Deconstructing Mongo – A SysAdmin’s POV

This isn’t really a “Carping Comment”, more of an “over-enthused” one, but I’m putting it in the “Carping Comments” category as that’s the closest I’ve got. The basic point being that this isn’t just some Regular Reader making a Regular Comment; and I’m commenting on it / analyzing it; so more of a meta-comment treatment as in Carping Comments.

Every day I get a load of “odd comments”. Mostly these will auto-filter into SPAM and take no attention from me. The SPAM Topic Of The Day tends to wander around. Right now it’s “Poker” (and pointing to poker urls) along with some amount of pushing CBD oil and “vaping” shops.

Every so often you get some comments that are just not quite right, but seem written to address the topic du jour. (Many SPAM comments are targeted at threads that are still open, but that have been quiet for months, so that’s also a bit of a ‘tell’).

This does look like the comment is aimed at the topic, and is current, so passes the first test.

Next up I look at the Name and the EMAIL address. Do they look related and legit? So a posting from Mary Sue with an email of HotBabesRus.com is suspicious, especially if aimed at a topic like “How to make pizza” and discussing on-line pleasure palaces…

So what’s this one got?

Mongo
end@this.com

As already pointed out “Mongo” is a character from Blazing Saddles. While aliases, even cute ones, are OK, they get a bit more scrutiny than things that look like a Real Name ™ and where the email matches.

In this case, the email address also looks suspiciously like a joke. It was posted at the Portland PD article.

So we check it.

root@XU4uDevuan3:/# nslookup this.com
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: this.com
Address: 72.52.225.65

Well, the server certainly exists. I wasn’t expecting that, but it is a real IP number and name per “nslookup”. Now we do a “whois” on the number. I’m going to delete some lines as it is rather long:

root@XU4uDevuan3:/# whois 72.52.225.65
{normal ARIN nag deleted. -EMS}
NetRange: 72.52.128.0 – 72.52.255.255
CIDR: 72.52.128.0/17
NetName: LIQUIDWEB
[…]
Organization: Liquid Web, L.L.C (LQWB)
RegDate: 2006-08-03
Updated: 2016-12-19
[…]
City: Lansing
StateProv: MI
PostalCode: 48917
Country: US
RegDate: 2001-07-20
Updated: 2020-04-29
[…]
OrgTechName: IP Administrator
OrgTechPhone: +1-800-5xx-xxxx
OrgTechEmail: FOO@liquidweb.com
{Has normal IP Admin phone number and email address. I’m masking it. E.M.S.}

So the site is real and legit, in Lansing Michigan. How about the IP the guy is posting from? I’m making the last quartet of the IP xxx just for a bit of privacy for Mongo:

root@XU4uDevuan3:/# whois 45.153.160.xxx
{normal nag deleted. E.M.S.}

% Information related to ‘45.153.160.0 – 45.153.160.255’
% Abuse contact for ‘45.153.160.0 – 45.153.160.255’ is ‘abuse@moneroj.eu’

inetnum: 45.153.160.0 – 45.153.160.255
netname: Moneroj-VPS
country: NL
[…]
created: 2020-12-01T14:31:54Z
last-modified: 2020-12-08T11:01:34Z
[…]
org-name: Moneroj-NL
org-type: OTHER
address: 26 De Linge, Dronten, 8253 PJ, Netherland
abuse-c: AR55580-RIPE

So there’s the first suspicious bits. First off, why is someone with email in Lansing Michigan posting from a site in Dronten Netherlands? And one that was only created 7 months ago? Seems like a mis-direction to me.

Is that email even a valid one? Might someone have just thought it was cutsy and didn’t know that ‘this.com’ was a real site?

https://verifalia.com/validate-email

[list of other checks skipped. E.M.S.]

SMTP server validation
The mail exchanger of the email address domain can be contacted successfully.

Mailbox validation
The mailbox for the e-mail address does not exist.

So that would be a “NO!”.

OK, name and email address are both bogus. Absent some other indications of this being an honest real person, it belongs in the probably SPAM or TROLL and definitely suspicious group. But what is the content?

FWIW, at this point unless there is some really good content in such a message I’ll just trash it. I do that maybe 1 time a year. Mostly the content flags it as SPAM. Those are about 1 a day that were not caught by the Auto-SPAM filters.

We’ll take this comment in chunks and I’ll list my “Aw Crap” flags as they accrue:

There’s just too much talk and playing around. A dead enemy can’t fight you. And if that horror spreads to their host (parents housing them in basements) – these riots will stop.

