kiwi_nc.py ?

DenBozDenBoz
in Configuration and Operation

got me a question.


i see a lot of users from all difrent locations connect

and they all seem to have the name kiwi_nc.py

is this some sort of hacking or? is this something legit? they listen to diffrent frequencys though... tnx !!

Comments

  • scratchmoneyscratchmoney

    I am getting hammered by these guys too. A bunch of different subnets from Philippines, El Salvador, etc. They are taking up all my slots. I ban a few subnets and they pop right back up like someone is using a botnet to do radio recon. They always tune to 5514 iq using the name kiwi_nc.py:

    image.png

    @jks How hard would it be to incorporate banning by username? I thought about just making an ipsets blocklist, but there are so many that I can't keep up.

  • IK8SUTIK8SUT

    @jks Please how to block kiwi_nc.py . It's possible enable banning for this name? This day occupied all slot with connection at 5 mhz from multiple ip and nations ... Help!

  • scratchmoneyscratchmoney
    edited June 28

    Here is a list of IPs they have used from just one of my kiwis, filtered to the username 'kiwi_nc.py'. They are all over the world (or using some rando VPN maybe), but appear to be in sketchy locations. See attached log for the list.


  • dl7awldl7awl

    Please how to block kiwi_nc.py . It's possible enable banning for this name?

    If one name is blocked, another will be used. Could become an endless game, I fear.

  • HB9TMCHB9TMC
    edited June 28

    See this thread: https://forum.kiwisdr.com/index.php?p=/discussion/3239/cloud-listening-to-hfdl-frequencies


    You can try to set "Number of simultaneous channels available for connection by non-Kiwi apps" to "none". Then they should be kicked after ~10 seconds. Normally they give up after a few tries and don't come back for a few hours.

  • jolo22jolo22

    This happened to me too, really fills up the slots.

  • KU4BYKU4BY

    I got hit by them a couple times earlier this week and then it stopped. Yesterday I had a few pop in here and there but that was it. Today, I got slammed on both receivers. I let it ride for a while to see if I could figure out what they were up to. I had 228 unique IP addresses on rcvr 1 and 130 on rcvr 2. I didn't compare the 2 lists to filter out dupes. They were recording about 10 different frequencies. They would stay connected anywhere from 30 seconds to 30 minutes and, like others have mentioned, are coming from IP addresses all over the world and as soon as you blocked one address, 3 more would show up. I finally got tired of messing with it and disabled non-kiwi apps and that took care of it. I'm probably going to open them back up tomorrow to grab more IPs for the black list though as I hate having to disable anything barring security issues. Attached are the IPs that I got from today on rcvr1 and rcvr2 in case anyone wants to compare.


  • scratchmoneyscratchmoney
    edited June 29

    >You can try to set "Number of simultaneous channels available for connection by non-Kiwi apps" to >"none".

    Yes, but then that also will block TDoA I think, which I would like to let people use.

    DenBoz
Sign In or Register to comment.