<html><body><div dir="auto">I suppose there are some more. These are the ones I have detected on the network.<br></div><div dir="auto"><br></div><div dir="auto">Kin</div><div dir="auto"><br></div><div id="ms-outlook-mobile-signature" dir="auto"><div><br></div>Enviado desde <a href="https://aka.ms/AAb9ysg">Outlook para Android</a></div><div dir="auto" id="mail-editor-reference-message-container"><br><hr style="display:inline-block;width:98%"><div id="divRplyFwdMsg" style="font-size: 11pt;"><strong>De:</strong> Dxspider-support <dxspider-support-bounces@tobit.co.uk> en nombre de Keith, G6NHU via Dxspider-support <dxspider-support@tobit.co.uk><br><strong>Enviado:</strong> miércoles, enero 29, 2025 9:14:40 p. m.<br><strong>Para:</strong> The DXSpider Support list <dxspider-support@tobit.co.uk><br><strong>CC:</strong> Keith, G6NHU <g6nhu@me.com><br><strong>Asunto:</strong> Re: [Dxspider-support] Spot with False Origin Nodes<br></div><br>
<div name="messageBodySection">
<div dir="auto"><span style="font-family:Arial; font-size:medium">Is this a complete list of all the callsigns in the WWA thing?</span><span style="font-size:medium"><br></span><span style="font-size:medium"><br></span><span style="font-family:Arial; font-size:medium">I’m loathe to do this because there are genuine spots for these stations. It’s the bad actors injecting forced spots that I object to. </span><span style="font-size:medium"><br></span><span style="font-size:medium"><br></span><span style="font-family:Arial; font-size:medium">73 Keith.</span><span style="font-size:medium"><br></span></div>
</div>
<div name="messageReplySection">On 29 Jan 2025 at 16:46 +0000, Kin via Dxspider-support <dxspider-support@tobit.co.uk>, wrote:<br>
<blockquote type="cite" style="border-left-color:grey; border-left-width:thin; border-left-style:solid; margin:5px 5px; padding-left:10px">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">Anthony,</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US"> </span></p>
<p class="MsoNormal"><span class="SpellE"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">From</span></span> <span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US"><span class="SpellE">your</span> spider <span class="SpellE">console</span>, <span class="SpellE">you</span> <span class="SpellE">must</span> run <span class="SpellE">the</span> <span class="SpellE">following</span>:</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US"> </span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">set/<span class="SpellE">badword</span> WWA</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">set/<span class="SpellE">baddx</span> 8E3R BY8GA BY4DX HB9WWA CR6WWA IR1WWA</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">set/<span class="SpellE">baddx</span> II0WWA II1WWA II2WWA II3WWA II4WWA II5WWA II6WWA II7WWA II8WWA II9WWA</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">set/<span class="SpellE">baddx</span> EG1WWA EG2WWA EG3WWA EG4WWA EG5WWA EG6WWA EG7WWA EG8WWA EG9WWA</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">set/<span class="SpellE">baddx</span> E7W CQ7WWA GB2WWA DA0WWA EN0U GB6WWA A91WWA</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">set/<span class="SpellE">baddx</span> WWA 3WWA UP7WWA PA25WWA S53WWA A43WWA RW1F</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">set/<span class="SpellE">baddx</span> SN3WWA SN4WWA HZ1WWA CR5WWA OL5WWA 3Z6I</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US"> </span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US">Kin</span></p>
<p class="MsoNormal"><span style="mso-bidi-font-size:11.0pt; font-family:"Calibri",sans-serif; mso-bidi-font-family:"Times New Roman"; mso-fareast-language:EN-US"> </span></p>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; mso-fareast-font-family:"Times New Roman"">De:</span></b> <span style="font-size:11.0pt; font-family:"Calibri",sans-serif; mso-fareast-font-family:"Times New Roman"">Dxspider-support <dxspider-support-bounces@tobit.co.uk> <b>En nombre de</b> Anthony (N2KI) via Dxspider-support<br>
<b>Enviado el:</b> miércoles, 29 de enero de 2025 15:50<br>
<b>Para:</b> The DXSpider Support list <dxspider-support@tobit.co.uk><br>
<b>CC:</b> Anthony (N2KI) <n2ki.ham@gmail.com><br>
<b>Asunto:</b> Re: [Dxspider-support] Spot with False Origin Nodes</span></p>
</div>
<p class="MsoNormal"> </p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">With all the fraud being reported and what should be blocked and how, I ,for one, would appreciate a list of items to be blocked and the command to use to do so. I am not as astute in linux as most. Thank you.</span></p>
</div>
<p class="MsoNormal"><br clear="all" style="mso-special-character:line-break"></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"> <br>
<b>Regards,<br>
<br>
Anthony </b></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b> N2KI</b><br>
<br>
<br>
<br>
<br>
<br style="mso-special-character:line-break"></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"> </p>
</div>
<p class="MsoNormal"> </p>
<div>
<div>
