@Makyen That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
[ SmokeDetector | MS ] Blacklisted website in body, pattern-matching website in body, potentially bad ns for domain in body, potentially bad keyword in body (198): Corporations with restrained by xypojpep on askubuntu.com
Deleted on site but not reported in MS on Ask Ubuntu - is there a 10K here whom can see it (and deletion reason) - is this error an artifact of the bug fix for our issue on GitHub: "Post deleted" on posts which aren't #568 ? -- This is the inverse of the bug report.
@Seth Could I ask you about this: chat.stackexchange.com/transcript/message/48868439#48868439 - On MetaSmoke the post isn't reported as deleted but appears to be deleted on site. There was another occurance of this the other day which I didn't document thinking it might be a one time thing. If I can accumulate some information I might have enough for a bug report. Not even sure what I need to know, perhaps just why it was deleted is sufficient - if you are willing to say.
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 0-4: keto Potentially bad keyword in title - Position 0-4: keto Potentially bad keyword in username - Position 0-4: keto
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 0-4: keto Potentially bad keyword in title - Position 0-4: keto Potentially bad keyword in username - Position 0-4: keto
:48869485 > Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 0-4: keto Potentially bad keyword in title - Position 0-4: keto Potentially bad keyword in username - Position 0-4: keto
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 0-4: keto Potentially bad keyword in title - Position 0-4: keto Potentially bad keyword in username - Position 0-4: keto
@Jenayah The second website in their post, smore.com, scores 252 TPs and 0 FPs but is not blacklisted. MS reports the first URL in their post, turmericforskolinnutrition.com, has 6 TPs and 0 FPs and repeats of the smore.com
> Pattern-matching product name in body, pattern-matching product name in title ---------- Pattern-matching product name in body - Position 0-23: burn and trim with fuel Pattern-matching product name in title - Position 0-23: burn and trim with fuel
@Rob MS only monitors for deletion for a limited period of time. I'm not certain what that amount of time is at this point, but it's not forever. IIRC, at one point, this was 10 minutes, but I thought that had been extended. I believe this is done by monitoring the WebSocket for events on the post.
There are times when the SE WebSocket does not properly report deletion. You can see this happen erroneously from time to time on SE pages, where you'll try to do something, but get a message saying you can't because it's already deleted. If the WebSocket was performing correctly, the post would have been hidden behind a "deleted, please refresh" banner (I forget the exact wording).
> Bad keyword in body, bad keyword in title, bad keyword in username, blacklisted website in body, blacklisted website in title, pattern-matching website in body, pattern-matching website in title, pattern-matching website in username ---------- Bad keyword in body - Position 8-17: forskolin Bad keyword in title - Position 8-17: forskolin Bad keyword in username - Position 8-17: forskolin Blacklisted website in body - Position 0-30: turmericforskolinnutrition.com Blacklisted website in title - Position 0-30: turmericforskolinnutrition.com
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 0-4: keto Potentially bad keyword in title - Position 0-4: keto Potentially bad keyword in username - Position 0-4: keto
@iBug Looking at the MS for what @Jenayah replied to I see I should have scrolled even further right to see the second entry on the same line. Thanks for pointing that out.
> Pattern-matching product name in body, pattern-matching product name in title, potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Pattern-matching product name in body - Position 0-18: keto melt and trim Pattern-matching product name in title - Position 0-18: keto melt and trim Potentially bad keyword in body - Position 0-4: keto Potentially bad keyword in title - Position 0-4: keto Potentially bad keyword in username - Position 0-4: keto
@Makyen yes we fixed a bug the other day where a post would be reported deleted but wasn't. Now I've found that posts are not being reported as deleted when in fact they have been -- after I get a couple of examples I'll file a bug report for that. I wish the status was reported correctly so we could rely on what we see rather than triple checking everything.
@Seth The MetaSmoke report shows me the post (I don't have 10K on Ask Ubuntu) and says that the link to it is: askubuntu.com/a/1115673 --- The bug I'm trying to document is that the MS page doesn't say that the post has been deleted but when you click on the link it isn't visible (to me). --- I've no complaints about it being deleted, my Bug report is that MS shows the status incorrectly.
@Rob I'm aware of the bug-fix. The issue wrt. posts not being shown as deleted can have multiple causes. Some of those are in our control, some not. Part is that we only choose to monitor each post for some limited period of time. Even if that's a considerable time, we probably don't re-attach the monitoring if MS is rebooted. There are ways where MS could get supplementary information, or at least be informed that it should check on the status. So far, there's been a choice not to do that.
@Jenayah you can complain that the person is a spammer and ask why they are not nuked. --- This is what you wrote: "@SmokeDetector this account has apparently been posting spam for one week network-wide. (chat.stackexchange.com/…) How come they haven't been nuked yet?"
