<div dir="auto"><p dir="ltr">Whois response for those IPs...</p>
<p dir="ltr">150.102.129.109 - Early Registration address allocated to Brisbane, Australia. </p><p dir="ltr">188.47.125.123 - PTK Centertel, Warsaw, Poland</p><p dir="ltr">IP address from 3 fake spots find in my debug logs...</p><p dir="ltr">158.44.145.79 - Early Registration address, Trigem Computer Inc., Korea</p><p dir="ltr">Chris, WI3W</p></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Feb 25, 2025, 15:27 Keith, G6NHU via Dxspider-support <<a href="mailto:dxspider-support@tobit.co.uk" target="_blank" rel="noreferrer">dxspider-support@tobit.co.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div name="messageBodySection">
<div dir="auto"><span style="font-family:Arial;font-size:16px">Are there any other variations of the same IP?</span><span style="font-size:16px"><br></span><span style="font-size:16px"><br></span><span style="font-family:Arial;font-size:medium">73 Keith</span></div>
</div>
<div name="messageReplySection">On 25 Feb 2025 at 18:50 +0000, Kin via Dxspider-support <<a href="mailto:dxspider-support@tobit.co.uk" rel="noreferrer noreferrer" target="_blank">dxspider-support@tobit.co.uk</a>>, wrote:<br>
<blockquote type="cite" style="border-left-color:grey;border-left-width:thin;border-left-style:solid;margin:5px 5px;padding-left:10px">Same IP (188.47.125.123) with two callsigns (HF95PZK and SP2MKI) on two<br>
different nodes (SR2PUT and SR4DXC):<br>
<br>
PC92^SR2PUT^2334^A^^1HF95PZK:188.47.125.123^H93^<br>
PC92^SR4DXC^67551^A^^1HF95PZK:188.47.125.123^H95^<br>
PC92^SR2PUT^85952^A^^1SP2MKI:188.47.125.123^H95^<br>
<br>
Kin EA3CV<br>
<br>
<br>
-----Mensaje original-----<br>
De: Dxspider-support <<a href="mailto:dxspider-support-bounces@tobit.co.uk" rel="noreferrer noreferrer" target="_blank">dxspider-support-bounces@tobit.co.uk</a>> En nombre de<br>
Gregor Surmann via Dxspider-support<br>
Enviado el: martes, 25 de febrero de 2025 18:45<br>
Para: The DXSpider Support list <<a href="mailto:dxspider-support@tobit.co.uk" rel="noreferrer noreferrer" target="_blank">dxspider-support@tobit.co.uk</a>><br>
CC: Gregor Surmann <<a href="mailto:gs@funil.de" rel="noreferrer noreferrer" target="_blank">gs@funil.de</a>><br>
Asunto: [Dxspider-support] Further analysis of fake spots<br>
<br>
Hello guys!<br>
<br>
I have found some interesting stuff. I was seeking for the information, if<br>
my SSID/Call was forged. Yes, it was:<br>
<br>
sysop@dxspider:~$ grepdbg "bad spot" | grep -i do5ssb<br>
21Feb2025@13:03:32 (*) PCPROT: Bad Spot HF95PZK on 21074.0 by<br>
SP2MKI(150.102.129.109)@DO5SSB-2 User SP2MKI not on node DO5SSB-2 via F3KT-3<br>
25 hops<br>
<br>
sysop@dxspider:~$ grepdbg HF95PZK | grep -i SP2MKI<br>
21Feb2025@05:53:38 (*) PCPROT: Bad Spot HF95PZK on 3573.0 by<br>
SP2MKI(81.89.113.246)@JG1VGX-8 User SP2MKI not on node JG1VGX-8 via ON4KST-2<br>
28 hops<br>
21Feb2025@05:53:38 (progress) SPOT: HF95PZK on 3573.0 @ 0553Z by<br>
SP2MKI(81.89.113.246)@JG1VGX-8 '95th PZK - 100th IARU FT8' route: ON4KST-2<br>
21Feb2025@06:47:40 (*) PCPROT: Bad Spot HF95PZK on 7074.0 by<br>
SP2MKI(145.89.214.218)@ON4KST-2 User SP2MKI not on node ON4KST-2 via<br>
ON4KST-2 28 hops<br>
21Feb2025@06:47:40 (progress) SPOT: HF95PZK on 7074.0 @ 0647Z by<br>
SP2MKI(145.89.214.218)@ON4KST-2 'ft8 95th PZK - 100th IARU' route: ON4KST-2<br>
21Feb2025@08:48:22 (*) PCPROT: Bad Spot HF95PZK on 7047.0 by<br>
SP2MKI(54.225.51.18)@EA4FIT-2 User SP2MKI not on node EA4FIT-2 via ON4KST-2<br>
28 hops<br>
21Feb2025@08:48:22 (progress) SPOT: HF95PZK on 7047.0 @ 0848Z by<br>
SP2MKI(54.225.51.18)@EA4FIT-2 '95th PZK - 100th IARU FT4' route: ON4KST-2<br>
21Feb2025@09:10:13 (*) PCPROT: Bad Spot HF95PZK on 14080.0 by<br>
SP2MKI(36.134.227.136)@IV3SCP-6 User SP2MKI not on node IV3SCP-6 via F6KVP-3<br>
26 hops<br>
[...more...spots...]<br>
21Feb2025@22:44:41 (*) PCPROT: Bad Spot HF95PZK on 7047.0 by<br>
SP2MKI(59.181.166.39)@SM7IUN-3 User SP2MKI not on node SM7IUN-3 via ON4KST-2<br>
28 hops<br>
<br>
sysop@dxspider:~$ grepdbg 150.102.129.109 sysop@dxspider:~$<br>
<br>
So, there was never a user with the IP 150.102.129.109 here, but the spot<br>
originated at DO5SSB-2, strange.<br>
<br>
This means, that someone is injecting packets at some point in the network,<br>
without being on the node itself, not before, not while and not after the<br>
spot.<br>
<br>
Or, maybe the famous VE7CC-1 is doing nasty stuff?<br>
<br>
All of the IPs do exist in the global BGP routing, many of them are in AWS<br>
or other data centers.<br>
<br>
But probably none of the IPs are from the countries the callsign is in.<br>
<br>
So, either someone is using the clusters and faking spots, or someone is<br>
injecting PC messages somewhere.<br>
<br>
73 de Gregor, DO5SSB<br>
<br>
_______________________________________________<br>
Dxspider-support mailing list<br>
<a href="mailto:Dxspider-support@tobit.co.uk" rel="noreferrer noreferrer" target="_blank">Dxspider-support@tobit.co.uk</a><br>
<a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" rel="noreferrer noreferrer" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a><br>
<br>
<br>
_______________________________________________<br>
Dxspider-support mailing list<br>
<a href="mailto:Dxspider-support@tobit.co.uk" rel="noreferrer noreferrer" target="_blank">Dxspider-support@tobit.co.uk</a><br>
<a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" rel="noreferrer noreferrer" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a><br></blockquote>
</div>
</div>
_______________________________________________<br>
Dxspider-support mailing list<br>
<a href="mailto:Dxspider-support@tobit.co.uk" rel="noreferrer noreferrer" target="_blank">Dxspider-support@tobit.co.uk</a><br>
<a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" rel="noreferrer noreferrer noreferrer" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a><br>
</blockquote></div>