@SmokeDetector While the question sort-of asks for this type of information, the presentation makes it clear that it's clearly intended as advertising rather than intending to answer the question in a thoughtful manner.
@JoErNanO That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Title - Position 1-13: mycabdeal.in Body - Position 1-13: mycabdeal.in Username - Position 1-13: mycabdeal.in
[ SmokeDetector | MS ] Bad keyword in body, blacklisted website in body, body starts with title and ends in URL, link at end of body, pattern-matching product name in body, +2 more: After that, you can stop doing the by boseaxsdea on askubuntu.com
@Makyen That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
All answers from this user seems containing spammy links: SU has been removed, Arqade seems.. legit answer with unneeded link, German is blatantly unrelated.
[ SmokeDetector | MS ] URL in title, bad NS for domain in body, bad NS for domain in title, bad keyword in body, bad keyword in title, +4 more: lumalifteye.com/vitasilk/ by kitpoent on english.SE
@TetsuyaYamamoto It's part of a more complex regex. Looks like we should look for what the initial intent was and adjust the regex to more accurately detect that, without also getting the FP.
> Blacklisted website in body, blacklisted website in title ---------- Title - Position 1-18: braindumps4it.com Body - Position 1-18: braindumps4it.com
@TetsuyaYamamoto The criteria for blacklisting a website is 5. 3 only qualifies if it is part of an "ongoing campaign", which is defined as something that's part of a coordinated effort using multiple domains for basically the same advertising.
@Makyen but if we can find evidence that this is an ongoing campaign, it should be fine ... "ongoing" is probably a stretch here but something similar has been happening over the last couple of years, I just haven't dug up the samples to see how similar they are
[ SmokeDetector | MS ] URL in title, bad NS for domain in body, bad NS for domain in title, bad keyword in body, bad keyword in title, +4 more: lumalifteye.com/vitasilk/ by Cakilap on graphicdesign.SE
@tripleee I good with that. My concern is the progressive generalization from 5 to 3 without someone actually considering if it really qualifies as an ongoing campaign.
OTOH, the project can define whatever criteria that it wants for the blacklist. I'm not really in a position where I should be enforcing policy, particularly on those that set that policy. But, I am concerned about the appearance of laxer standards working their way into the thinking of those that are attempting to follow policy.
@Makyen That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@Makyen Added (?:autolinkpk|auto\W+link\W+(?:international|int\W+pakistan)) to watchlist
I'm wondering, would it be possible to configure rules such as "on site x, in order for five autoflags to be used, at least one of these rules must apply"?
@zoe I adjusted a watch you added here for Auto Link International. It was picking up an identifiable amount of FP. I changed it to something that's more restrictive, but catches all of the TP in metasmoke which the regex you had did (with the exception of the oldest TP, which was actually TP for another reason, but FP for with respect to the detection done by this regex).
I have some SQL queries which deliver an approximation of that, but it's obviously only available to those who have access there ... the idea to expose cached SQL results to users with lesser privileges seems appealing
created tag #fake-login for these gmail/hotmail/etc login spams
the HiChina whois results are weird
maybe all of these are really Nexperian, it seems to be a scam operation
*"NEXPERIAN HOLDING LIMITED is associated with domainabuse@service.aliyun.com and 91 other email addresses. A total of 2,011,102 associated domains were identified."*
4/4, blacklist on next sighting (or group it with some related recent spam and blacklist now)
I guess #visit-my-website is a plausible fallback for everything which doesn't fall into any other category but then we should avoid using this as much as possible
what about the Lucky Patcher / Plex / Kodi spams? It looks like this is an organization which attempts to answer questions and add a signature to a random smattering of their web sites metasmoke.erwaysoftware.com/domains/18464
@tripleee That pattern looks like it's already caught by Pattern-matching website in answer, Blacklisted website in answer, Pattern-matching website in body, and Blacklisted website in body; append -force if you really want to do that.
[ SmokeDetector | MS ] URL in title, bad NS for domain in body, bad NS for domain in title, bad keyword in body, bad keyword in title, +4 more: reviverxtry.com/vitasilk/ by CarlGonzal on puzzling.SE (@Mithrandir)
[ SmokeDetector | MS ] URL in title, bad NS for domain in title, bad keyword in body, bad keyword in title, blacklisted website in title, +1 more: lumalifteye.com/vitasilk/ by Gutierre on codegolf.SE (@Mego @DJMcMayhem)
@Wrzlprmft That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
@Magisch I thought about that, but I didn't want to have even a quick flicker ... leaving the room temporarily certainly provides a workaround, but it would be nice to be able to say "shut up for 30 minutes please" and still receive e.g. personal pings
@NogShine That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
@tripleee That pattern looks like it's already caught by Blacklisted website in body and Blacklisted website in answer; append -force if you really want to do that.
it's not like you can identify which one did it, we just know that something like 1 in 10,000 users go ballistic when you criticize them or enforce site rules
[ SmokeDetector | MS ] Bad keyword in answer, offensive answer detected, potentially bad keyword in answer, toxic answer detected, blacklisted user: Roles - Identity Server 4 by user9846123 on stackoverflow.com
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad keyword in username, blacklisted website in body, blacklisted website in title, +2 more: health-forall.com/vitasilk/ by VitaSilk on askubuntu.com
[ SmokeDetector | MS ] URL-only title, bad NS for domain in body, bad NS for domain in title, bad keyword in body, bad keyword in title, +5 more: lumalifteye.com/vitasilk/ by kitpoent on askubuntu.com
@Makyen That pattern looks like it's already caught by Potentially bad ns for domain in answer and Potentially bad ns for domain in body; append -force if you really want to do that.
