@Ethan Because the initial manual report was half an hour after the last answer was posted, so all of the answers had already been scanned, but we didn't have anything that caught them at that time.
@Ethan No, that's not actually what I said. SD already scanned each answer shortly after it was posted. There wasn't anything in them that triggered a detection. When one of them was manually reported a half hour after the last one was posted, SD doesn't go back and rescan all posts.
Actually, SD wouldn't have rescanned them for a day, unless those answers were actually changed. SD doesn't rescan a post that hasn't changed since it last scanned the post, as long as that last scan was within 24 hours, even if SD's detections have been changed in a way which might, now, detect the post. So, a manual !!/scan, !!/report, or !!/allspam would be needed (!!/allspam isn't appropriate in this case, due to an existing question by the user).
@SmokeDetector Custom flagged: This is spam. This flag is to provide some context. This answer is part of a spam campaign that's been posting nearly identical answers across the Stack Exchange Network for the last several months. There have been at least 85 answers posted in that time across many different SE sites. You can see a list of them here on metasmoke.
Just FYI: I've created a tag on MS, currently called "spam-campaign-de-gran", to hold posts in the Spanish language digital advertising spam campaign which are normally posted by Jose or Alberto. I created it so we can track them and more easily point people to the list when explaining the posts. I only did a cursory search for the posts on MS, so there could easily be ones I missed. If you happen to see any, feel free to add the tag.
4
If someone wants to come up with a better name for the tag, I'm not really attached to the above name. It merely reflects the search I used to find the posts I added to the tag.
The quota_remaining property was not in the API response. Error: no method found with this name at 04:35:39 UTC. Backing off on requests for the next 12 seconds. Previous URL: https://api.stackexchange.com/2.2/questions?site=stackoverflow.com
[ SmokeDetector | MS ] Bad keyword in answer, link at beginning of answer, pattern-matching website in answer, potentially bad keyword in answer, potentially problematic ns configuration in answer (202): Linux "Top" command for Windows Powershell? by NSP on superuser.com
[ SmokeDetector | MS ] Bad keyword in link text in answer, link at beginning of answer, pattern-matching website in answer, potentially bad keyword in answer, potentially problematic ns configuration in answer (195): Linux "Top" command for Windows Powershell? by Coin Bazaar on superuser.com
@tripleee That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer Append -force to the command word(s) if you really want to add the pattern you provided.
@tripleee A normalized version, {{'0775543886'}}, of that pattern is already on the number watchlist. You can use !!/bisect-number 0775 543 886 to determine which entries on the number lists match that pattern, which would tell you: Matched by 0775 543 886 on line 3299 of watched_numbers.txt: 0775 543 886 found verbatim
[ SmokeDetector | MS ] Body starts with title and ends in url, link at end of body, potentially bad asn for hostname in body, potentially bad ip for hostname in body, potentially bad ns for domain in body, +3 more (270): Softgel Capsule Manufacturing by Saphnix Lifesciences on superuser.com
@SmokeDetector tpu- This reads like spam. User has also suggested an edit on another site superuser.com/a/1336625 that replaces what looks like a legit link with the same link posted here. They also have another answer that looks to be promoting the same site except without a link softwarerecs.stackexchange.com/a/84675. Custom flagged on both sites. Blacklisting the user on softwarerecs.se to see if they insert a spam link, or post related promotional content.
@SmokeDetector About 1.9K users on the network (case-insensitive, so it's an overcount), and it's a very common real name. 2 fp in the last day, and only one post on MS that wouldn't have been caught otherwise.
STDERR: To https://github.com/Charcoal-SE/SmokeDetector.git ! [rejected] master -> master (fetch first) error: failed to push some refs to 'https://github.com/Charcoal-SE/SmokeDetector.git' hint: Updates were rejected because the remote contains work that you do hint: not have locally. This is usually caused by another repository pushing
### ErrorReturnCode_128 on teward/Thoth at 2022-12-01T06:15:42Z:
RAN: /usr/bin/git pull
STDOUT:
STDERR: hint: You have divergent branches and need to specify how to reconcile them. hint: You can do so by running one of the following commands sometime before hint: your next pull: hint: hint: git config pull.rebase false # merge (the default strategy) hint: git config pull.rebase true # rebase hint: git config pull.ff only # fast-forward only hint: hint: You can replace "git config" with "git config --global" to set a default
On branch master Your branch and 'origin/master' have diverged, and have 2 and 1 different commits each, respectively. (use "git pull" to merge the remote branch into yours)
@Ethan The one with the email address that cocomac watched just after the one you tried to add is usually a good idea, since those tend to reappear in subsequent posts in the campaign.
@SmokeDetector fp- The answer doesn't appear to be spam. User doesn't seem affiliated, and the answer is providing a resource that the question asks for.
@tripleee That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body Append -force to the command word(s) if you really want to add the pattern you provided.
[ SmokeDetector | MS ] Bad ip for hostname in body, blacklisted website in body, potentially bad keyword in body, potentially bad keyword in username, potentially problematic ns configuration in body, +1 more (271): How to merge pst file? by ignissta akash on superuser.com
@SmokeDetector tpu- Copied verbatim from another answer to the question stackoverflow.com/a/51774347 with a link to their own blog (see profile), no disclosure. Custom flagged.
@SmokeDetector The same link is in all other answer of that user. On second sight, the answer appears to be slightly different than the existing one, so probably not spam?
@tripleee That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body Append -force to the command word(s) if you really want to add the pattern you provided.
@tripleee Already watched on line 45153 of watched_keywords.txt