[ SmokeDetector | MS ] Url-only title, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, link at end of body, +1 more (594): pilpedia.com/rapid-slim/ by necixowope on askubuntu.com
@Seth Thanks Seth, you've redacted the deletor. Can I ask if it was any of the following: One of the Mods or someone with Tags or over 20K --- IE: Did one person delete it, and they are not the owner of the answer?
OK. Out of concerns for privacy I won't ask anymore. That much information is very likely enough. If we need more one of the Moderators here can ask you Mod to Mod for more details if needed. Thanks for your assistance.
@Makyen Jen's user that she reported? --- I dislike that information is provided but isn't correct. It's like you need to ignore what you read (deleted / not deleted) and click through to check.
@Jenayah A user being deleted requires it to come to the attention of moderators. If their posts are (relatively) rapidly deleted by 6 spam flags, then moderators usually don't even see it. As I understand it, a network-wide nuke takes running it up to a CM, as moderators only do so on their own sites.
Nuking the user, if it's a persistent spammer (i.e. one that's going to recreate a new account anyway, once nuked), is moderately helpful (more so if it does inconvenience the spammer). If they are just going to create new accounts, it's actually easier to let them have one account which is readily identifiable and can rapidly have it's posts nuked when they are made. For spammers/trolls that are not persistent enough to make new accounts (new IP addresses), then nuking does help quite a bit.
@Rob No worries. Let me know if you need to know anything else. In hindsight I didn't really need to blur anything, but I tend to over protect and then peel it back if necessary vs risk slipping up.
[ SmokeDetector | MS ] Url in title, bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, +9 more (989): 360nutra.org/keto-slim-7/ by effifoppuw on blender.SE
[ SmokeDetector | MS ] Bad keyword in body, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, pattern-matching website in body, +5 more (791): healthsuppliment4diet.com/keto-drox/ by Tonnyrow on graphicdesign.SE
@Mithrandir There may be more, but what's been said publicly is that it imposes a block on the IP address, and feeds it into SpamRam. If the spammer isn't one that can/will use other IP addresses then that's the end of them. If it's for users/groups of users like our persistent "keto" spammers, then they have IP addresses which exist just for them to to burn.
For posts we're dialed in on detecting based on content, it doesn't really matter one way or the other from SD's POV, but is good from SE's POV. For things that we (SD) don't, yet, have good detections for the content, it's helpful to have the user stay the same. From the SE + SD/MS system's overall POV, it's good to nuke accounts. Doing so stops an entire (large) class of problem users (spammer and trolls). For the professionals, it doesn't really appear to slow them down all that much.
[ SmokeDetector | MS ] Body starts with title and ends in url, link at end of body, potentially bad ns for domain in body, potentially bad keyword in body, potentially bad keyword in title (200): Keto Drox what's amazingly by teudeckr88James on askubuntu.com
@Seth Thanks, all OK for now; and probably no questions this week. :) --- No problem with blurring it if it's Mod Only info, if people over 10K can see it we probably have someone here whom can access the information in any event.
Searching for Spamram StackExchange turns up a bit more than 200 hits - basically it works on what the server owner can see and flags, while we work the opposite way on what users can see and we produce flags.
[ SmokeDetector | MS ] Url in title, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, mostly non-latin body, +2 more (476): www.jbnproduct.com/ by rajupunjabi on graphicdesign.SE
[ SmokeDetector | MS ] Url-only title, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, link at end of body, +3 more (695): pilpedia.com/rapid-slim/ by xicite201 on askubuntu.com
MetaSmoke has one off error. In this MS report a post from Mar 10 '14 at 14:13 is reported as being answered one hour ago when in fact the post one previous (sorted by votes) is the one from an hour ago.
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, body starts with title and ends in url, link at end of body, +7 more (888): Keto 10 Keto Max by mihjffvb on superuser.com
[ SmokeDetector | MS ] Blacklisted website in body, body starts with title and ends in url, potentially bad ip for hostname in body (295): MaraNutra Turkey by Caroljacobs on wordpress.SE
[ SmokeDetector | MS ] Url-only title, bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, +4 more (790): pilpedia.com/primalis-rx/ by vebefazozi on askubuntu.com
[ SmokeDetector | MS ] Url in title, blacklisted website in body, blacklisted website in title, mostly non-latin body, potentially problematic ns configuration in body, +1 more (378): www.jbnproduct.com/ by FELIXx on graphicdesign.SE
[ SmokeDetector | MS ] Url-only title, bad keyword in body, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, +4 more (694): pilpedia.com/keto-180/ by coneet20 on askubuntu.com
[ SmokeDetector | MS ] Url in title, bad keyword in body, blacklisted website in body, blacklisted website in title, pattern-matching website in body, +5 more (789): topdiethub.com/keto-drox/ by waploxzmjadea on graphicdesign.SE
