BW-OS.com – Why dose this not work?

As of 10/30/2023 BW Broadcast has reassumed ownership of this domain.

The frustration stemming from the utilization of a hardware feature, only to discover it is no longer supported by the vendor, is a sentiment shared by many. I personally experienced this disconcerting situation whenever I accessed a BW transmitter, including the one located at WIID

Upon investigating the status of BW Transmitters, I encountered various update files, none of which were compatible with our specific transmitter model. My pursuit led me to the recently downloaded BW_30W_TX.dat file, which, when examined using 7Zip, revealed itself to be an archive containing an update.

A deeper examination of this archive unveiled a file named “params.xml,” which appeared to hold a substantial amount of configuration data for our transmitter. Within this file, I found a reference to a domain name: bw-os.com.

Upon further inquiry, it became evident that the domain had recently expired. Historical records indicated that its last known owner was as follows:

Registrant Organization: Aquarian Broadcast Group Limited Registrant State/Province: Surrey Registrant Country: UNITED KINGDOM

I quickly registered this domain, and put up a simple PHP script to dump every GET/Post request to a json file.

<?php
// Check if the request method is GET or POST
if ($_SERVER['REQUEST_METHOD'] === 'GET' || $_SERVER['REQUEST_METHOD'] === 'POST') {
    // Get the current data from the JSON file, if it exists
    $jsonData = [];
    if (file_exists('data.json')) {
        $jsonData = json_decode(file_get_contents('data.json'), true);
    }

    // Add the current GET or POST data to the array
    $requestData = [
        'method' => $_SERVER['REQUEST_METHOD'],
        'timestamp' => date('Y-m-d H:i:s'),
        'data' => $_REQUEST, // Contains GET and POST data
    ];
    array_push($jsonData, $requestData);

    // Encode the updated data as JSON
    $jsonData = json_encode($jsonData, JSON_PRETTY_PRINT);

    // Save the JSON data back to the file
    file_put_contents('data.json', $jsonData);

    // Respond to the original request if necessary
    if ($_SERVER['REQUEST_METHOD'] === 'GET') {
        // Handle GET request here
    } elseif ($_SERVER['REQUEST_METHOD'] === 'POST') {
        // Handle POST request here
    }
}
?>

Remarkably, before I even had an opportunity to log in to my BW transmitter and perform a test email, an alert from a TX300 transmitter appeared in the JSON file. An example of this JSON data can be found at www.bw-os.com.

With the assistance of PHPMailer, I expediently established a script to forward these requests to the appropriate email address. Additionally, I created a succinct website utilizing Bootstrap to elucidate the purpose of the domain and provide contact information.

It is worth noting that certain details have been omitted from this account. Specifically, a name and password are transmitted with each transmitter request. These credentials are uniform for all transmitters and likely serve as a means of authentication, ensuring that the API is not exploited for spamming purposes. The new script has been equipped with rate limiting and crawling detection mechanisms to mitigate any potential misuse.