> Url in title, bad keyword in body, bad keyword in title, bad keyword in username, potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Bad keyword in body - Position 33-39: cbdoil Bad keyword in title - Position 33-39: cbdoil Bad keyword in username - Position 33-39: cbdoil Potentially bad keyword in body - Position 30-42: topcbdoilhub, Position 43-62: sure-botanicals-cbd Potentially bad keyword in title - Position 30-42: topcbdoilhub, Position 43-62: sure-botanicals-cbd
> Bad keyword in body, bad keyword in title, bad keyword in username ---------- Bad keyword in body - Position 0-7: cbd oil Bad keyword in title - Position 0-7: cbd oil Bad keyword in username - Position 0-7: cbd oil
> Bad keyword in body, bad keyword in title, bad keyword in username ---------- Bad keyword in body - Position 0-6: BiOfIT Bad keyword in title - Position 0-6: BiOfIT Bad keyword in username - Position 0-6: BiOfIT
> Url in title, bad keyword in body, bad keyword in title, bad keyword in username, potentially bad ns for domain in body, potentially bad ns for domain in title, potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Bad keyword in body - Position 28-40: spectrum-cbd Bad keyword in title - Position 28-40: spectrum-cbd Bad keyword in username - Position 28-40: spectrum-cbd Potentially bad keyword in body - Position 8-22: kingtipper.com Potentially bad keyword in title - Position 8-22: kingtipper.com
@Stormblessed That pattern looks like it's already caught by Bad keyword in body and Bad keyword in answer; append -force if you really want to do that.
@Stormblessed That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; append -force if you really want to do that.
> Blacklisted website in body, blacklisted website in title ---------- Blacklisted website in body - Position 0-12: mumybear.org Blacklisted website in title - Position 0-12: mumybear.org
> Blacklisted website in body, blacklisted website in title, pattern-matching website in body, pattern-matching website in title ---------- Blacklisted website in body - Position 0-13: healthcaresup Blacklisted website in title - Position 0-13: healthcaresup Pattern-matching website in body - Position 0-20: healthcaresupchat.co Pattern-matching website in title - Position 0-20: healthcaresupchat.co
> Url in title, bad ns for domain in body, bad ns for domain in title, bad keyword in body, bad keyword in title, bad keyword in username, blacklisted website in body, blacklisted website in title, pattern-matching website in body, pattern-matching website in title ---------- Bad keyword in body - Position 9-14: nutra Bad keyword in title - Position 9-14: nutra Bad keyword in username - Position 9-14: nutra Bad ns for domain in body - nutrasunnaturalgreencleanseblog.com NS suspicious reza.ns.cloudflare.com.,lloyd.ns.cloudflare.com.
> Blacklisted website in body, blacklisted website in title ---------- Blacklisted website in body - Position 1-12: healthflyup Blacklisted website in title - Position 1-12: healthflyup
> Url in title, blacklisted website in body, blacklisted website in title, pattern-matching website in body, pattern-matching website in title ---------- Blacklisted website in body - Position 13-33: hairlosspropecia.org Blacklisted website in title - Position 13-33: hairlosspropecia.org Pattern-matching website in body - Position 13-33: hairlosspropecia.org Pattern-matching website in title - Position 13-33: hairlosspropecia.org Url in title - Position 1-33: https://www.hairlosspropecia.org
> Bad keyword in body, bad keyword in title, bad keyword in username, pattern-matching website in body, pattern-matching website in title ---------- Bad keyword in body - Position 4-12: garcinia Bad keyword in title - Position 4-12: garcinia Bad keyword in username - Position 4-12: garcinia Pattern-matching website in body - Position 4-26: garciniabodyprobuy.com Pattern-matching website in title - Position 4-26: garciniabodyprobuy.com
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 0-16: sleepreality.com Potentially bad keyword in title - Position 0-16: sleepreality.com Potentially bad keyword in username - Position 0-16: sleepreality.com
@Stormblessed All of the watch and blacklists are, by default, case-insensitive. You can turn on case sensitivity by enclosing what you want to be case sensitive in a group which turns off the i flag. That looks like: (?-i:This IS CasE sEnSiTiVe)
@Stormblessed That depends on what you are proposing. If it's a watch, then you can just !!/watch. If it's a blacklist you can !!/blacklist-[appropriate list]. If it's something more complex, then you can begin a discussion, open an issue on GitHub, and/or write the code and submit a PR. If it's a new detection, there's a write-up here
@Stormblessed Ultimately, the person who runs the site is Undo. However, there are a few developers (Undo, ArtOfCode, and thesecretmaster), and some more people who are admins. You can get a list of admins using the !!/whois admin command. In general, the admins can handle most issues, but there are some that require a developer or Undo. Any admin should be able to tell you if someone else is needed.
