« first day (2601 days earlier)      last day (1514 days later) » 

08:00
@Mast I don't know how to do that actually...
[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): How to prove (A v B), (A → C), (B → D) therefore (C v D) ✏️ by Roman Martinuk on philosophy.SE
@Yatin Have you taken a look at the current watchlist, at the hundred or so most recently added?
No
Please do.
@Yatin Isn't it SK(\s*)Trainings better?
08:01
@Mast Ok
It has 2 tp
It looks like we're only interested in the exact username here, so the watch would look even different than that.
@CodyGray Post 1: This does not look like spam
@CodyGray No such command 'scan-a'.
> Would not be caught as an answer.
08:02
!!/bisect Hugsangeloveden
@Mast Matched by sktrainings\.com on line 25514 of watched_keywords.txt
@CodyGray 'Hugsangeloveden' is not caught by a blacklist or watchlist item.
@SmokeDetector Affiliated with "Hugsangeloveden"; uses that name for his YouTube channel (youtube.com/playlist?list=PLQ0VVA6zSipc9hcLDK9W3uppv3mHX-UyX)
!!/watch Hugsangeloveden
@CodyGray You don't have blacklist manager privileges, but I've created PR#5423 for you.
08:03
PR#5423 ("Cody Gray: Watch Hugsangeloveden") opened by SmokeDetector
@CodyGray User blacklisted (49751 on philosophy.stackexchange.com).
tp- feedback received
!!/watch (?-i:^SK Trainings$)
08:06
fp feedback received
sdc watch SK[\W_]*+Trainings
!!/reject-force 5422 "Superseded"
@ppwater You don't have blacklist manager privileges, but I've created PR#5424 for you.
PR#5424 ("ppwater: Watch SK[\W_]*+Trainings") opened by SmokeDetector
08:06
@Mast Closed pull request #5422.
!!/reject 5424 "Will not catch anything that's not caught at the username already, which is explicitly watched already."
@Mast Closed pull request #5424.
Ah, thanks.
@CodyGray Looks like "Hugs angel love den" or something... google.com/…
08:08
@Yatin Yeah, it's the OP's (Sean Michael Collins) online nickname.
Or tagline or whatever
Oh
It's their mark that they leave all over the place, whenever they post some stupid crap.
Excellent thing to watch for :-)
Especially since it's so unique (at least without the whitespace)
🤔
sdc bisect wispurechoseden
@Yatin 'wispurechoseden' is not caught by a blacklist or watchlist item.
@SmokeDetector @ppwater did you flag it?
08:13
@rene If you're looking at it for userscripts, there's really no way to completely handle backoff as required by the SE API, unless you're only running a single userscript, in a single tab, in a single browser profile, in a single browser, on a single machine, on your external IP address.
Basically, given the SE API's requirement that backoff be honored per endpoint for every use on the IP address, to completely comply would require coordination between everything accessing the SE API from that IP address. It should be possible for something like MS (complicated by multi-threading/processing), but for a userscript it's effectively impossible.
That doesn't mean a userscript can't do a very good job, just that it's likely to encounter problems from time to time. How many issues there are will depend largely on the combination of things which are being run: what the user is doing (e.g. how many tabs are open and what's happening in the tabs); which userscripts are being used; etc.
@Yatin Huh? I marked it as TP
ok
first case of afflication
seems rene flagged it
does this make any sense btw? philosophy.stackexchange.com/a/78315/49451
The image had "wispurechoseden"
08:15
[ SmokeDetector | MS ] Blacklisted user (71): Is 1+1=2 true by definition ? by Sean Michael Collins on philosophy.SE
tpu- feedback received
It's promotional for their Twitter account and ... apparently some crackpot world view.
rude flag? or just tpu-?
I rude flagged.
08:16
@Yatin R/A could work.
naa- feedback received
Spam would also be fine. It's clearly promotional.
Ok
[ SmokeDetector | MS ] Luncheon meat detected (41): hashcat brute force print passwords tried by Sudo-su-cm on stackoverflow.com
Incidentally, I was a moderator on Philosophy.SE back in the very olden days :-)
08:17
fp feedback received
@CodyGray :O
@Makyen fair enough, only trying to add data-points.
