Published on Nov 29, 2019
Topic: technology
What do these words mean?
I don’t know. I found them by accident, when poking around a part of the internet no one was ever supposed to find.
I was poking around my Pi-Hole (an ad-blocking/privacy solution), and noticed
that one of the most blocked domains was ads.mopub.com. If you visit that URL, you will find that
most enigmatic phrase: Bearclaw. Cornstalk. Turtles. Get Yolked., followed by a number between 1
and 1000. Most curious.
We’ll start with what we get by googling this phrase. Results are sparse, but there are a few things of note:
- Some people noticed this on the Imgur mobile app, where sometimes, instead of an ad, it would display this text.
- In Spring of 2012, AWS appears to have had an issue with its load balancers where they would display this text. This is substantiated by a post in the AWS forums, and on Twitter. The forum thread was never resolved, and the Twitter post has a reply from 2017 where someone reported seeing it on “Cain and Able”, but I was unable to make good guess about what site or app that is. It seems to have been somewhat widespread at the time. For most of these, I could not find links to twitter. For many, I could find links to Amazon, most likely their Elastic Load Balancers (ELB).
- Someone experienced something related with Apple.com, in December of 2012. However, this happened whenever they connected to WiFi.
- Another person, on superuser.com, got this message from their own IP in 2014.
- Someone posted on a Chinese Q&A Site about a similar issue, but received no responses. The question is not dated that I can find.
Who is Mopub? They’re an advertising company, like Google’s AdWords, which is very specifically targeted toward mobile apps, and owned by Twitter.
From points 1 and 3, I have a guess as to just what’s happening here. Most likely, in cases where
this text actually showed up on someone’s app screens, either the developer of the mobile app had
some bug where they used the API incorrectly, or the version of the Mopub Software Development Kit
(SDK) they used had a bug in it. See, valid requests to view an ad have a specific format, and
something would have to break to use just the basic URL I provided earlier, rather than a valid one,
which would be formatted more like http://ads.mopub.com/m/ad....
Mopub was founded in 2010, so the timeline is plausible.
However, points 2 and 4 raise trickier questions.
I don’t have a great explanation for this. My best guess would be that some traffic, somewhere, in each situation is routing through a partially broken AWS Elastic Load Balancer which had this bug introduced in 2012 by sheer luck, but nobody ever noticed. However, I find this hard to believe.
AWS (Amazon Web Services), and Twitter are two distinct entities; Twitter may or may not not buy resources from AWS. However, Twitter seems to spend a pretty penny on AWS from the sources I can find, at least as of 2018. Given that, it’s possible that someone of Twitter’s size is bouncing some traffic into AWS behind the scenes, and that’s giving this message.
In the course of my investigation, I gathered some interesting information:
> $ curl http://ads.mopub.com/
Bearclaw. Cornstalk. Turtles. Get Yolked. 344.
> $ curl -I -XGET http://ads.mopub.com/
HTTP/1.1 200 OK
content-length: 47
content-type: text/plain; charset=UTF-8
date: Fri, 29 Nov 2019 09:07:05 GMT
server: tsa_b
x-connection-hash: a9f7d41f2f36b59e3d0c876435e20919
x-response-time: 3
We can see that we can replicate the bizarre message from the command line here. We can also see
that we’re getting a 200 OK, which means that this is a server intentionally and successfully
returning this result. Finally, we can see that the listed server is tsa_b. tsa_b is the name
for some custom server software that Twitter owns, which makes it odd that an Amazon Elastic
Load Balancer (ELB) would return the same result at any point. On the other hand, it seems feasible
that tsa_b is acting as a load balancer and setting itself to the server header above.
The plot thickens.
Poking around at IP addresses, I noticed that the IP addresses which ads.mopub.com points to four
IP addresses, all of which are based in New York and registered to Mopub (which makes sense). What’s
more, all of the 192.48.236.0/24 block is allocated to Mopub. Within that range, there are many
tsa_a servers in addition to the tsa_b servers.
Within that range, interestingly, some of the IPs are serving certificates for other twitter services aside from Mopub, which means not all Mopub IP addresses are used strictly for Mopub; some seem to be used for Twitter.
Even more interestingly, I found that the IP addresses for ads.mopub.com were also registered to
two other domain names: s.mopub.com, and, more interestingly, cpp-test.imp.mpx.mopub.com. Even
more interestingly, curling these additional sites gives different results: s.mopub.com tends to
give 404 Not Founds, and cpp-test gives a slightly different message - a number between 1 and 100,
no space between the phrase and the number, and no terminating newline. If we curl the IP directly,
we also get a 404 response.
This is interesting. From this, we can surmise that we are talking to three different servers, all doing something somewhat different. And for some reason, two of these three servers are telling us to get yolked. This means Twitter is using shared servers and distributing the requests using SNI (Server Name Indication) to indicate which one to get results from. In fact, we can get the adpub pages from Twitter’s IP addresses:
> $ nslookup twitter.com
Non-authoritative answer:
Name: twitter.com
Address: 104.244.42.129
Name: twitter.com
Address: 104.244.42.65
> $ curl http://ads.mopub.com --resolve ads.mopub.com:80:104.244.42.129
Bearclaw. Cornstalk. Turtles. Get Yolked. 536.
> $ curl http://cpp-test.imp.mpx.mopub.com --resolve cpp-test.imp.mpx.mopub.com:80:104.244.42.129
Bearclaw. Cornstalk. Turtles. Get Yolked.41
(The --resolve is a way of forcing curl to pass SNI for a specific address to a different IP)
Great. So now Twitter is telling us to get yolked.
Well, what we know from this, at least, is that Get Yolked is most likely not coming from Mopub, but from somewhere in Twitter’s underlying infrastructure itself, which may well be routing through AWS or hitting some weird AWS ELB condition.
As for the person who saw it on their own server, it’s possible that something was interacting with one of these load balancers and just never got fixed.
So, that’s the theory I have to go with. In 2012, AWS had a weird, esoteric bug with their ELBs. Mopub was affected. Everyone else either destroyed and recreated, or fixed, their ELBs, while Mopub’s was never dealt with. It may not even be their main load balancer - just one used somewhere else that’s propagating up the weird text. It’s not a great theory, but it’s the best I’ve got.
It’s also possible that someone at Twitter or Mopub had to deal with that problem, and left that text around as a joke.
Language
But where did these words come from? It’s a strange jumble of text, regardless of what internet infrastructure it’s running through. Bearclaw. Cornstalk. Turtles. Get Yolked. A Bear Claw is, aside from being the weapons of a large mammal, is also a name of pastry, a Canadian casino/hotel, a nebula, and a Dutch snack. A cornstalk is, of course, associated with corn, but is also a word for a native-born Australian. A turtle, aside from being an animal eaten (often as soup), is also a kind of ice cream. Yolked, of course, in addition to referencing an egg yolk, is a synonym of “Swole” when used as “Get Yolked.”
Notably, every phrase in this blob of text is directly related to food. So, the best guess as to where this came from, is that somebody was making some test text before lunch, and, being hungry, used a bunch of words related to foods they liked. In their rush to get to lunch, perhaps, they forgot to remove the test. People like food, so this seems pretty plausible.
It may also be a reference to nature, as each of these words has primary connotations associated with nature and natural life, rather than with humanity.
These are both just weak guesses, looking for patterns. So it’s likely there’s nothing there. It’s really impossible to know. Some human being put that text there 7 years ago, but their name seems to be lost to time.
In Closing
Stay Yolked, my friends.
If you know something about this that I don’t, send me an email using the “Contact” button above. I’d really like to know. If I’m able to get any extra information from anyone, I’ll update it here.