[ SmokeDetector | MS ] Few unique characters in body, no whitespace in body, no whitespace in title, potentially bad keyword in body, potentially bad keyword in title, +2 more (397): lllllllllllllllllllllllllllllllllllll ✏️ by Gonza on japanese.SE
@Makyen I'm not sure, but I suspect it's related to this message. I'm curious as well. pizzahutcouponcode.com is caught by the blacklisted domain couponcode.com. Should the pizzahut domain be watched anyway?
Is anyone else having issues with MS reports not loading? FIRE is not working for me either, I get the popup saying "report could not be loaded". It was fine half an hour ago.
@cigien That's going to depend both on what the intent was behind the blacklist of CouponCode\.com and what its effect is and has been. In general, I'd do some investigation to try to determine if there in any indication if the intent in blacklisting was only to catch that specific domain, or if it was the intent to catch more than just that domain. I'd also search on MS to see what the blacklist really is catching.
Then it would be a good idea to adjust everything such that what is intended to be caught is caught; what we want to be caught is caught; and that it doesn't catch things we're not intending to be caught.
@cigien I'm not experiencing any problems along those lines at the moment. It's possible that MS was occupied with something else at the time you were attempting to interact with FIRE. If MS gets busy, it can sometimes cause intermittent issues with using FIRE. In the past, the things that have tended to be the culprits has been MS running backups and/or someone (or more than one person) running multiple regex searches.
That's one of the reasons we generally ask people not to run multiple concurrent regex searches. Personally, I don't run more than two at the same time (i.e. I wait for at least one to complete prior to starting a new one; just closing the tab without completion doesn't count).
@Makyen It does happen intermittently, but it usually goes away, as Yatin points out. However, it's been 20 minutes now since I've been able to load a report, which is considerably longer than I've experienced before. This suggests that there's something wrong on my end, but I can't figure out what that might be; I can't correlate it with anything else I was doing at the time. I'll wait a bit longer, and if it still persists, I'll try to provide some details that might be relevant.
@Makyen Oh, I had no idea. I haven't actually been running multiple concurrent regex searches, but I didn't know that we were advised not to. I'll keep that in mind, thanks.
@Makyen I've tried reloading, and that hasn't helped. I'm afraid I'm quite clueless about what to look for in the console. The Web Console says "The connection to wss://metasmoke.erwaysoftware.com/cable was interrupted while the page was loading.", "Firefox can’t establish a connection to the server at wss://metasmoke.erwaysoftware.com/cable." The Browser Console is saying something about an "NS_ERROR_FAILURE" Exception. Should I try restarting the browser?
@Makyen Yes, me too. I was starting to get annoyed that it wasn't working, and especially because I couldn't figure out why.
I still don't know what went wrong of course, so that's not great. Still, I know what to try next time this happens. Thanks for the help (both you and @Mast).
@cigien np. I'm glad we were able to help. The "NS_ERROR_FAILURE" implies something at the browser level or something beyond that (e.g. networking). That restarting the browser was sufficient implies it was as the browser level. For me, it tends to be that my antivirus gets into a mode where it just starts taking up a complete CPU core worth of processing, which makes everything slow. Other than rebooting, I have not figured out another solution (I should try another antivirus project).
I did try killing off a couple thousand browser tabs, but that really hasn't helped all that much; some, but not a lot.
@Mast Not really. I prefer to have an anti-virus active, even though I am quite careful about activities which might be risky. Getting more cores really wouldn't help with this particular issue. It's not that I run out of cores, it's that something in the antivirus is single threaded, which means it, at least for this issue, doesn't use other available cores, even though they are available.
There's also a secondary issue with the Firefox browser's background process (one process of N processes), which tends to get to the point where it starts taking up a larger and larger baseline of usage. This one does go away with just restarting the browser.
@Makyen That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@CodyGray Without having looked at it in detail, I'd expect it broke the text on characters which are invalid in a domain name, and _ isn't valid in a domain. Specifically, the initial pass at separation into domains is that it matches the URL_REGEX, which is here.
@AndrewT. It really doesn't read that way to me. Are you basing this on some additional information that you have as a moderator on the site? Based just on the contents of the answer, I don't think NAA feedback is appropriate.
@cigien I do know the PII, but that didn't affect my judgement. I read the post purely as "I have important documents. How do I store/encrypt them safely to be used on my (Android) device since there's no passcode for decryption, and if anyone has the password, they can read the documents?"
This is more of a usual paranoid poster we've gotten on Android.SE ...
@Makyen That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@AndrewT. That's very interesting. I was unaware of this pattern. Go ahead, and leave NAA feedback then. Could you leave a comment on the MS report indicating that this is something to be looked out for on this site?
A recent spam domain shares IP addresses with a bunch of spam domains that were never watched, for whatever reason. One is only a year old, but others are several years old. Should we be watching those domains as well?
^ I'm splitting these up, since it never seems to have been the intent for couponcode\.com to catch all domains with this as a suffix (though it seems no FP were generated as a result anyway). In particular, putting bookending this avoids blacklisting verifiedcouponcode\.com which seems unrelated to the other spam.
Darn. Note to self: write message, proofread, then post.
