Who is Ronaldmew and why are they so persistent?

« previous post | next post »

More than a dozen times over the past couple of weeks, someone using the username "Ronaldmew" has been locked out of our site by Wordfence due to repeated attempts to log in as a contributor. Each time, the IP address that the multiple attempts came from is blocked, and then a day or two later Ronaldmew tries again from a different IP address.

The last few attempts have been from SecuredConnectivity.net in New York City, Eweka Internet Services  in the Netherlands, Strong Technology LLC in Melbourne Australia, and OverPlay.Net LP in Swindon UK.

None of the 180,535 registered comments on this site have been entered by "Ronaldmew", so a desire to communicate with our readers doesn't seem to be their goal.

Ronaldmew, whoever you are, this is not working. I'm going to leave the comments open on this post for a while, and maybe you can explain what you're trying to do and why you're trying to do it this way.

Update — no comment from Ronaldmew, but four more blocked login attempts using that name since this post went up.


  1. Jim Breen said,

    January 30, 2019 @ 3:17 pm

    "Strong Technology LLC in Melbourne Australia"? Curious. The LLC classification of companies is British, and not used in Australia.

  2. Philip Taylor said,

    January 30, 2019 @ 3:21 pm

    Are you sure that LLC is British, Jim ? I am a 72-year-old Briton and I have never encountered a British company using that particular designation. "plc" (public limited company) yes, but never LLC to my knowledge. Anyhow, RIPE finds Strong in America :

    Strong Technology, LLC
    127 W. Fairbanks Ave. #139
    32789 Winter Park, FL

    [(myl) The location and company names came from IP geolocation queries. Apparently where companies are based and where they have IP addresses are not always the same :-)…]

  3. Aelfric said,

    January 30, 2019 @ 3:33 pm

    I feel like this all ends with the discovery that some small internet node or networked device has become sentient and fascinated by linguistics.

    I, for one, &c. &c.

  4. peter said,

    January 30, 2019 @ 3:42 pm

    I for one am a supporter of Roman numerals.

  5. Ralph Hickok said,

    January 30, 2019 @ 4:30 pm

    @Jim Breen:
    "LLC" is very widely used in the United States. When I walk eight blocks from my home to a little coffee shop downtown, I go past at least a half-dozen limited liability corporations. Most of them are law firms, but one is an accounting firm.

  6. AndrewD said,

    January 30, 2019 @ 4:51 pm

    I believe LLC stands for Limited Liability Company, at least here in the UK. It was developed, I believe,to replace the partnership, in the UK. Partnerships had collective unlimited liability in law-which could prove very costly if a partner was negligent in an audit of day a company like Carillion. If I am wrong please correct me

  7. bob coard said,

    January 30, 2019 @ 5:23 pm

    LLP (partnership) is far more common in the UK.

  8. Ian Menzies said,

    January 30, 2019 @ 5:38 pm

    I wouldn't rule out that they are trying to leave a comment but they don't understand that you don't need to log in to do that, nor that the log-in link is for contributors only. That link is a little prominent for something that is only for a small number of people (not that I have any idea where else you would put it).

  9. John Kozak said,

    January 30, 2019 @ 6:00 pm

    Ltd is the UK standard abbreviation for for a non-public limited company, and plc for a public one.

    LLC is Australian, possibly elsewhere too.

  10. Ian Menzies said,

    January 30, 2019 @ 6:07 pm

    On second thought, those company names (and location mismatches) look a lot like VPN endpoints. Someone who's tech savvy enough to use a VPN would probably be tech savvy enough to scroll down and see that there's no "log in to comment" anywhere.

  11. Laura Morland said,

    January 30, 2019 @ 6:12 pm

    While I vastly prefer Aelfric's explanation, considering that the attempts are *purportedly* coming from four different countries over three continents, I'm thinking that "Ronaldmew" is more likely simply a malevolent bot.

    Your Wordfence is apparently powerful and effective! (Maybe we should propose that "Wordfence" protect our Southern border?)

  12. Jim Breen said,

    January 30, 2019 @ 6:51 pm

    Yes it's "plc" or "ltd"in the UK; not LLC. (I should wait for my first coffee of the day before posting a comment.)
    LLC is not used in Australia. The nearest equivalent is labelled "Pty Ltd" here.

  13. JB said,

    January 30, 2019 @ 8:06 pm

    It were Russian hackers.

