@Nick Yeah if there's a trend, they typically have a trailing unique ID that we can watch. For the most recent TP of that domain, the trailing lbzMzL31Pf31Rw could be watched through an expression along the lines of (?-i:lbzMzL31Pf31Rw)(?#yadi.sk) . Though this is only really useful if the same file ID is going to be spammed multiple times.
@Mast That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
@cigien *sigh* Yes, there was. I was trying to do some bootleg "Watch them all quickly so as to keep the transcript somewhat clean" thing and had them all on one line instead of opening notepad and dropping the individual commands on newlines and copy-pasting those or something less asinine. I should write something that makes multi-watches-at-once much more efficient (though I think Makyen has a script that does this, or something along those lines?)
Doesn't mean I shouldn't have double-checked those watches considering I was using something bootleg like that. Thanks for catching it.