[ SmokeDetector | MS ] Bad keyword in body (95): Domin XT Pills are the most by CassanSchus on apple.SE
[ SmokeDetector | MS ] Potentially bad asn for hostname in body (1): is the backlink is the most important aspect in the SEO? by Alaa on webmasters.SE
tpu- feedback received on [MS] Domin XT Pills are the most
fp- feedback received
@ppwater 'https://sites.google.com/view/domin-xt-order/' is not caught by a blacklist or watchlist item.
!!/watch- domin[\W_]*+xt(?:[\W_]*+(?:pill|order|official|\d++|[\da-f]{5,}+)s?)*
sdc bisect sites.google.com/view/domin-xt-official
@ppwater Matched by domin[\W_]*+xt(?:[\W_]*+(?:pill|order|official|\d++|[\da-f]{5,}+)s?)* on line 25984 of watched_keywords.txt
[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): Preparing for a Machine Learning Design Interview by Cuca on datascience.SE
08:36
And don't forget Data Science Stack Exchange. In this blog... seriously? You call DataScience.se a blog?
@rene I appreciate the data-point. I should have said that first. I may have gotten a bit long-winded in my reply., due to how the SE API handles backoff being an ongoing/repeating frustration for me. While I understand why it's designed the way it is, I just find it frustrating that for a large segment of the SE API's expected use, it's not possible to comply with it.
I just wish they'd relax the restrictions for registered users, and especially moderators. I am always running into API or IP-related blocks. Very irritating.
I am volunteering my time to help improve your site. Why won't you help me?
Or at least not actively work against me!
iBug/Lily: Executing automatic scheduled reboot.
@CodyGray Yeah, it would be nice if all of those were at least loosened a bit. My impression has been that some of the rate limit restrictions are loosened a bit for moderators, but definitely not the overall ones which result in hard blocks.
sdc bisect beveragecraft.com
@ppwater 'beveragecraft.com' is not caught by a blacklist or watchlist item.
[ SmokeDetector | MS ] Manually reported answer (94): Getting error in sending email from Website hosted on Godaddy by Somnath Thakur on stackoverflow.com
I haven't noticed anything being relaxed. If anything, I run into them more now. But maybe that's just a behavior change.
08:45
@Makyen thanks, that makes sense. Unfortunately, I lack the skills to be of any meaningful help here.
@CodyGray Given how long you've been a moderator, I'm not surprised that you wouldn't notice most of them. The ones I'm thinking of are relatively minor. I've only noticed them due to the close contrast between not being a moderator and being a moderator. It's not huge, but it at least feels like it's there. Most of it is lessening restrictions on often/rapidly it's possible to access SE-private endpoints.
sdc bisect greatlivings.com
@ppwater 'greatlivings.com' is not caught by a blacklist or watchlist item.
08:53
sdc watch- greatlivings\.com
PR#5425 ("ppwater: Watch greatlivings\.com") opened by SmokeDetector
!!/watch moduleszone\.com
!!/approve 5425
!!approve 5423
@ppwater User blacklisted (414661 on ru.stackoverflow.com).
[ SmokeDetector | MS ] Potentially bad keyword in body (1): What are songs similar to Ami Itabashi's "Teyandee Special Express"? by Etcetera on musicfans.SE
@SmokeDetector why
08:59
@ppwater Potentially bad keyword in body - Position 0-36: <p><a href="https://www.youtube.com/
sdc watch bkinds\.in
@ppwater You don't have blacklist manager privileges, but I've created PR#5426 for you.
sdc bisect aescripts.com
09:07
@ppwater Matched by aescripts\.com on line 23773 of watched_keywords.txt
sdc bisect spam404.com
@ppwater 'spam404.com' is not caught by a blacklist or watchlist item.
@Makyen While talking about userscripts, would it be an idea to add a section for bookmarklets to the repo?
!!/approve 5426
!!/approve 5423
sdc bisect dreamworkphotography.com
@ppwater 'dreamworkphotography.com' is not caught by a blacklist or watchlist item.