@Stormblessed General comments (I have not yet looked through the transcript, nor at any of your recent watch and/or blacklist PRs in detail):
For many of your blacklists, they are going to be declined if they have not already demonstrated that they are detecting spam that's already in MS. In general, most things should go on the watchlist first, to let them be run against all the posts which are checked prior to putting them on the blacklist, just to be sure that it's not getting FP, as the data on MS is very biased towards things that are spam.
You should also regularly check for things you watch/blacklist on a search of SE. Unfortunately, SE search does not support regular expressions, so you often need to get creative. If it's only a couple of words that are required together, then you can put them in quotes. If it's something that is expected to be in URLs, then you can prefix the search with url:.
We're going to be much more willing to watch things than blacklist. The blacklist is kept as maintaining a true positive rate in the high 90's.
Unfortunately, there isn't a good way to test how much a username is used accross SE. At a minimum, I usually check for username matches on Stack Overflow, as it has the most users. You can also use an SEDE query, but that also is only on a per-site basis. Watches intended to target usernames should almost always be for the entire username and include ^ and $ to indicate the start and end of the regular expression.
If the spammer has not demonstrated that they are using multiple different ways of using case in their username, then case insensitivity should be turned off.
@Makyen That pattern looks like it's already caught by Potentially bad keyword in body, Mostly punctuation marks in body, Mostly punctuation marks in answer, and Potentially bad keyword in answer; append -force if you really want to do that.
@Makyen That pattern looks like it's already caught by Bad keyword in answer, Pattern-matching website in answer, Pattern-matching website in body, and Bad keyword in body; append -force if you really want to do that.
@Stormblessed Watches and blacklists, except the -number lists, are regular expressions. If you want to match an actual ., then you need to use \.. This should have been smoreworld\.com Please re-submit your !!/blacklist-website.
@Stormblessed Nope. You should leave a comment on the PR. If you happen to be talking to someone who has the ability to close PRs on GitHub (code admins should be able to do so), then you can ping them.
@Stormblessed That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; append -force if you really want to do that.
:51390818 That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; append -force if you really want to do that.
@Stormblessed That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; append -force if you really want to do that.
@Stormblessed It would be !!/blacklist-website-force. When SD replies with a reason that you need to use -force, then you should make sure you know exactly why it is being detected by other reasons, and make an evaluation as to it being appropriate to have the detection. You will see me, and others, often use -force, but that's because we've already considered why it is being caught and made that evaluation. (Often, I've already spent several minutes composing watches and blacklists.)
@Stormblessed Looking at this a bit more closely, the domain hasn't been seen in any spam for almost 1.75 years. In addition, it only has 3 hits on MS. As such, this would be more appropriate as a watch, rather than a blacklist.
@Stormblessed We do get a reasonable quantity of spam for drugs, but the single words for a drug are also used in non-spam posts, so when we detect them, they are often detected in combination with other words.
@Stormblessed There was some for what appears to be the same company 14 days ago, but it used the domain bestpillstoday.se.
