD: 'bye ' by EA3HXV ip: 217.61.58.23
23mS<br>
</font></font><br>
<font size="+1" face="monospace">To try and reduce this as much as
possible, please would you block this ip address </font><font
size="+1" face="monospace"><font size="+1"><font
face="monospace">217.61.58.23 </font></font>(or its subnet
</font><br>
<font size="+1" face="monospace"><font size="+1"><font
face="monospace">217.61.58.0/24) using your firewall (in
your router). If you are running Linux/BSD you could
consider installing UFW or similar software to help with
this task. <br>
<br>
</font></font>73 Dirk G1TLH<br>
</font> <br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Dxspider-support mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dxspider-support@tobit.co.uk">Dxspider-support@tobit.co.uk</a>
<a class="moz-txt-link-freetext" href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a>
</pre>
</blockquote>
<br>
</body>
</html>