Review

A month ago, I logged into the Mix-Space backend to check for new comments, and then out of curiosity, I clicked on Spam (I didn't think my small site would have any spam comments, right?). Guess what? There actually was someone trying to spam comments. Unfortunately for them... this useless piece of work didn't succeed. Everything was blocked by the anti-spam filters (didn't even need AI review). Now that I finally have some time, let's see what this loser did.

Rough Data Analysis

Spam Screenshots

Quite the Shanghai Hypergryph Network Technology Co., Ltd., really knows how to Hypergryph

Since the Mix-Space backend only shows general information, let's dive into the database.

Detailed Data Analysis

Mix Side Analysis

Using Datagrip to connect to the MX database, enter the comments table.

Then directly filter by the IP: 198.23.130.211, and the results come up.

You can see the detailed information of this mentally challenged child.

This is the information we got from the Mix system. Now let's take a look at Umami.

Umami Side Analysis

We can see the comment time was on 2025-08-02. Let's take a look.

Go directly to that day in Umami and confirm it's this user:

Enter the Umami database to search for the ID to verify, but unfortunately, Umami doesn't record IPs? Not a big deal, let's just download the Umami request logs. Coincidentally, the starting record time is July 30th, heaven is on my side.

We'll use the IP search tactic again. Sure enough, we found it, the time matches, confirmation successful.

AI Log Analysis

1. Entering the site
   • 10:30:48: First entered /posts/site/comeback
   • 10:32:17: Visited homepage /
   • 10:32:32 ~ 10:32:40: Continuous refreshing or repeated visits to /posts/site/comeback
2. Browsing regular pages
   • 10:32:38 ~ 10:33:25: Repeatedly visited /posts and /posts/site/comeback, as if testing page jumps or repeatedly reading certain content.
3. Visiting technical articles
   • 10:37:22 ~ 10:37:33: Viewed /posts/devops/how-to-handle-zombie-processes-in-ubuntu (an article about handling Linux zombie processes), opened at least twice, possibly confirming content.
   • 10:37:25 ~ 10:36:25: Visited /posts/cybersecurity/msf-bypass-test (likely an article on penetration testing or bypassing protection).
4. Behavior before ending
   • 10:38:23: Returned to homepage /
   • 10:38:46: Last visit to the /posts page, session ended.

What does this mean? It means this loser:

He was slowly copy-pasting and trying in the browser! He tried for 4 minutes!

Because Mix doesn't display spam by default after detecting it, he kept refreshing the page, wondering where his comments went.

Hahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahaha!

AI also verified my thoughts:

AI Comprehensive Analysis

1. Same Person Behavior
   • Same IP address: 198.23.130.211.
   • Time perfectly aligned: Comments occurred during the session, the last comment (22:38:16) was only 30 seconds away from the session end (22:38:46).
   • Confirmed that the commenting and browsing behavior were done by the same visitor.
2. Behavior Pattern
   • Quickly browsed multiple technical articles (security-related) in a short time.
   • Simultaneously utilized the comment function to batch spam different author names and different content, which is malicious flooding/spam comment behavior.

And I noticed a very interesting point, as shown:

zh-TW? Interesting, looks like someone from the other side came to cause trouble hahahaha (laughing out loud)

Clarity Side Analysis

This is the funniest part. I integrated Microsoft Clarity, and I guess he wasn't on guard, so everything was screen-recorded hahahahahahaha

Unfortunately, some input boxes are masked by default, otherwise it would be even more fun. Watch it here

Summary Diagram