> Blacklisted website in body, blacklisted website in title, pattern-matching website in body, pattern-matching website in title, pattern-matching website in username, potentially bad asn for hostname in body, potentially bad asn for hostname in title ---------- Blacklisted website in body - Position 0-19: worldmuscleking.com Blacklisted website in title - Position 0-19: worldmuscleking.com Pattern-matching website in body - Position 5-19: muscleking.com Pattern-matching website in title - Position 5-19: muscleking.com
> Bad keyword in body, bad keyword in title, bad keyword in username ---------- Bad keyword in body - Position 0-10: ketoviante Bad keyword in title - Position 0-10: ketoviante Bad keyword in username - Position 0-10: ketoviante
> Blacklisted website in body, blacklisted website in title, pattern-matching website in body, pattern-matching website in title, potentially bad ns for domain in body, potentially bad ns for domain in title ---------- Blacklisted website in body - Position 0-17: fitnesreviews.com Blacklisted website in title - Position 0-17: fitnesreviews.com Pattern-matching website in body - Position 0-16: fitnesreviews.co Pattern-matching website in title - Position 0-16: fitnesreviews.co Potentially bad ns for domain in body - fitnesreviews.com NS suspicious dns1.namecheaphosting.com.,dns2.namecheaphos…
> Blacklisted website in body, blacklisted website in title, potentially bad ns for domain in body, potentially bad ns for domain in title ---------- Blacklisted website in body - Position 0-14: pillsdrive.com Blacklisted website in title - Position 0-14: pillsdrive.com Potentially bad ns for domain in body - pillsdrive.com NS suspicious dns1.namecheaphosting.com.,dns2.namecheaphosting.com. Potentially bad ns for domain in title - pillsdrive.com NS suspicious dns1.namecheaphosting.com.,dns2.namecheaphosting.com.
@Stormblessed There is a related watch here. I'll adjust it so that it does not require "keto", which picks up one additional post, and move it to the blacklist.
@Stormblessed There's also a blacklisted-keyword here for keto\W*body(?:\W*(?:tone|avis|fr|web|\d+))*
And, we are not currently watching, or have blacklisted, keto-bodytone\.com.
@Stormblessed That pattern looks like it's already caught by Bad keyword with email in answer and Bad keyword with email in body; append -force if you really want to do that.
PR#3284 ("Stormblessed: Blacklist johnsonjohnsononline\@gmail\.com") opened by SmokeDetector
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 5-22: bestpillstoday.se Potentially bad keyword in title - Position 5-22: bestpillstoday.se Potentially bad keyword in username - Position 5-22: bestpillstoday.se
@Stormblessed This is already watched as johnsonjohnsononline(?:@gmail\.com)?. It's not shown as detecting your first blacklist attempt due to the \@. The @ doesn't have any special meaning in a regular expression, so doesn't need the backslash to quote/escape it. When testing the pattern you've provided, SD doesn't know that it should remove the \ in that circumstance, so it passes johnsonjohnsononline\@gmail.com to the detection code, which doesn't match the existing regex.
This sort of thing is relatively common when mixing regular expression syntax with text. The interactions can get complex and it's something that often ends up running into cases which are not perfectly handled.
@Makyen That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@Makyen That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@Makyen That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; append -force if you really want to do that.
@Makyen That pattern looks like it's already caught by Bad keyword in body, Bad keyword in answer, Pattern-matching website in answer, and Pattern-matching website in body; append -force if you really want to do that.
@ArtOfCode Given that you just dropped in :-): The error on this post page was reported, but I haven't really had a chance to look at it yet. It appears that a comment exists, but is null.
@terdon Those abuse reports have public access built-in - the direct link using the numeric ID is restricted access, but anyone who can access that link can also access a publicly shareable link for it, using a UUID.
It's done like that so that if reports do include sensitive data, they're not public by default, but can be shared if that's useful.
> Bad keyword in answer, pattern-matching website in answer, potentially bad asn for hostname in answer ---------- Bad keyword in answer - Position 0-8: dietpill Pattern-matching website in answer - Position 0-23: dietpillsrevolution.com Potentially bad asn for hostname in answer - dietpillsrevolution.com address 77.72.0.142 in ASN 12488
> Potentially bad ns for domain in body, potentially bad ns for domain in title ---------- Potentially bad ns for domain in body - review-with-raju.com NS suspicious dns2.namecheaphosting.com.,dns1.namecheaphosting.com. Potentially bad ns for domain in title - review-with-raju.com NS suspicious dns2.namecheaphosting.com.,dns1.namecheaphosting.com.
