I know this has 1 FP, but it has 70 TPs and is pretty much always spam, and has an accuracy of over 95%, so I'm blacklisting it, but if it should be a watch, let me know
@cigien Please provide an adequate reason for rejection (at least 20 characters long) so the user can learn from their mistakes. Use -force to force the reject
@cocomac Yes, something like that should be a watch first for a notable amount of time prior to being put on the blacklist. Please keep in mind that the data in MS is very biased towards TP posts. Even things with very high TP/FP rates in the data on MS can end up with substantial FP when tested against all data on SE and all future posts.
@cocomac I'm going to go with a pattern that more broadly matches the obfuscated "@gmail.com" series that spammers such as the one your watch targets tend to use.
@Spevacus That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer Append -force to the command word(s) if you really want to add the pattern you provided.
@Spevacus Is doing that preferable, given that the gmail.com obfuscated version is already watched? (I don't mind - but I'd like to know if that is the right way to do it)
The quota_remaining property was not in the API response. Error: Violation of backoff parameter at 02:31:41 UTC. Backing off on requests for the next 12 seconds. Previous URL: https://api.stackexchange.com/2.2/questions
The quota_remaining property was not in the API response. Error: Violation of backoff parameter at 02:32:05 UTC. Backing off on requests for the next 12 seconds. Previous URL: https://api.stackexchange.com/2.2/questions
The quota_remaining property was not in the API response. Error: Violation of backoff parameter at 02:32:43 UTC. Backing off on requests for the next 12 seconds. Previous URL: https://api.stackexchange.com/2.2/questions
@cocomac What's currently watched is generic gmail obfuscation, which is somewhat news to me (here's the regex: gmail[\W_]*+(?:dot[\W_]*+)?com(?<!gmail\.com) ) - I'm actually unsure if we should include the obfuscation in gmail watches against that kind of obfuscation.
I initially based the replacement with gmail obfuscation on what I'm typically used to doing in that scenario
So.... I dunno? Maybe Makyen, cigien, or Ryan could weigh in
@SmokeDetector tpu IMO, someone looking for a study partner is (to some degree) someone wanting to hire someone, and per this Meta post job offers are spam, so I feel it is spam, even though it is a bit of a stretch.
I reported it so I’m not giving feedback, but if they post again I’d like it reported so I’m blacklisting them until someone else gets a chance to review that MS report
@cocomac Registered answer as true positive and blacklisted user.
[ SmokeDetector | MS ] Bad keyword in title, potentially bad ip for hostname in body, potentially bad ns for domain in body, potentially bad keyword in body, potentially bad keyword in username (102): Which is the best preschool in India? by junior dps on chemistry.SE
[ SmokeDetector | MS ] Potentially bad ns for domain in answer, potentially bad keyword in answer, username similar to website in answer (70): Flutter custom clipper by join clipper on stackoverflow.com
[ SmokeDetector | MS ] Potentially bad ip for hostname in body, potentially bad ns for domain in body, potentially bad keyword in body (3): PANDIT JI LUCKNOW by PANDIT JI on askubuntu.com
[ SmokeDetector | MS ] Link at beginning of body, potentially bad ip for hostname in body, potentially bad ns for domain in body, potentially bad keyword in body, potentially bad keyword in username (44): What is SEO and how it work by muhammad imran on superuser.com (@Ollie)
[ SmokeDetector | MS ] Bad ns for domain in body, blacklisted username, blacklisted website in body, potentially bad ip for hostname in body, potentially bad keyword in body, +1 more (287): How To Develop NFT Gaming Platform? by GamesDApp on stackoverflow.com
[ SmokeDetector | MS ] Potentially bad keyword in answer, potentially bad keyword in username, username similar to website in answer, blacklisted user (141): What can cause infertility in men? by CRYSTA IVF on medicalsciences.SE (@IanCampbell)
@Glorfindel That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body Append -force to the command word(s) if you really want to add the pattern you provided.
@Spevacus @cocomac In general, yes, if the thing you're watching is an email and the spammer has demonstrated that they will use obfuscation on the email domain, then please include the domain with obfuscation in the regex in the general form which you use here. If the spammer hasn't used obfuscation (e.g. extra spaces, "at", "dot", etc.), then just have the domain as normal. The point of the watch on what appears to be an obfuscated gmail.com email by itself is to detect such emails for which we don't have a specific detection. There's a few different arguments on both sides, but the way that we've been doing it is to include the domain with the email username. To a large extent it's so that it's easier for humans reading the why data to see what's going on.
