[CQ-Contest] Strange DX-Spots in WAE SSB ..

[Fabian Kurz]

Hello,

thanks to the OH2AQ-Webcluster's facility to retrieve the originating 
IP-Address for Spots entered via the HTTP-Interface, I could collect some 
interesting information about some spots in the recent WAE SSB Contest... 
just have a look:

SPOT:
Sep 13 09:37 2003 DX de OZ1HPS-@:  21295.3  4L6AM        WAE 
TEST                       0937Z      62.168.189.31

A 'WHOIS'-lookup of the IP-address revelaed:

inetnum:      62.168.160.0 - 62.168.191.255
netname:      GE-CN-20030212
descr:        Caucasus Network Ltd.
descr:        PROVIDER LOCAL REGISTRY
country:      GE

So this Spot was sent from Georgia, obvioulsy NOT from Denmark. OZ1HPS 
later complained on the cluster about his call being abused.


Next candidate:

Sep 14 04:23 2003 DX de 
AI1G-@:     3789.0  CQ0T         WAE                            0423Z 
193.126.128.219

WHOIS-Lookup-Result:

inetnum:      193.126.128.0 - 193.126.191.255
netname:      KQPT-IOL-DIALUP
descr:        KPNQwest Portugal / IOL ISP
country:      PT

This Spot was definitely coming from Portugal, not from the US. Furthermore 
the callsign AI1G is not currently issued.

Some hours later, another spot of CQ0T:

Sep 14 15:55 2003 DX de 
K2EFV-@:   21271.0  CQ0T         WAE                            1555Z 
194.65.14.75

And again the lookup reveals that this spot was coming from Portugal, 
another ISP this time though.. Again, K2EFV is not an issued Callsign.

inetnum:      194.65.0.0 - 194.65.255.255
netname:      PT-TELEPAC-960515
descr:        Provider Local Registry
descr:        Telepac - Comunicacoes Interactivas, SA
country:      PT


Lets go on ... YL2LY being spotted by JA's... the calls look familiar but 
actually they're just very similar to stations who are actually active 
(JK1OLT, JQ2EHG ...). All spots are originating from the same IP.

Sep 14 08:19 2003 DX de 
JK1OLM-@:  21237.0  YL2LY                                       0819Z 
81.94.226.141
Sep 14 08:50 2003 DX de 
JQ2EHH-@:  21236.9  YL2LY                                       0850Z 
81.94.226.141
Sep 14 10:31 2003 DX de 
JJ4PPK-@:  21225.0  YL2LY                                       1031Z 
81.94.226.141
Sep 14 11:59 2003 DX de 
YL2CV-@:   14222.0  YL2LY                                       1159Z 
81.94.226.141
Sep 14 15:00 2003 DX de 
UA9FMZ-@:  14206.8  YL2LY                                       1500Z 
81.94.226.141
Sep 14 14:04 2003 DX de 
VE3YQY-@:  21218.0  YL2LX                                       1404Z 
81.94.226.141

Looking up that IP-Address reveals...

inetnum:      81.94.226.128 - 81.94.226.143
netname:      PCABC-NET
descr:        PCABC SIA
descr:        Computer equipment supplier and local ISP in Kuldiga region.
descr:        Address Liepâjas street 23, LV3301, Kuldiga.
country:      LV

... that they're obviously from Lativa.

Another one: EA7FTR being spotted by fake-callsigns, interestingly all from 
the same IP-Address...

Sep 14 10:45 2003 DX de JA2SFH-@:  21333.2  EA7FTR       wae fb 
sig                     1045Z      80.58.11.170
Sep 14 13:03 2003 DX de 
WS3YA-@:   21318.0  EA7FTR       WAE                            1303Z 
80.58.11.170
Sep 14 15:14 2003 DX de 
KI9HF-@:   21312.7  EA7FTR       WAE                            1514Z 
80.58.11.170
Sep 14 16:27 2003 DX de 
AG4YT-@:   21330.0  EA7FTR       wae                            1627Z 
80.58.11.170

... which belongs to an ISP in Spain.

inetnum:      80.58.0.0 - 80.58.24.255
netname:      RIMA
descr:        Telefonica de Espana SAU
descr:        Red de servicios IP
descr:        Spain
country:      ES


RW3RN is one of the few honest chaps around: At least he uses his own 
callsign for self-spotting ;)

Sep 14 13:08 2003 DX de 
RW3RN-@:   21271.8  RW3RN        WAE                            1308Z 
213.135.132.39
inetnum:      213.135.132.0 - 213.135.132.255
netname:      TMBNET
descr:        Dynamic IP pool for access server 2
country:      RU


And this seemed strange, too: How can a EC3 (Spain, Mainland) and EC6 
(Balearic-Islands) use the same IP-Adress?