09:27
sdc watch- dreamworkphotography\.com
PR#5427 ("ppwater: Watch dreamworkphotography\.com") opened by SmokeDetector
[ SmokeDetector | MS ] Potentially bad keyword in body (1): could not create decoder object (python3 + Django) by niuniuwang on stackoverflow.com
fp- feedback received
!!/approve 5427
[ SmokeDetector | MS ] Potentially bad ip for hostname in answer, potentially bad ns for domain in answer (2): How to anchor a raft on a river by Tony Zhang on outdoors.SE
naa- feedback received
tpu- feedback received
!!/watch amarine\.store
@CodyGray ^ good example of DNS-based rules providing a good alert
fp- feedback received
[ SmokeDetector | MS ] Potentially bad ip for hostname in answer, potentially bad ns for domain in answer, potentially bad keyword in answer, blacklisted user (74): Sleeping in an inflatable boat by Tony Zhang on outdoors.SE
tpu- feedback received
@ppwater Matched by amarine\.store on line 25990 of watched_keywords.txt
09:39
Oh, tripleee just watched it
I'll revenge by calling you pppwater
@tripleee Lol
@tripleee Hmm. That is weird to me. Why did it need to an IP or NS lookup? How did that tell it anything?
What's "suspicious" about that IP address?
09:53
fp feedback received
[ SmokeDetector | MS ] Potentially bad keyword in answer (1): What is Akito's Geass? by Rolivey on anime.SE (@AndrewT.)
[ SmokeDetector | MS ] Pattern-matching website in answer, potentially bad keyword in answer (79): Meizu Pro 5 Ubuntu Edition by mobile mall techno on askubuntu.com
@CodyGray See findspam.py line 1149 and down.
I can't really make much sense of that.
I guess the answer is that there's a blacklist of suspicious IPs and NSs?
@CodyGray Where 'blacklist' is a dynamic list based on resolved DNS's, kind-of.
IIUC.
10:04
That's even weirder.
See line 1032.
We have a blacklist of domains, those are automatically transformed to their DNS names, and then when content is scanned, we transform the domains to their DNS names and match them against the list?
Seems absurdly complicated.
All to... what? Catch the case where someone registers a new domain name redirecting to the same IP/NS?
IIUC, yes.
And nameservers used by blocks of spammers.
tpu- feedback received
fp- feedback received on [MS] What is Akito's Geass?
[ SmokeDetector | MS ] Potentially bad keyword in body (1): How to replace Trigorilla mainboard with MKS Gen L 1.0 by Davinho on 3dprinting.SE
[ SmokeDetector | MS ] Potentially bad keyword in answer (1): ADX Connection on Landing page by Anchal Gupta on stackoverflow.com
@CodyGray certain spammers like to rotate their product names and domains rather fast to defy traditional domain blacklists. I don't suppose they have that many IP blocks.
tpu- feedback received
tpu- feedback received
[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): Quran Surah Baqarah verse 111 interpretation by Hafeez7868 on islam.SE
10:36
naa- feedback received
@SmokeDetector NAA at least, possibly spam.
@Mast Recorded answer as an NAA in metasmoke.
Yes yes, I already did that...
I'll put a . in front of it next time just to shut you up.
[ SmokeDetector | MS ] Bad keyword in link text in body, potentially bad keyword in body (70): Co-working Space In Dubai by Liza James on ell.SE
tpu- feedback received
10:52
sdc bisect exponenta-bc.com
@ppwater Matched by exponenta-bc\.com on line 25185 of watched_keywords.txt
@CodyGray we did not know anything about this particular domain name but its IP address and NS configuration are watched because of previous spam involving them
[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): Free dividend data API for non-US stocks by Robbie Q on quant.SE
the IP address is myshopify.com, it's not inherently spammy but a lot of the hits we get are actually spam
11:06
[ SmokeDetector | MS ] Potentially bad keyword in answer (1): What is Akito's Geass? by Rolivey on anime.SE (@AndrewT.)
sdc bisect to my blog ishttps://binaryniche.blogspot
@RyanM Matched by \w+https?://(?=(?:[^<]|<(?!/)){0,100}$) on line 14840 of watched_keywords.txt
heh
11:20
[ SmokeDetector | MS ] Manually reported answer (94): 4.2.2 update error on Samsung Galaxy s2 plus GT - I9105P by Firmware File on android.SE (@AndrewT.)
