@RyanM Regarding the last SD report, the answer was originally NAA, and was then vandalized. I would think tp would take precedence, as the edit itself is something that we would want to block at the system level, but I'm not sure.
@cigien Yeah, that's...a good question. I went NAA based on the history, since nothing of value was lost. That is, I'm not sure that edit is worth reverting, since it should just be deleted as NAA either way. TP is certainly reasonable too.
@Nick That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
[ SmokeDetector | MS ] Bad keyword in link text in body, blacklisted username, blacklisted website in body, potentially bad ip for hostname in body, potentially bad ns for domain in body, +1 more (261): Debuts In-Game Today For NBA2K21's 2KDay by Dingbest on english.SE
[ SmokeDetector | MS ] Pattern-matching website in answer, potentially bad ip for hostname in answer, potentially bad keyword in answer, blacklisted user (150): Can sucralose form a syrup? ✏️ by Joe Jonson on chemistry.SE
@lyxal That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@lyxal a reasonable guess, but take a closer look: that domain has appeared in spam previously (which is linked from the MS report), and these sort of "thanks for this helpful post, here's a link to something else that's sort of related" are a really common spam pattern. Both that general pattern and the fact that it's shown up in spam in the past (also hinted at by the domain being a "potentially bad keyword in answer") are strong hints that a post might be spam.
@lyxal also for the watch you'd want to omit the / at the end, for two reasons: 1) we'd want to catch it even if there's no slash, and 2) the watches are tested with \b added at the start and end, so it wouldn't match, say, https://example.com/" because there's no word boundary
the \b is added to prevent accidentally matching things in the middle of words when that wasn't intended, though it can occasionally be a pain when trying to write especially clever regexes.
(this isn't true of the website blacklist, which is probably a bad thing but would be a bunch of effort to fix)
@SmokeDetector Custom flagged: Spam: This domain has a history of being spammed across the SE network, including under this username. This is very unlikely to be a genuine recommendation and quite likely to be spam.
@tripleee That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@SmokeDetector tpu- Custom flagged: This username is a known spammer who posts spam about power equipment (note the title). Post content is plagiarized from here.
@Nick That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
@metasmoke @Glorfindel do your moderator eagle eyes see something I can't for why that's spam? From my perspective, it does answer the question, albeit poorly.
@Spevacus yeah, I wasn't certain about it, there were a string of spam messages on the weekend linking to it but then when I looked into it further I did see it seemed basically to be an equivalent of google drive. So I guess it's going to be post specific...
