@SmokeDetector The match of first name of the username to the first name of the person who posted the YouTube video, along with the first two letters of the last name, make it feel likely that there's undisclosed affiliation here. However, I'm not seeing enough to me sure enough about the undisclosed affiliation to call it TP (e.g. the video is from 2.5 years ago and has 2.5k views).
@user12986714 That pattern looks like it's already caught by Blacklisted website in answer and Blacklisted website in body; append -force if you really want to do that.
@Makyen I'm fine with that. Both of my instances are running in Docker so version requirement is pretty easy to satisfy. In addition, both hosts are Debian Buster which ships 3.7.
@user12986714 indeed, but they have different name servers ... not sure it's an indication of anything as such, but in the past we have noticed that Cloudflare sometimes seems to put related domains (and no others) on the same pairs of name servers
@user12986714 how so? I haven't seen this with Cloudflare before but shared hosting is definitely a thing ... the Google-hosted spammers in particular often share an IP address with legit domains
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, link at end of body, pattern-matching website in body, +2 more (491): Houston seo services by Mavzuna Abdurahmonova on askubuntu.com
[ SmokeDetector | MS ] Bad keyword with email in body, blacklisted website in body, potentially bad ip for hostname in body, potentially bad keyword in body (158): seo certification? by Joker on askubuntu.com
Notice. teward/Osiris: Last 2 connection(s) to metasmoke succeeded. Setting metasmoke status to up.
[ SmokeDetector | MS ] Bad keyword with email in body, blacklisted website in body, potentially bad ip for hostname in body, potentially bad keyword in body, blacklisted user (229): seo certification? by Joker on askubuntu.com
[ SmokeDetector | MS ] Url in title, body starts with title and ends in url, link at beginning of body, potentially problematic ns configuration in body, potentially problematic ns configuration in title, +1 more (337): www.openstudy.co.in/ by Open Study Centre on webapps.SE
@tripleee That pattern looks like it's already caught by Blacklisted website in body and Blacklisted website in answer; append -force if you really want to do that.
@Makyen thank you! I created a metasmoke account and it now says I need to ping an admin to request manual activation. Do you know where I can find a list of admins?
@Kulfy I am aware of 8 admins. Currently in this room: tripleee, Makyen, Undo, ArtOfCode, Thomas Ward. Not currently in this room: Andy, angussidney, thesecretmaster.
[ SmokeDetector | MS ] Url-only title, bad ip for hostname in title, bad keyword in title, blacklisted website in title, potentially bad ns for domain in title (398): ketoavis.com/keto-fab/ by nmbopghmqwdg on askubuntu.com
You may also want to look at the userscripts we have available (GitHub), as they can be quite helpful, depending on how you want to participate, or not. For viewing, feedback & flagging in chat, I find FIRE and AIM to be the ones I use the most.
@avazula np. I'm happy to help. As a moderator, you are automatically given SmokeDetector privileges, and can run the "privileged" commands (e.g. for giving feedback, reporting posts, etc).
@Makyen I don't know if this is an issue you're aware of but when I try to get a Charcoal email, after logging in with Stack Exchange it gives me a 400 Bad Request
@avazula My initial guess at the issue is that getting an email address requires you to at least begin the process of signing up for autoflagging (your flags are not used on any site you're a moderator on). However, it shouldn't require for autoflagging to be actually enabled. It probably needs to be set up to the point of being able to flag through the userscripts (i.e. FIRE, but not have autoflagging enabled, unless you want that too; some people want it; some aren't comfortable with it).
What's needed to have the userscripts able to raise flags when you tell them to is:
your metasmoke account needs to be write authenticated with SE, which, if you haven't already done so, can be done from the authentication page and doesn't require you to also sign up for autoflagging, although authenticating is also a required step for signing up for autoflagging.
In addition, to enable manual flagging, the checkbox that says "Use my account to cast flags automatically" on this page also needs to be checked. If you have no entries in the "ID Site Count Flags Used Today" list at the bottom of that page, then autoflagging will still not be enabled, but manual flagging through the userscripts will be enabled.
If you completely don't want metasmoke to hold a token allowing the scripts to raise flags, then you can de-activate the token through your Stack Exchange preferences.
Again, I'm guessing as to the problem. I'll now try to duplicate the issue on a test account.
@ArtOfCode @Undo It looks like there's a problem with MS users authenticating with SE. avazula reported a problem here of getting a "400 Bad Request" after logging in with Stack Exchange.
I partially attempted to duplicate the problem with one of my test accounts, Maktest2. I revoked the token from SE's side, then tried to re-authenticate with SE from this Authentication page. The first time through the process (i.e. clicking the "Authenticate with Write Access" button ), I got routed to SE, as expected.
However, when attempting to get back to MS, after approving the auth, with what appears to be a valid token, I got an "Internal Server Error" from the address knox.metasmoke.erwaysoftware.com/auth/complete with what appeared to be valid code and state query parameters.
I tried the process again (i.e. navigating back and clicking the big red button), without invalidating the newly created token, it skipped the step of going to MS for auth and I ended up on MS with the process apparently complete.
At no point did I see the "Bad Request" response, but for that, it may be necessary to start the account from scratch, which I did not yet try.
[ SmokeDetector | MS ] Bad ip for hostname in answer, bad keyword in answer, blacklisted website in answer, link at beginning of answer, potentially bad ns for domain in answer, +1 more (312): Minimum pumping length of (01)* by komakara on cs.SE
@Daniil because it has been proven useful; the persistent spammers we see register new domains every week if not every day, but they have a more limited number of IP addresses
there has also been several incidents where some IP addresses seem to be devoted by hosting companies to, shall we say, customers of uncertain standing, which means if we watch the first one all the others will be blocked when they come here
but it's a scattershot approach at the moment, it should be more systematic, and probably completely automatic instead of manually updated
@Daniil I welcome any volunteers but for the time being it requires a PR for each edit which is cumbersome ... if you want to suggest changes to the pending PR to expose this functionality to chat that might be useful, but I hope to be able to take a look at it one of these days
user435118
@tripleee Ah yes, forgot that it would require a PR for every commit. I'll probably wait till the chat watch ip is implemented