@SmokeDetector tpu- linked in profile
!!/watch firmwareflashfiles\.com
Spammers respect nothing. Even New Year.
@VictorVosMottor Celebrate the new year by relaxing with some Keanu Reeves keto CBD oil!
11:33
Makyen/EC2-num02: Executing automatic scheduled reboot.
[ SmokeDetector ] SmokeDetector started at rev 63b113a (Makyen: This is the MS instance, so needs to post feedback) (running on Makyen/EC2-num02, Python 3.6.12)
teward/Osiris: Executing automatic scheduled reboot.
[ SmokeDetector ] SmokeDetector started at rev 1dedb47 (SmokeDetector: Auto watch of firmwareflashfiles\.com by Ryan M) (running on teward/Osiris, Python 3.6.9)
Restart: API quota is 17134.
Makyen/EC2-linux: Executing automatic scheduled reboot.
12:06
[ SmokeDetector | MS ] Mostly punctuation marks in body (27): unsupported operand type(s) for +: 'int' and 'list' by Kabdolla Meirambek on ru.stackoverflow.com
fp- feedback received
[ SmokeDetector | MS ] Link at end of answer (61): dd on entire disk, but do not want empty portion by Doe on serverfault.com
@Yatin I earned the Deputy badge for 83 useful falgs - thanks for spammers at all ;D
fp- feedback received
12:13
!!/watch betavare\.com
fp- feedback received
no wait, changing my verdict on those based on the number of identical posts
!!/watch partclone\.org
all still up
12:35
The partclone link is being spam-posted, but I don't see it as spam, myself. It appears to be a free tool that solves the questions it's posted at.
[ SmokeDetector | MS ] Potentially bad keyword in body (1): Removing Tap cartridge help! by Michaela Drake on diy.SE
No obvious link from their U&L profile to that project.
[ SmokeDetector | MS ] Url in title, bad keyword in body, bad keyword in title, potentially bad keyword in body, potentially bad keyword in title (290): sites.google.com/view/dominxt-officials/ by CharlMurdock on apple.SE
fp feedback received on [MS] Removing Tap cartridge help!
tp feedback received
[ SmokeDetector | MS ] Bad ns for domain in body (97): Getting problem in Dating Theme while editing page by Chittranjan K on stackoverflow.com
12:44
fp- feedback received
[ SmokeDetector | MS ] Toxic answer detected (80): Which one is it? "Damn" or "damned"? by JustMe on english.SE
fp feedback received
fp- feedback received
[ SmokeDetector | MS ] Potentially bad keyword in body (1): Why storing bitcoin in paper wallet is complex for me? by javac on bitcoin.SE
13:01
@SmokeDetector Why
@ppwater Potentially bad keyword in body - Position 136-210: a>.</p><p>So, I have the private key and public key.</p><p>I want to buy
fp- feedback received
[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): How trademarks offer legal protection by DennisWhite on law.SE
tpu- feedback received
sdc bisect sites.google.com/view/dominxt-officials/
13:14
Matched by the following regexes:
dominxt(?:[\W_]*+(?:muscle|building|review|buy|\d++|[\da-f]{5,}+)s?)* on line 2405 of bad_keywords.txt
domin[\W_]*+xt(?:[\W_]*+(?:pill|order|official|\d++|[\da-f]{5,}+)s?)* on line 25984 of watched_keywords.txt
[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): The line bar is quite slow. I want to speed it up by Muhammad Ahmad on codereview.SE
fp- feedback received
sdc bisect trademarkterminal.com
@ppwater 'trademarkterminal.com' is not caught by a blacklist or watchlist item.
sdc watch- trademarkterminal\.com
@ppwater The regex contains an unescaped "."; in most cases, it should be "\."; append -force if you really want to do that.
13:15
PR#5428 ("ppwater: Watch trademarkterminal\.com") opened by SmokeDetector
[ SmokeDetector | MS ] Url in title, potentially bad keyword in body, potentially bad keyword in title (97): tea-movie-guide-explore-the-movie-world.en.aptoide.com/?store_name=alltinomteknik&app_id=41071657 by allt inom teknik. on movies.SE
tpu- feedback received
@ppwater 'https://tea-movie-guide-explore-the-movie-world.en.aptoide.com' is not caught by a blacklist or watchlist item.
