[ SmokeDetector | MS ] Few unique characters in body, mostly punctuation marks in body, potentially bad keyword in title (121): gfgfhfhghghghdh ✏️ by cody c on security.SE
@NobodyNada Wrt this, could we blacklist the specific website this user continues to use? There's a fair bit of confusion on some of the most recent posts of theirs, and it'd increase the weight of them by a fair bit. Might be able to squeeze out another autoflag or two.
Hm. It does seem to be changing. Apologies, this may be trickier than I first thought.
!!/test <p>Take a look at this document with the links to my images you used at worldbuilding.stackexchange.com and my earlier publications to get the evidence of my ownership.</p> <p>Download it right now and check this out for yourself:</p> <p><a href="https://sites.google.com/view/id8230017720014/google/drive/file/downloads/storage?FileID=113487442210185431" rel="nofollow noreferrer">https://sites.google.com/view/id8230017720014/google/drive/file/downloads/storage?FileID=113487442210185431</a></p>
> Url in title, blacklisted website in body, blacklisted website in title, potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Blacklisted website in body - Positions 265-338, 400-473: sites.google.com/view/id8230017720014/google/drive/file/downloads/storage Blacklisted website in title - Positions 265-338, 400-473: sites.google.com/view/id8230017720014/google/drive/file/downloads/storage Potentially bad keyword in body - Position 181-234: Download it right now and check this out for yourself, Position 265-365: sites.google.com/v…
@NobodyNada This was effectively already watched. Please either remove the watch or change one or the other of the watch or the blacklist, so that it's not double-detected.
@Makyen Fair enough -- I thought it was best to have a specific blacklist and more general watches (since the blacklist doesn't catch everything) -- but I didn't think about the risk of double-detection.
would it be best to add negative lookarounds to the watches?
@NobodyNada It's good/fine to do that, we just need the general one to exclude the specific one. Yes, negative lookarounds are generally the way to accomplish preventing the more general one from matching the specific.
!!/unwatch sites\.google\.com\S*/(?:google)?drive/\S*+(?#sites.google.com masquerading as drive.google.com)
!!/watch sites\.google\.com\S*/(?:google)?drive/(?:file/downloads/storage)?+(?<!sites\.google\.com/view/id\d++/google/drive/file/downloads/storage)(?#sites.google.com masquerading as drive.google.com)
@SmokeDetector hrmmmmmmm this is borderline...affiliation disclosed but seems like a formulaic copy-paste that isn't written for this question...thoughts?
@SmokeDetector Custom flagged: This is part of a network-wide spam campaign promoting this product on virtually any question related to remote desktop software. It is quite doubtful, given the history, that this is a legitimate attempt from an unaffiliated party to recommend a product that they've used and believe is a good fit here.
@SmokeDetector Appears to be a response to comments on bicycles.stackexchange.com/a/52554/52386 from someone who's lost the credentials to their account. Affiliation with the link is disclosed.
What do you guys think of this? https://aviation.stackexchange.com/a/82653/1467 2 links to this never-seen-before in5minutes site and I find "Paul is the Founder & Editor of in5minutes.com"
@Federico as you are a mod on that site I would defer to you, do you want to give them a fair warning first or do you have reason to believe they are consciously breaking the rules?
@RyanM That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
[ SmokeDetector | MS ] Bad keyword in body, bad pattern in url body, blacklisted website in body, pattern-matching product name in body, potentially bad ip for hostname in body, +3 more (385): What Is The Virilyn Price? by michelstark on superuser.com
[:56334301] That message is not a report. [:56334300] <processed without return value> [:56334286] <processed without return value> [:56334280] <processed without return value>
