@tripleee That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
Yeah if they're not going to use those numbers to spam then it's not generally needed to watch them as well. We sometimes wander into blatantly spam profiles and grab domains/phone numbers, but that's typically about as far as we go.
The malware spam that the user "Mel" posts has changed its URL pattern for the malware which is not currently caught by our blacklisted website regex for it.
I've adapted the original regex to accept the new format and am interested in a second look from others to determine its effectiveness. Here's the regex proposal:
@VictorVosMottor That pattern looks like it's already caught by Bad keyword in body and Bad keyword in answer; append -force if you really want to do that.
@VictorVosMottor That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@VictorVosMottor Just as a note, make sure you're appending a ? at the end of those types non-capture groups, because we want them to be optional (i.e. - Only match one or zero times) The correct regex would be chubygreat(?:@gmail\.com)?
Hey there everybody. Hope everyone is doing fine. I was wondering if there is some sort of command or anything available to see stats on the Smoke detected, perhaps per Site? or the smoke redirected to a site's smoke chat room? As to be able to gauge and understand the spam cycles and behavior
or if someone can point me to the corresponding doc or info, I'll appreciate it :)
@DarkCygnus alternatively you could query: metasmoke.erwaysoftware.com/data/sql but I'm not intimate enough with the schema to know if that has the data you need. For example I don't know if it has chatrooms SD posts to.
@Federico I checked (and re-checked a fair few times) that this wouldn't interfere with anything posted on the site and I came up blank (0 matches), and this regex only catches posts by Mel in MS. The IDs seem to be changing, so I've opted for something slightly more flexible.
This will also help with stacking some additional weight (back up to what it once was) which helps with autoflags and what have you.
I'm definitely going to be monitoring this so that no FPs pop up that are unwarranted, though. I'm no regex wizard, so I've got slightly less confidence that it's as foolproof as something created by Makyen for example could create, but if it causes problems I'm definitely going to remove it (or another blacklister can if I'm not around.)
Sorry, just noticed this might not be clear: When I say "wouldn't intefere with anything posted on the site" what I meant to say was "Anything currently on SE" and I confirmed this through (quite a lot of) SE searches.
@Makyen I found a fair few of the ones listed in those searches, and it seems that immediately following /view/ is the name of the Google user/company name/etc. In this case, the spammer seems to be using a series of numbers that varies from post to post. In this instance, catching all numbers in between /view and /file appears to work.
I'm going to continue going through these to ensure there aren't any hits that do the same thing, but I don't imagine anyone that's not a bot would set their account name to an arbitrary series of numbers.
@Makyen That pattern looks like it's already caught by Blacklisted website in answer and Blacklisted website in body; append -force if you really want to do that.
@Makyen That pattern looks like it's already caught by Blacklisted website in answer and Blacklisted website in body; append -force if you really want to do that.
@metasmoke Starting to get to the realm where I'd actually like you, @Makyen (or another similarly-proficient regex guru) to take a look and find an amenable blacklisted website regex here. I was going to modify the one I submitted not long ago to sites\.google\.com\/view\/\d++\/(?:file|home)\/drive\/storage\/(?:share|files)\/download but I'm not sure how sustainable that'll be in the future if this is going to continue.