  14. Ken said,

    January 30, 2019 @ 9:09 pm

    @peter: Don't you mean "I IV I am a supporter of Roman numerals"?

  15. mnoelle said,

    January 30, 2019 @ 11:11 pm

    Laura, I think your explanation and Aelfric's go together. Surely a bot must be sentient in order to be malevolent?

  16. richardelguru said,

    January 31, 2019 @ 7:25 am

    But Ken "VNVS QVATTOR VNVS am a supporter of Roman numerals" (or should that be "VNVS AD UNUM am a supporter of Roman numerals)" doesn't make a lot of sense?

    OT but in a similar vein Apple apparently insists that the 'X' in iPhone X should be pronounced as a number, not as a letter.
    I propose everyone should go in to Apple Stores and ask about the 'iPhone Decem'. Of course after a while the assistants would get fed up and decide that the next time someone did that they would deck 'em.

  17. NSBK said,

    January 31, 2019 @ 9:19 am

    Looks like a bot to me: https://mobile.twitter.com/ronmor1

  18. J.W. Brewer said,

    January 31, 2019 @ 11:57 am

    Two minor points: First, the LLC remains a fairly new innovation (late 20th century) in Anglophone nations, and because it is a creature of statute may not exist at all in some jurisdictions where the necessary legislation has not thus far been enacted — but as I understand it it's loosely modeled on (and could thus be thought a translation or calque of?) the much longer-standing GmbH that is prominent in German-speaking nations.

    Second, it was interesting to see myl using "singular they" for the mysterious "ronaldmew" rather than being prompted by the "ronald" to conclude that a masculine pronoun would be appropriate.

  19. Philip Taylor said,

    January 31, 2019 @ 1:26 pm

    (Singular "they"). Yes, I noticed that as well, but for me the use of singular "they" in juxtaposition with plural "are" just does not work. I could understand "why is they so persistent", which would make it immediately clear that the "they" is intended as singular, but with plural "are" my brain immediately interprets the "they" as also being plural and my mental parser then fails at that point if the sentence as a whole has led me to believe that one person is being discussed and not many. Radio 4 used plural "are" with singular "they" earlier this week, and I was completely confused until the speaker clarified (the speaker's) position.

  20. Chandra said,

    January 31, 2019 @ 3:02 pm

    @Philip Taylor – I wonder then if you encounter the same difficulty parsing singular "you", as in "Why are you so persistent?", which underwent exactly the same evolution from solely plural to either plural or singular (replacing "thou")?

  21. Chandra said,

    January 31, 2019 @ 3:05 pm

    @mnoelle – I think a non-sentient bot could be considered malevolent if the person who created it intended to use it for malevolent purposes.

  22. Philip Taylor said,

    January 31, 2019 @ 3:24 pm

    Chandra — No, for me, "why are you …" poses no problem at all, because it has existed in my brain for as long as I have been aware of language, while "why are thou" would jar (it should be "why art thou"). After ten minutes or so of deep introspection, I now think that there are constructs in which "why are they" for singular "they" does work for me — for example, "who the h@ll keeps calling my landline at four in the morning, and why are they so ***ing persistent ?" — so it is not clear to me why Mark's title causes my brain so much trouble. It may simply be the collocation with "Ronald".

  23. Patrick said,

    February 1, 2019 @ 2:56 am

    It is a scripted bot that attempts to check if usernames exist. Expect the username to change over time. The bot is on a computer whose network you were able to find out, but the person running this computer does not know they have a trojan or other script running the bot. The way of the script will also change over time, you will see usernames like admin-sitename, admin-sitename-com and so on.

    You are using Wordfence, add the username to the list of blocked usernames and the amount of email you get will be reduced. Other than that there is no way to change this and this post will have as much success as writing it on a piece of (eco-friendly sourced) paper and putting it in a hole in a tree in a wood.

  24. Ellen K. said,

    February 2, 2019 @ 10:34 am

    @Phillip Taylor

    I find your reaction interesting. I see two things going on. I think, for some of us, use of traditional singular they, for an unspecified person, works here. For me it does. And for others, including you, it doesn't, because you see "Ronaldmew" as specifying a person.

    And then, additionally, for the newer use of singular they for a specified person, you find the use of "they are" instead of "they is" disjunctive. I'm pretty sure "they are" is the norm in this, but I think for many of us we haven't heard this sort of usage enough for it to be natural to us.

RSS feed for comments on this post