#opmonoxide

The canary mission is a shady group of Zionists that doxx activists and students that express support for Palestine in an attempt to silence, intimidate, and defame them.

Some time ago, I was able to link the organization to one Howard David Sterling, an American lawyer who invests in Israeli medical firms. I wrote the report on my site here.

More recently, I found the account that runs their tip submission form. The username was included in the resource URL of the banner image of the form, which is hosted on a service called jotforms, under the username “carlossantanajm”

A google dork turned up two potential candidates: a man from eastern Canada, and a the rock musician Carlos Santana, who played a concert in Israel around 2010 despite backlash. Investigation is underway to conclusively prove the involvement of either of these individuals, but data is scarce.

Also of note was an investigation by Josh Nathan-Kazis into Megamot Shalom: an elusive organization that acts as a front for the Canary Mission. In the report, data from the Israeli charity register is cited but not provided to prove connections between Megamot Shalom and Aish HaTorah, an organization that focuses on pro-Israel media advocacy.

Funding for Megamot Shalom is contributed by wealthy zionists in the US, through the Central Fund for Israel, which routes the money to the Israeli organization so that the donors can claim it on their tax breaks. The connection between the Central Fund for Israel and Megamot Shalom was confirmed by the 2017 Tax returns of the Hellen Diller Family Foundation, who donated to CFI and labeled the reason as “CANARY MISSION FOR MEGAMOT SHALOM”

Two anonymous sources claim that a man named Jonathan Bash (who has ties to Aish HaTorah) confided in them that he ran the Canary Mission. From this info, six other Megamot Shalom board members were able to be named.

Efforts are Still underway to obtain the charity data cited in the report.

And I can prove it:

The following information will go up on my site soon, but I felt that it was worth having here, as several discoveries have recently been made.

The Canary Mission website is likely currently hosted on a server owned by fixweb, a French hosting provider. IP geolocation (in general) is not accurate enough to get an exact location of the server, but it is accurate enough to tell me that the server is somewhere in Paris, France, and uses Scaleway SAS as an ISP.

On and related to the fixweb network are several domains and IP addresses that are connected in some way to the Canary Mission:

1. beta.canarymission.org

The URL beta.canarymission.org resolves to an IP in the fixweb range. Furthermore, that IP redirects to the main site (using HTTP code 302) when accessed through a browser via port 80 (HTTP), but not when accessed by port 443 (HTTPS). This indicates that port 443 is likely being used to communicate with either the CloudFlare reverse HTTP proxy (possibly in California) or the web application firewall (in the NY/NJ area). It also tells me that the server is configured to refuse connections on port 443 that don’t come from certain servers (whether that’s the WAF or the Reverse proxy is still unknown).

While investigating this a few months ago, the IP didn’t redirect to the main site as far as I knew. But it still resolved to the beta domain. The redirect occurred only after a major change had been made to their site layout, indicating that the development version of the site is hosted on the machine corresponding to the IP. This is significant, because most people try to keep their code in one place, so it’s likely the production version of the site is in the fixweb network too, but is only accessible through the reverse proxy and/or the WAF.

2. media90.canarymission.org

media90.canarymission.org resolves to an IP owned by fixweb, indicating that their CDN (content delivery network) exists on their servers but is not behind the proxy. This further confirms my suspicions that the Canary Mission switched their host from Israel (likely under Kamatera’s hosting services) to France, so they could abuse the GDPR to redact the contact information of the site maintainers.

3. canary.fixweb.net

The domain canary.fixweb.net exists. Not much to say about this one, I think the conclusions write themselves.

4. thingdust.io

This isn’t directly related to the fixweb domain (as far as I’m aware), but I found three other domains through an automated OSINT search:

canarymission.cust.dev.thingdust.io

canarymission.cust.disrec.thingdust.io

canarymission.reservd.disrec.thingdust.io

Noticing a pattern in these URLs, I also attempted to access canarymission.cust.prod.thingdust.io: the host was up (I think), but it wasn’t configured to serve any resources.

Upon researching thingdust, I found that they’re a company in Switzerland that specializes in IoT-enabled workplace monitoring. This is one of those companies that makes those sensors that some people would find under their desks that track workplace occupancy. If the resources on those servers were publicly accessible, we could use the sensor network’s web view to obtain the floor plan of the building the Canary Mission team operates from.

It’s a bit short, as my computer decided to become a geriatric during the course of writing this. Please tell me if you notice any bugs in the site layout, as I was experimenting with using flute for template generation, and it didn’t work out so well. I had to manually correct a lot of it myself.