[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, +2 more (493): thesanofi.com/krygen-xl/ by nikampfs on wordpress.SE
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, +2 more (493): thesanofi.com/keto-deluxe/ by cjdgnrte on wordpress.SE
@double-beep I removed the two domain tags you asked for. As to the AS58182 tag, there doesn't appear to be a way to change if a domain-tag is special or not through the user interface. The only place the "special" flag appears to be set is based on an automatic lookup of the ASN when a spam domain is created. Unfortunately, that lookup is broken for wixsite.com domains and others.
I was, however, able to find a domain in that ASN which does get looked-up properly in order to create a new #AS-58182 tag and then merge the tag you linked into that one.
I believe I have a fix for the ASN lookup, so I'll add that, which should prevent the need/desire for someone to manually create an ASN tag in the future for new spam domains. However, that won't add ASN tags for any domains which predated the ASN tags and/or were affected by the lookup problem. Adding ASN tags in bulk for existing spam domains is a bit beyond what I'd want to try at the moment.
!!/watch-force- www\.today22\.com(?#Abuse the watchlist to get a third detection on a persistent spammer.)
@Makyen That pattern looks like it's already caught by Blacklisted website in answer, Pattern-matching website in answer, Pattern-matching website in body, Bad keyword in answer, Blacklisted website in body, and Bad keyword in body; append -force if you really want to do that.
@rene I haven't looked at the full context of what you're asking about. However, MS has certainly been linked to before from MSE. I don't know of any policy which would prohibit linking. The information is public. I think we'd prefer if it's not linked to in a comment underneath a spam post, but that's merely because it could directly draw the attention of the spammer (with a couple/few rare spammers/trolls that attention has been somewhat inconvenient).
[ SmokeDetector | MS ] Few unique characters in body, luncheon meat detected, no whitespace in body, repeating characters in body (303): closed closed closed ✏️ by Jhin Scripter on stackoverflow.com
[ SmokeDetector | MS ] Few unique characters in body, luncheon meat detected, no whitespace in body, repeating characters in body (303): closed closed closed ✏️ by Jhin Scripter on stackoverflow.com
[ SmokeDetector | MS ] Url-only title, bad keyword in body, bad keyword in title, pattern-matching product name in body, potentially bad ns for domain in body, +3 more (396): pillsneed.com/diamond-247-keto/ by qoolsoox on askubuntu.com
@Stormblessed We generally only add the obfuscation to the watch when the spammer is seen using obfuscation. If you want to have it in most of the ones you add, it's not unreasonable to do so. Mostly, it's that adding the obfuscation takes a bit more work.
@Stormblessed That's possible, but non-trivial. Usually, we want to specify how far apart the words can be in the post, with a strong preference for requiring them to be close together. Basically, you have to build the regex such that it has different matches for each order. Alternately, you can look for repeats of a set of words and then exclude the ones where there's a double of the same word using a negative lookahead or lookbehind.
@Stormblessed Usually, we'd use \s+ or \s* instead of a space, but a space isn't wrong, if that's the only separator that you actually want, but it means that the OP can't have hit return between any of the words. Alternately, we use \W+ or \W* if the separation between words can be things other than whitespace (e.g. -). If you also want to have _ as a possible separator, then use [\W_]+ or [\W_]*.
You'll see me commonly use [\W_]*+, but adding the extra + in that can have unintended side effects when the regex gets more complex. However, for something that is strictly non-optional words separated by [\W_]*+, it should work as expected.
@Stormblessed Yes, they are. They can get quite complex.
