<div dir="auto">Rudy:</div><div dir="auto"><br></div><div dir="auto">These graphs tell a pretty clear story:<br>
<a href="http://www.dxspider.org/gb7djk/msg.html" rel="noreferrer" target="_blank">http://www.dxspider.org/gb7djk/msg.html</a></div><div dir="auto"><br>
-Bill/W9KKN<br>
<br>
On Mon, Feb 17, 2025 at 6:58 AM Keith, G6NHU via Dxspider-support <<a href="mailto:dxspider-support@tobit.co.uk" target="_blank">dxspider-support@tobit.co.uk</a>> wrote:<br>
><br>
> David,<br>
><br>
> See the screenshot I just linked to where it’s clearly obvious they were fake spots. The callsign that submitted them was fake, the IP addresses were faked and the originating nodes were faked. These spots were 100% fraudulently injected into the network.<br>
><br>
> Do you actually know that CR3DX was on those frequencies at that time? That’s just a very small cross section of the submitted fake spots.<br>
><br>
> Let me remind you of this capture I took yesterday which is much the same - Hundreds of spots submitted at the same time by variations of the same callsign, all via different nodes and all on different frequencies. I very much doubt that HH3DX was on over 50 frequencies at the same time.<br>
><br>
> 73 Keith G6NHU<br>
><br>
> 1739695055^(progress) SPOT: HH3DX on 28430.0 @ 0837Z by LX1NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@DH1TW-2 '' route:<br>
> 1739695058^(progress) SPOT: HH3DX on 7058.4 @ 0837Z by LX5NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@K1AX-11 '55' route:<br>
> 1739695059^(progress) SPOT: HH3DX on 7118.3 @ 0837Z by LX3NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@VE2REA 'good signal' route:<br>
> 1739695059^(progress) SPOT: HH3DX on 3635.7 @ 0837Z by LX8NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@CS5ARLC-1 '59 Here' route:<br>
> 1739695059^(progress) SPOT: HH3DX on 3678.0 @ 0837Z by LX2NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@KM3T-10 '59 Here' route:<br>
> 1739695059^(progress) SPOT: HH3DX on 7128.1 @ 0837Z by LX8NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IT9OBK-6 '55' route:<br>
> 1739695059^(progress) SPOT: HH3DX on 21072.2 @ 0837Z by LX2NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@VE7CC-1 'sorry' route:<br>
> 1739695060^(progress) SPOT: HH3DX on 21180.6 @ 0837Z by LX7NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@SV1KP-9 '' route:<br>
> 1739695060^(progress) SPOT: HH3DX on 3599.2 @ 0837Z by LX1NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IK6XMI-12 'SES' route:<br>
> 1739695060^(progress) SPOT: HH3DX on 21235.9 @ 0837Z by LX8NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IV3BVK-5 'strng here' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 3514.1 @ 0837Z by LX4NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@F5MZN-3 'tnx 73s.' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 14084.7 @ 0837Z by LX8NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@GB7RAU '' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 3622.6 @ 0837Z by LX6NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@SQ3MZM-3 '' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 28264.1 @ 0837Z by LX8NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@KD4WLE-3 'tnx QSO' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 3688.4 @ 0837Z by LX1NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@F5UGQ-2 '' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 14177.6 @ 0837Z by LX0NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@EA3KZ-5 'pilup!!!' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 7036.7 @ 0837Z by LX5NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@VE3TOK-1 'award' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 14066.9 @ 0837Z by LX5NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@EA1RCF-5 'tnx qso' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 3671.5 @ 0837Z by LX3NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@WD1L '' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 14144.8 @ 0837Z by LX6NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IR5V 'pilup!!!' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 7097.6 @ 0837Z by LX4NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@KC9AOP-1 '' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 14012.6 @ 0837Z by LX4NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@DJ4PK-2 'TKS 5/9' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 3604.5 @ 0837Z by LX0NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@UA4CC 'UP UP UP!' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 28681.7 @ 0837Z by LX3NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@DB0LJ-6 'thank u 59' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 21058.7 @ 0837Z by LX3NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@KC5CZZ-2 'Thank you' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 21198.5 @ 0837Z by LX3NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IV3BVK-5 'dx' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 14015.9 @ 0837Z by LX6NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@KD4WLE-4 'Good OP' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 28524.4 @ 0837Z by LX6NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@W9BG 'strng here' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 28148.1 @ 0837Z by LX5NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@K5DX 'thank u 59' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 3594.6 @ 0837Z by LX4NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@EA2CW-2 '' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 28098.0 @ 0837Z by LX3NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@HB9ON-8 '59/73' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 28213.6 @ 0837Z by LX8NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IW1QLH-6 'tnx qso' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 28495.7 @ 0837Z by LX7NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@KF8I-3 '59 Here' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 7105.1 @ 0837Z by LX1NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@GB7RAU 'tnx QSO' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 21358.8 @ 0837Z by LX1NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IQ5KG-6 'Thank you' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 7142.4 @ 0837Z by LX1NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@GB7BAA 'qsy' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 28023.8 @ 0837Z by LX5NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@R2AKT-9 '59/73' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 7117.0 @ 0837Z by LX1NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IZ2LSC-99 '' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 7146.4 @ 0837Z by LX6NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@ 'award' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 3545.8 @ 0837Z by LX5NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@EA4FIT-2 'weak signal' route:<br>