Sep 14 13:35 2003 DX de 
EC3TGI-@:  21284.5  EA6AEQ       wae                            1335Z 
80.58.41.46
Sep 14 13:38 2003 DX de EC6TT-@:   21284.5  EA6AEQ       CQ WAE 
CONTEST                 1338Z      80.58.41.46
Sep 14 14:01 2003 DX de 
EC6TT-@:   21282.0  EA6AEQ       wae                            1401Z 
80.58.41.46


Also this Frenchman hust have had trouble with his local ISP, so he dialed 
up to a SP-ISP...

Sep 14 11:02 2003 DX de F5CBU-@:   21308.0  SO6Y         WAE 
Contest                    1102Z      213.77.157.180
inetnum:      213.77.157.128 - 213.77.157.255
netname:      OLAWA-SDI
descr:        TP S.A. SDI
descr:        Olawa Centrum Wroclaw
country:      PL

... or it was just a lonely Pole who tried to increase his rate!

During the contest there were many Spots from PY1/PU1's spotting ZW1M, all 
from the same address.. maybe they joined together at the clubstation to 
make a spot-festival, nothing wrong with that, but these Italian spots are 
100% bogus:

Sep 14 19:46 2003 DX de 
IZ5EME-@:  14198.0  ZW1M         wae                            1946Z 
200.149.160.20
Sep 14 19:48 2003 DX de 
IK5EME-@:  14198.0  ZW1M         wae                            1948Z 
200.149.160.20

inetnum:     200.149.128/17
aut-num:     AS7738
abuse-c:     CGR13
owner:       Telemar Norte Leste S.A.
ownerid:     002.558.134/0001-58
responsible: Marcello Lugon
address:     Rua Humberto de Campos, 425, 7º andar
address:     22430-190 - Rio de Janeiro - RJ


These above examples were collected in a few hours only by analyzing the 
Spots at OH2AQ.
In all cases faked or pirated calls have been used to do selfspots, or 
possibly for
spotting a friend etc. I am sure that this is only the 'tip of the iceberg' 
because many
people are using telnet-dx-cluster where it's not so easy (except for the 
Sysops) to trace
back spots; these will never be revealed, if the Sysop's security policy 
does not change.

If I had included all the obvious semi-selfspotting, (by operator-calls, 
friend's-calls
etc.) this e-mail would probably have been thrice as long...

I know this won't help to stop the cheating, but I just find it worth 
mentioning and this
is a true evidence of poorest OP technique ...

Self-Spotting itself is - by the way - not explicitly forbidden in the 
contest rules, but
'unsportsmanship conduct' *is* a reason for disqualification ... just for 
consideration ..

73, Fabian DJ1YFK (maybe a lid, but certainly not cheating in contests ;)

PS: Congrats for Z31GX for sending 10 Spots for Z38AV within exactly 30 
minutes.

Sep 14 21:56 2003 DX de Z31GX-@:   14298.3  Z38AV        CQ DX-WAE 
TEST                 2156Z      62.162.20.117
Sep 14 21:57 2003 DX de Z31GX-@:   14298.3  Z38AV        CQ DX-WAE 
TEST                 2157Z      62.162.20.117
Sep 14 21:57 2003 DX de Z31GX-@:   14298.3  Z38AV        WAE test. Looking 
for DX       2157Z      62.162.20.117
Sep 14 21:59 2003 DX de Z31GX-@:   14298.3  Z38AV        WAE test. Looking 
for QTC a    2159Z      62.162.20.117
Sep 14 22:03 2003 DX de Z31GX-@:   14298.3  Z38AV        Very loud. WAE 
test. OUT EU    2203Z      62.162.20.117
Sep 14 22:04 2003 DX de Z31GX-@:   14298.3  Z38AV        Very loud. WAE 
test. OUT EU    2203Z      62.162.20.117
Sep 14 22:04 2003 DX de Z31GX-@:   14298.3  Z38AV        WAE test. Looking 
for DX       2204Z      62.162.20.117
Sep 14 22:18 2003 DX de Z31GX-@:   14298.4  Z38AV        WAE CQ DX...Out 
EU             2218Z      62.162.20.117
Sep 14 22:19 2003 DX de Z31GX-@:   14298.4  Z38AV        WAE CQ DX...Out 
EU             2219Z      62.162.20.117
Sep 14 22:26 2003 DX de Z31GX-@:   14298.4  Z38AV        Very loud Need DX 
for test     2226Z      62.162.20.117