[ SmokeDetector | MS ] Potentially bad asn for hostname in body, potentially bad ip for hostname in body, potentially bad ns for domain in body, potentially bad keyword in body, blacklisted user (77): Solar Panel in Bangladesh by Power Ark Engineering on magento.SE
[ SmokeDetector | MS ] Bad ip for hostname in answer, bad ns for domain in answer, bad keyword in answer, blacklisted website in answer, potentially bad keyword in username (366): How to properly freeze kefir grains by spammer on cooking.SE
> Bad ns for domain in body, bad keyword in body, potentially problematic ns configuration in body ---------- Bad keyword in body - Position 0-19: revenantcyberhacker Bad ns for domain in body - revenantcyberhacker.org NS suspicious ns6.hostnownow.com.,ns5.hostnownow.com. Potentially problematic ns configuration in body - Suspicious nameservers: all IP addresses for revenantcyberhacker.org are in set {'104.194.9.178'}
@Dragonrage Matched by revenant[\W_]*+cyber[\W_]*+hacker(?!\.com(?<=revenantcyberhacker\.com))(?!\.net(?<=revenantcyberhacker\.net))(?:[\W_]*+(?:at[\W_]*+)?gmail(?:[\W_]*+(?:dot[\W_]*+)?com)?)? on line 2932 of bad_keywords.txt
@Anerdw Yeah, it was posted when there were 200,000 true positives, long before there was any inclination that there'd be trouble with people registering for it.
[ SmokeDetector | MS ] Bad ip for hostname in body, bad ns for domain in body, bad keyword in body, bad keyword in link text in body, blacklisted website in body, +3 more (535): What is Supply Chain Management? by Transglobe seo on askubuntu.com (@PetəíŕdtheWizard)
[ SmokeDetector | MS ] Potentially bad ip for hostname in answer, potentially bad ns for domain in answer, potentially bad keyword in answer, username similar to website in answer (77): Add URL parameters to XML Sitemap? by Elightwalk on stackoverflow.com (@PetəíŕdtheWizard)
@Dragonrage A normalized version, {{'9814790990'}}, of that pattern is already on the number watchlist and the pattern you provided is not an exact match to an existing entry on the number watchlist. You can use !!/bisect-number 9814790990 to determine which entries on the number lists match that pattern, which would tell you: Matched by 9814790990(?#NO NorAm) on line 4825 of watched_numbers.txt: 9814790990 found verbatim
@Dragonrage That pattern looks like it's already caught by Bad keyword in answer and Bad keyword in body Append -force to the command word(s) if you really want to add the pattern you provided.
@cocomac I didn't immediately see a good reason for that. Unfortunately, the logs I have access to don't go back that far. If it's critical, I believe the logs are stored indefinitely, but the ones currently available through the UI are significantly limited. I believe I could make code changes which would increase that, but haven't done so over the years I've known about the limitation.
@ipodtouch0218 The spammer Including their own thing in a list of products/services is not all that uncommon a way to spam, based on known spam examples over the years. [Not an evaluation of this specific case.]
@GeneralGrievance the only way I can make the math work is if the get_domain() function didn't remove the .net portion, making the ratio 0.81 (less than SIMILAR_THRESHOLD), but ... when I manually test that portion of the code locally, it seems to do the right thing, so I'm back to ¯_(ツ)_/¯
@ipodtouch0218 yes, several, at github.com/Charcoal-SE/SmokeDetector/wiki/… -- including: "!!/test-a for answer, !!/test-q for question body, !!/test-t for title, or !!/test-u for username"
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 0-8: sportzfy Potentially bad keyword in title - Position 0-8: sportzfy Potentially bad keyword in username - Position 0-8: sportzfy
> Potentially bad ip for hostname in body, potentially bad ip for hostname in title, potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad ip for hostname in body - profitablecpmrate.com suspicious IP address 192.243.59.13 Potentially bad ip for hostname in title - profitablecpmrate.com suspicious IP address 192.243.59.13 Potentially bad keyword in body - Position 0-21: profitablecpmrate.com Potentially bad keyword in title - Position 0-21: profitablecpmrate.com