While these are at core just statements of what are nominally true things, the tone is edging toward thinking it desirable to go for violence. As I’m a zero violence kind of guy, I find this a bit unsettling.

This is a job for Ghengis Khan.

Over The Top (OTT) hyperbolic statement. Poor style and implicit advocacy for one of the greatest Mass Murderers of all time who destroyed nations. Unless there’s a joke coming or this is clarified as just being parody for effect or some other artistic device, not good.

Portland police should go on strike. This situation is beyond them. Ideally, even the feds will fear to wade in – until it’s over.

True and reasonable statements. Though why one would find it desirable for higher authorities to not take over from locals-on-strike is a bit unclear.

Some of these Antifas had training and wear body armor (who paid for this). They’ll be tougher to kill. But bring enough people with varmint rifles and they’ll go down too. Their wounded will provide the identity of Antifa’s funding sources.

Um, this is a direct advocacy for a violent attack on other human beings. That’s both violation of law, and a horrible idea. While it would be nice to know the backers / funders of the Street Riot Mobs (Antifa / BLM / etc.) doing it via murder and war in the streets is not only incredibly dumb, but highly illegal and immoral.

It is as this point I begin to wonder the 3 way question:

Troll (Antifa / BLM / etc. advocate trying to get others in trouble via endorsing such stupidity, trying to politically “dirty up” the site, or just a regular Troll trying to kick up a fuss)

Stupid Person (some people ARE dumb enough to want such things as a war in the streets and murder by the dozen. Take Antifa and BLM for example. Or really anyone who believes in the Communist Revolution goal.)

TLA / Agency phish (There ARE loads and loads of Agents of various TLAs from around the world assigned to infiltrate and investigate just about everyone. They usually propose OTT ideas and emotionally loaded scenarios to try to establish their creds. It’s a bit of a heavy handed dumb example in this one, but hey, not all undercovers are all that bright or good at their job. A good one would have a real email address for “off site” communications and would spend a few weeks being bland to get the lay of the land first. But like I said, not all of them are that bright. Mongo isn’t.)

But at this point the “No Way!” flag is up. No way am I letting an advocacy for murder through. Approval also opens the WhiteList of trust for whatever else might follow. This is just entirely beyond the pale for a moral society and not approved here.

But maybe it was just one unfortunate sentence?

It’s time for Antifa to go. No more ridiculous street battles. Real deal lynch mobs with permanent solutions.

Oh Dear. That too would be an “Um, no.” Going for the “permanent solution” line? That’s so lame the “likely a TLA” vote gets stronger. Pushing a “lynch mob”? Really? Sounds like someone who has a caricature of Conservatives and Libertarians in mind that’s set in 1880 Anti-bellum Georgia… At this point “Stupid Troll” and “TLA” are about neck in neck (so to speak ;-) (I’ll get my coat… 8-)

Now he / she / it (Damn, Mongo didn’t give their pronouns! Well, whatever. BTW He / she /it is pronounced “Heshit”… (I know, forget the coat, just leave quickly ;-)

Always grab their wallets and phones. Walk up their relationships and deal with them. Take any cash and donate to soup kitchens using their new name : “Dead Antifa”

Those in rural Oregon should be alert for escapees – and deal with them.

At this point they are well into the Violent Fantasy Land scenario. Wanting to “deal with” everyone in a contacts list? Even their doctor or car repair shop? Really? To be that far “off the rails” is a bit beyond Troll, so I’m leaning more toward TLA. OTOH, the stupid in it is more in keeping with Troll as guys making Big Bucks at TLAs are usually brighter than that. Whatever. Maybe it’s a TLA from a foreign country who is a bit clueless about what Real Americans are like…

So that’s the Mongo Comment. By posting it as a Carping Comment folks can learn how to spot such stuff themselves, what kinds of tools exist, and can also see some of the more crazy stuff that can show up in an un-moderated comment thread.

This kind of stuff is why I moderate comments. Aside from the fact that it’s offensive to civilized folks, and inflammatory of arguments; there’s the real possibility that it is someone attempting to cause a crime to be committed. I’m pretty sure that advocating for the death of others, and promoting armed conflict on the streets are some kind of crime somewhere in the world, so just to avoid the “attempted entrapment” alone is enough reason to toss the comment.

But long before that the general angry / unthinking tone of it had driven me away.

There you have it. One Violent Loon looking to promote a street war? Or a TLA Agent attempting to provoke some subtle “crime by agreement”? Entrapment in progress? Or just sociopath venting?

I don’t know which one it is, but I do know it doesn’t belong here as a comment.

Subscribe to feed