<p class="MsoNormal">On Wed, Jan 29, 2025 at 8:58<span style="font-family:"Arial",sans-serif"> </span>AM Keith, G6NHU via Dxspider-support <<a href="mailto:dxspider-support@tobit.co.uk">dxspider-support@tobit.co.uk</a>> wrote:</p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; mso-border-left-alt:solid #CCCCCC .75pt; padding:0cm 0cm 0cm 6.0pt; margin-left:4.8pt; margin-right:0cm">
<div>
<div name="messageBodySection">
<div>
<p class="MsoNormal">Shouldn’t that all be baddx, not badnode?<br>
<br>
I’m inclined to agree with Kin here, if these are being generated and fed into the network in the way he’s describing it then it’s fraudulent and we should be blocking it.<br>
<br>
This award thing is due to end in a couple of days, it’s been almost double the size this year compared to last year and I’d love to see an analysis of how many ‘WWA’ spots have been posted this month. They appear to run events all throughout the year (which people pay for), but this is the biggest.<br>
<br>
The technology behind it all looks impressive but they do appear to be abusing the cluster network. The handful of hours of potential self-spotting pales into insignificance compared to this.<br>
<br>
With the WWA thing ending in two days, there’s a chance this gets forgotten about until it happens again next year.<br>
<br>
73 Keith.</p>
</div>
</div>
<div name="messageReplySection">
<p class="MsoNormal">On 29 Jan 2025 at 13:38 +0000, Kin via Dxspider-support <<a href="mailto:dxspider-support@tobit.co.uk">dxspider-support@tobit.co.uk</a>>, wrote:<br style="mso-special-character:line-break"></p>
<blockquote style="margin-left:3.75pt; margin-top:3.75pt; margin-right:3.75pt; margin-bottom:3.75pt">
<p class="MsoNormal">I have been analysing the logs, and I can see that the same thing is<br>
happening to every node I check.<br>
It seems that a list of all active nodes has been generated and is being<br>
used as a pool to create spots with fake IPs, and probably with spoofed<br>
spotters.<br>
<br>
So far, I have gathered the following:<br>
<br>
set/badword WWA<br>
set/badnode 8E3R BY8GA BY4DX HB9WWA CR6WWA<br>
set/badnode II0WWA II1WWA II2WWA II3WWA II4WWA II5WWA II6WWA II7WWA II8WWA<br>
II9WWA<br>
set/badnode EG4WWA II0WWA E7W CQ7WWA GB2WWA DA0WWA EN0U OL5WWA SN4WWA<br>
set/badnode WWA 3WWA UP7WWA CR6WWA GB2WWA PA25WWA DA0WWA S53WWA OL5WWA<br>
A43WWA<br>
set/badnode EG2WWA EG4WWA EG6WWA EG5WWA EG7WWA EG8WWA EG9WWA SN4WWA HZ1WWA<br>
<br>
<br>
Kin<br>
<br>
<br>
-----Mensaje original-----<br>
De: Dxspider-support <<a href="mailto:dxspider-support-bounces@tobit.co.uk">dxspider-support-bounces@tobit.co.uk</a>> En nombre de Kin<br>
via Dxspider-support<br>
Enviado el: miércoles, 29 de enero de 2025 14:12<br>
Para: 'The DXSpider Support list' <<a href="mailto:dxspider-support@tobit.co.uk">dxspider-support@tobit.co.uk</a>><br>
CC: Kin <<a href="mailto:ea3cv@cronux.net">ea3cv@cronux.net</a>><br>
Asunto: [Dxspider-support] Spot with False Origin Nodes<br>
<br>
Hi,<br>
<br>
Since the 27th, I have started seeing spots appearing from my EA3CV-3 node.<br>
<br>
It is impossible for these spots to have originated from my node, as it is<br>
password-protected.<br>
I fear that other nodes may be experiencing the same issue.<br>
This started after we raised concerns about a node that couldn't identify<br>
its connection and used a time string in the comment field-remember? Well,<br>
now that node is no longer visible, and the spots no longer contain that<br>
string, yet multiple spots are still being sent.<br>
<br>
1737969291^(chan) <- I PI4CC PC61^18104.0^II5WWA^27-Jan-2025^0914Z^FT4 award<br>
Worldwide^IK5FKE^EA3CV-3^54.7.76.202^H30^~<br>
1737985919^(chan) <- I PI4CC PC61^21031.0^8E3R^27-Jan-2025^1351Z^CW WWA25<br>
<a href="http://ham.cm/wwa">ham.cm/wwa</a>^YB1CDA^EA3CV-3^24.89.103.72^H30^~<br>
1738058541^(chan) <- I PI4CC PC61^21074.0^8E3R^28-Jan-2025^1002Z^2025 WWA<br>
ft8^YB3CUG^EA3CV-3^159.16.127.210^H30^~<br>
1738061474^(chan) <- I PI4CC PC61^14034.0^II4WWA^28-Jan-2025^1051Z^cw thanks<br>
wwa^I4GAD^EA3CV-3^185.120.124.165^H30^~<br>
1738135942^(chan) <- I PI4CC PC61^7162.0^II2WWA^29-Jan-2025^0732Z^<br>
^IK2YCW^EA3CV-3^131.4.148.117^H30^~<br>
1738154649^(chan) <- I PI4CC PC61^28023.0^II3WWA^29-Jan-2025^1244Z^tu<br>
wwa^IV3ZXQ^EA3CV-3^218.41.168.166^H30^~<br>
<br>
I am going to block EVERYTHING related to the event these spots carry,<br>
including the DX stations.<br>
<br>
Kin EA3CV<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
Dxspider-support mailing list<br>
<a href="mailto:Dxspider-support@tobit.co.uk">Dxspider-support@tobit.co.uk</a><br>
<a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a><br>
<br>
<br>
_______________________________________________<br>
Dxspider-support mailing list<br>
<a href="mailto:Dxspider-support@tobit.co.uk">Dxspider-support@tobit.co.uk</a><br>
<a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a></p>
</blockquote>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Dxspider-support mailing list<br>
<a href="mailto:Dxspider-support@tobit.co.uk">Dxspider-support@tobit.co.uk</a><br>
<a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a></p>
</blockquote>
</div>
</div>
_______________________________________________<br>
Dxspider-support mailing list<br>
Dxspider-support@tobit.co.uk<br>
https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support<br></blockquote>
</div>
<br></div></body></html>