> 1739695061^(progress) SPOT: HH3DX on 7028.9 @ 0837Z by LX9NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@M0IPU-4 'award' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 28150.2 @ 0837Z by LX4NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@JE3YEK 'Good OP' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 21016.2 @ 0837Z by LX1NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@DB0FFS 'UP' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 14302.3 @ 0837Z by LX2NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@N6WS-6 'award' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 14138.3 @ 0837Z by LX2NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IZ2LSC-97 'dx' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 28535.4 @ 0837Z by LX8NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@EA4URE-2 '59 PLUS' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 14337.6 @ 0837Z by LX0NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@IT9OBK-6 'Good OP' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 21160.3 @ 0837Z by LX2NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@KB8PMY-3 'weak signal' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 3693.4 @ 0837Z by LX0NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@EA4FIT-2 '' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 28545.0 @ 0837Z by LX1NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@LZ7A '' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 28511.1 @ 0837Z by LX6NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@DB0FFS '59 Here' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 14179.9 @ 0837Z by LX9NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@EA4URE-5 'TNX 73' route:<br>
> 1739695062^(progress) SPOT: HH3DX on 7144.1 @ 0837Z by LX8NX(2001:7e8:f631:a801:3cd2:8551:9b32:5db7)@DL9GTB-1 'TKS 5/9' route:<br>
> On 17 Feb 2025 at 11:47 +0000, David Spoelstra via Dxspider-support <<a href="mailto:dxspider-support@tobit.co.uk" target="_blank">dxspider-support@tobit.co.uk</a>>, wrote:<br>
><br>
> Comment:<br>
><br>
> From the log snippet, I see that CR3DX was spotted on four bands during the ARRL DX CW contest. That's correct. They are a large multi-multi and WERE on four bands at the same time. And, they weren't self-spotting. As a small pistol contestor, when I run assisted mode I'm very grateful for the spots so I can find and verify stations quickly.<br>
><br>
> My concern is that if you kill these legitimate spots, what happens during a contest or if a large DXpedition gets on and runs four bands at once? Will their spots get killed because it's flooding? Or are you killing them because they don't come from legitimate spotters (which I understand)?<br>
><br>
> Personally, I'd like to see at least ONE spot per band or mode get through every X minutes even if it's NOT from a legitimate spotter. Especially during a contest or DXpedition.<br>
><br>
> -David, N9KT<br>
><br>
> On Mon, Feb 17, 2025 at 2:45 AM Kin via Dxspider-support <<a href="mailto:dxspider-support@tobit.co.uk" target="_blank">dxspider-support@tobit.co.uk</a>> wrote:<br>
>><br>
>> Hi,<br>
>><br>
>> From the last attack I have seen the following:<br>
>> * Link crashes with partners. With greater impact on those with less hw<br>
>> resources.<br>
>> * Delays of up to 5 minutes in sending spots to users in some of the larger<br>
>> nodes.<br>
>> * More affected on Windows than on Linux.<br>
>> * On my node with 'set/var $DXProt::senderverify 2' the behaviour was as<br>
>> expected, no forged spots were fake.<br>
>> grep -i "bad spot" 047.dat | wc -l<br>
>> 287005 <-- EA4URE-2<br>
>> 381899 <-- EA3CV-2<br>
>><br>
>> 1739707974^(*) PCPROT: Bad Spot CR3DX on 14089.6 by<br>
>> N3LPT-3(70.139.124.201)@SM4ONW-14 User N3LPT-3 not on node SM4ONW-14, DUMPED<br>
>> 1739707974^(*) PCPROT: Bad Spot CR3DX on 7025.0 by<br>
>> N0LPT-3(70.139.201.124)@SP6MI-2 User N0LPT-3 not on node SP6MI-2, DUMPED<br>
>> 1739707974^(*) PCPROT: Bad Spot CR3DX on 28431.4 by<br>
>> N3LPT-3(70.139.124.201)@PA0ESH-3 User N3LPT-3 not on node PA0ESH-3, DUMPED<br>
>> 1739707974^(*) PCPROT: Bad Spot CR3DX on 21132.3 by<br>
>> N5LPT-3(70.124.139.201)@GB7NHR User N5LPT-3 not on node GB7NHR, DUMPED<br>
>> 1739707974^(*) PCPROT: Bad Spot CR3DX on 28438.0 by<br>
>> N0LPT-3(70.201.139.124)@PI1LAP-1 User N0LPT-3 not on node PI1LAP-1, DUMPED<br>
>><br>
>> On my other node without enabling this feature, thousands of them were<br>
>> received.<br>
>> * The attack was based on varying the fields: spotted, comment, spotter,<br>
>> spotter ip and source node.<br>
>> * It appears that the spots were not sent from the source nodes listed in<br>
>> the spots. I have verified that the ones where my node appears as the source<br>
>> node, did not come from my node, so I think that this must have happened to<br>
>> most of them.<br>
>><br>
>> My own conclusions<br>
>> * Dirk's algorithm was successful for nodes that used $DXProt::senderverify<br>
>> to remove dupes.<br>
>> * If the attack had been without 'dupes', it could not have been stopped.<br>
>> * The flood of spots that inundated the network clearly affected nodes with<br>
>> fewer resources, with a less efficient OS or with a sw other than spider.<br>
>><br>
>> Kin EA3CV<br>
>><br>
>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> Dxspider-support mailing list<br>
>> <a href="mailto:Dxspider-support@tobit.co.uk" target="_blank">Dxspider-support@tobit.co.uk</a><br>
>> <a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" rel="noreferrer" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a><br>
><br>
> _______________________________________________<br>
> Dxspider-support mailing list<br>
> <a href="mailto:Dxspider-support@tobit.co.uk" target="_blank">Dxspider-support@tobit.co.uk</a><br>
> <a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" rel="noreferrer" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a><br>
><br>
> _______________________________________________<br>
> Dxspider-support mailing list<br>
> <a href="mailto:Dxspider-support@tobit.co.uk" target="_blank">Dxspider-support@tobit.co.uk</a><br>
> <a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" rel="noreferrer" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a><br>
</div>