Review

A month ago, I logged into the Mix-Space backend to check for new comments. Out of curiosity, I clicked on Spam (thinking my little site wouldn't have any spam comments, right?). And guess what? There were indeed some attempts to spam, but unfortunately for them... this useless piece of work failed. All were blocked by the anti-spam filter (didn't even need AI review). Now that I finally have some time, let's see what this loser has done.

General Data Analysis

Spam Screenshots

Oh, Shanghai Eagle Network Technology Co., Ltd., really living up to the "eagle" in their name.

Since the Mix-Space backend only shows general information, let's dive into the database.

Detailed Data Analysis

Mix-Side Analysis

Using Datagrip to connect to the MX database, we enter the comments table.

Then directly filter by the keyword for this IP: 198.23.130.211, and the results are out.

You can see the detailed information of this dim-witted child.

This is the information we got from the Mix system. Now let's take a look at Umami.

Umami-Side Analysis

We can see the comment time was on 2025-08-02, let's take a look.

Let's check Umami directly for that day to confirm it's this user:

Enter the Umami database to search the ID for verification, but unfortunately, Umami doesn't record IPs? No big deal, let's just download the Umami request logs. Coincidentally, the starting record time is July 30th, heaven-sent.

We still use the IP search tactic, and sure enough, we found it. The time matches, confirmation successful.

AI Log Analysis

1. Entering the Site
   • 10:30:48: First entry to /posts/site/comeback
   • 10:32:17: Visit homepage /
   • 10:32:32 ~ 10:32:40: Continuous refresh or repeated visits to /posts/site/comeback
2. Browsing Regular Pages
   • 10:32:38 ~ 10:33:25: Repeated visits to /posts and /posts/site/comeback, as if testing page transitions or rereading some content.
3. Visiting Technical Articles
   • 10:37:22 ~ 10:37:33: Viewed /posts/devops/how-to-handle-zombie-processes-in-ubuntu (an article about handling Linux zombie processes), opened at least twice, possibly confirming content.
   • 10:37:25 ~ 10:36:25: Visited /posts/cybersecurity/msf-bypass-test (possibly an article on penetration testing or bypassing defenses).
4. Pre-Ending Behavior
   • 10:38:23: Returned to homepage /
   • 10:38:46: Last visit to /posts page, session ended.

What does this indicate? It shows this loser:

He was trying slowly on the browser side! Tried for 4 minutes!

Because Mix detected the spam and didn't display it by default, he kept refreshing the page, confused about where his comments went.

Hahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahaha!

AI also confirmed my thoughts:

AI Comprehensive Analysis

1. Same Person's Behavior
   • Same IP address: 198.23.130.211.
   • Perfect time alignment: Comments occurred during the session, with the last comment (22:38:16) only 30 seconds before the session ended (22:38:46).
   • It can be confirmed that the comments and browsing behavior were performed by the same visitor.
2. Behavior Pattern
   • Quickly browsed multiple technical articles (security-related) in a short time.
   • Simultaneously used the comment function, spamming different author names and content, which is malicious flooding/spam comment behavior.

And I noticed something quite interesting, as shown:

zh-TW? Interesting, seems like they're coming to cause trouble, hahaha (laughing out loud).

Clarity-Side Analysis

This is the funniest part. I integrated Microsoft Clarity, and I guess he wasn't prepared, so everything was recorded, hahaha.

Unfortunately, some input boxes were automatically blurred, otherwise, it would be even more fun. Check it out here.

Summary Diagram