I just saw this post which raised my eyebrows a little. The body ends with "Answers fromprofessionals", and username is "AlzadGroup Support". I'm probably overreacting, but it just felt a little weird to see. It's this user's first post. No spam, but does need a MRE.
@starball I have no idea what that "Answers from professionals" is supposed to be, but that's just a run-of-the-mill low-quality question from a new user that needs to be closed as needing a minimal, reproducible example. It's not the type of thing that Charcoal would typically deal with.
The user name definitely smells funny, but there's nothing else there at this point.
@Makyen Watching it in user names is exactly what I was going for when I first broached the subject and persuaded tripleee to try his hand at writing a suitable regex. I think it's reasonable to have it also match "seo" used in short titles.
~50% TPs is a bit lower than I was expecting, but still not enough to deter me, mostly because I think/hope this will catch things that we are otherwise missing, which is why they're not showing up in a MS search.
@Spevacus You can tell it wasn't that automated, based on those checkmarks sneaking into this message :-)
The "throw off Spevacus" step is an essential one in every process.
@SmokeDetector Looks like there was a spam wave a short time ago, with people promoting that service. Although we just now had a question that seemed to be using it innocently, that's not enough to remove it as a watch, and there's nothing I can tell to do in order to tighten up the watch.
@Ethan That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body Append -force to the command word(s) if you really want to add the pattern you provided.
Your original watch was too FP prone because it wasn't limited to user names. You think ~50% TP is too FP-prone? Especially considering that the whole point of the watch would be to catch things that we are not currently catching and thus aren't necessarily in the MS database? I don't.
@CodyGray I don't disagree entirely, but that detection produced more than a dozen alerts in a single day, many of which were FP; if we can make it less noisy, I'm all for it
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in link text in body, blacklisted website in body, link at beginning of body, potentially bad asn for hostname in body, +3 more (307): What is Digital Marketing? ✏️ by Agnes Jacob on stackoverflow.com
