@tripleee np. If you want BOL7, but not in code, you could use: BOL7(?!(?:[^<]|<[^c]|<c[^o]|<co[^d]|<cod[^e]|<code[^>])*?</code>) It's not perfect (i.e. don't parse HTML with a regex :-) ), but it handles most cases of not matching within a <code></code>.
@Makyen in keeping with the guidance to avoid rule overlap, we have already blacklisted bol7.com so I think we would prefer something which looks at a different part of the spams
@tripleee I can understand that. What I was referring to is that BOL7 is used as text within some of the spams. You could use BOL7(?!\.com)(?!(?:[^<]|<[^c]|<c[^o]|<co[^d]|<cod[^e]|<code[^>])*?</code>) which would not match the domain and thus not have any overlap.
[ SmokeDetector | MS ] Bad NS for domain in body, bad keyword in body, blacklisted website in body, body starts with title and ends in URL, link at end of body, +1 more: levels of your body. Furthermore, by Frothen19 on askubuntu.com
[ SmokeDetector | MS ] URL-only title, bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, +1 more: mumybear.com/summer-keto/ by nwairai201 on askubuntu.com
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Title - Position 1-14: yamarkets.com Body - Position 1-14: yamarkets.com Username - Position 1-14: yamarkets.com
@tripleee That pattern looks like it's already caught by Mostly non-latin answer and Mostly non-latin body; append -force if you really want to do that.
@tripleee Added [a-z_]*(?:1_)?855[\W_]*441[\W_]*4436[a-z_] to watchlist
CI on 38b1e2f succeeded. Message contains 'autopull', pulling...
[ SmokeDetector ] SmokeDetector started at [rev 38b1e2f (SmokeDetector: Auto watch of [a-z_]*(?:1_)?855[\W_]*441[\W_]*4436[a-z_]* by tripleee --autopull*)](//github.com/Charcoal-SE/SmokeDetector/commit/38b1e2f) (running on teward/Solar Flare)
@tripleee Thank you for that! If it works well I suggest we should try having it active for other sites, since I'm sure I've seen it in at least one other place.
@doppelgreener it's easy to change, though the semantics of that control are slightly weird (if 'all' is False the list names the sites to cover; if it's True it says which sites to not include)
@tripleee That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; append -force if you really want to do that.
I think it would be safe to construct it like so: - contains eight title case words in a row, separated by anything that isn't a title case word - contains "Japan" anywhere at all
scrolled back through 8 months of spam TPs mentioning Japan, I don't think there are any older hits...? Is this actually a new MO for Anonymous Teacher?
I can only speculate but a common snowshoe tactic is to not use a single domain for your spamming operations; we certainly see this with the pharma domains where sometimes a domain is dormant for years and then comes back and starts spewing
on the other hand it might just be "hey it didn't work so well last time but now we have changed some things so let's try again"
Yeah I've seen a few which are quiet for a while and come back, are the spam reports kept indefinitely or is there like a time when records are deleted?
so-called guerrilla marketers seem to have this mindset that making enemies is part of the business and as long as people end up clicking on the links and they don't actually get caught murdering infants with a rusty shovel they're fine
@JakeSymons Metasmoke is forever
watches should probably be removed at some point if they don't catch anything but the oldest are only just over a year old so we might want to keep them for a while still
So with the watched usernames, if there are a lot of normal users beign caught because of the name, do we remove that watched name or add each user to whitelist individually
but if there's a very small number of known-good users to whitelist what you propose is not completely out of the question
for example, a really specific user name which is currently taken by a small number of users and unlikely to be used by new users might make sense to handle with a watch + whitelist combo
Bill Gates or John Smith is definitely not "really specific", user5772156649 is unlikely to be registered even by people who actually like Euler's constant
yes, there are multiple facilities here, I probably get them mixed up again if I try to summarize ad hoc ... but "blacklisted user" is different from "blacklisted username" (the first refers to the specific immutable Stack Exchange user ID, the latter to the public profile name which can be changed) and "blacklisted keyword" applies to the latter as well as to post title and body text
[ SmokeDetector | MS ] Bad keyword in answer, bad keyword with email in answer, email in answer, pattern-matching email in answer: How to heal undead by marria on rpg.SE
@tripleee Oh ok, yeah there's quite a lot about the system that I need to explore I've just come back to SE now the bulk of my exams are finished so I'm still catching up with everything
so !!/addblu https://meta.stackexchange.com/users/374644/jake-symons to blacklist user id 374644 (that's you), !!/blacklist-keyword ^Jake Symonds$ to block by your current profile name (the regex anchors ^ and $ make it unlikely to match on a post title or body, though it's technically possible that someone would title a question literally "Jake Symonds")
I've somehow got in the 9% of SO this week just from editing alone. I don't do that much coding at the moment so that is where all my rep has come from on there :)
For some reason this answer
https://serverfault.com/a/671363/1435
keeps getting editing by spammers, can we just lock the question for good?