!!/approve 5428
tpu- feedback received
Hm. Trying to decide if the full russelaragbirphotography.netligy.com should be watched, or just netligy.com
No other hits on SE or MS for both.
Oddly, that user also posted this apparently legitimate answer.
I'm trying to figure out what gives.
13:31
Weird.
It wasn't even cleaned up by the edit.
I came here for an explanation. Don't disappoint! ;-)
@Spevacus I just went to netligy.com and I would definitely watch that instead of the full subdomain
Seriously, I'm wondering if that obvious spam answer was just a legitimate attempt to answer that trashcan fire of a question...
!!/watch netligy\.com
13:32
@RyanM OK, I'm watching...
Looks like it's installing spyware on my PC as we speak.
How long should I watch it?
*visually indicates that eyes are peeled*
fp- feedback received
Yeah there's a possibility that that wasn't spam and that user was actively trying to be helpful with that response.
Have you ever accidentally spammed? I mean, I haven't, and I don't imagine I ever would, but SO is weird, so it's not outside of the realm of possibility.
Okay, so I'm pretty sure that was a typo...
and they meant netlify
13:34
@Spevacus That got submitted as a comment to the prior SD report.
@CodyGray Hate it when it does that >_>
I didn't know that was a feature.
Seems like a misfeature if I ever heard of one.
buuuuuutttt (pure speculation) I somehow doubt their photography page is doing $1k/month of traffic.
I wonder what kind of inane nonsense that I've inadvertently submitted as comments to MS..
so...I'm leaning spam
13:35
You can reply-hook the report and it'll add a comment for you. That it randomly grabs messages from chatrooms seems like a bit of an... anti-feature
Weirdly, I don't see any evidence that that account belongs to Russell Ragbir.
No PII matches.
@Spevacus Yes. That's what I meant.
I cleared their sessions. Only 1 session cleared. So, no evidence of the account being compromised.
[ SmokeDetector | MS ] Link at end of body (99): Can't install windows on new laptop by Doron Shemla on superuser.com
fp- feedback received
@CodyGray I wouldn't be worried about your inane comments on MS ....
@rene Which ones would you worry about?
13:38
[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): Using OpenSSL v1.1.1 in a Qt-project for Windows by stormbirds on stackoverflow.com
fp feedback received
@CodyGray the ones we leave on MSE fun posts?
The parrot cleans those up...
That is true
the...parrot? oh right. took me a moment.
13:41
I don't have to be good there; I don't have a diamond there. (Isn't that how it works?)
fp feedback received on [MS] cat shit removal
You just have to be not bad. :)
Scared to click that one, but I wonder what it is.
13:45
fp feedback received
@Spevacus I think not that harmful. Opening from url2png gives an pdf starting page.
fp- feedback received
[ SmokeDetector | MS ] Few unique characters in body (94): Geometric problem triangles ✏️ by Maruchis on math.SE
14:02
sd v
@SmokeDetector v
14:17
[ SmokeDetector | MS ] Potentially bad ip for hostname in answer, potentially bad ns for domain in answer (2): RPI4 won't boot with powered USB hub by HikerLT on raspberrypi.SE
fp- feedback received
14:33
[ SmokeDetector | MS ] Potentially bad keyword in body (1): PointPay - A melhor empresa de criptomoedas de 2021 by Davi Koefender on bitcoin.SE
tpu- feedback received
!!/watch pointpay\.io
tpu- feedback received
iBug/Lily: Executing automatic scheduled reboot.
[ SmokeDetector | MS ] Bad keyword in body, blacklisted website in body, potentially bad keyword in body, potentially bad keyword in title (196): Where To Buy BP Zone And Cost? by zonesfi on askubuntu.com
[ SmokeDetector | MS ] Potentially bad keyword in body (1): Como eu faço para gerar aleatoriamente um nome ao clickar no botão? by user218029 on pt.stackoverflow.com
fp- feedback received

« first day (2601 days earlier)      last day (1514 days later) »