[ SmokeDetector | MS ] Few unique characters in body, no whitespace in body, no whitespace in title, repeating characters in body, repeating characters in title (393): xxxxxxxxxxxxxxxxxxxxxxxxxxxxx ✏️ by Cohen Elior on salesforce.SE
Regex search returns (presumably) the proper results, i.e. nothing. Anyway, they just spammed Codidact (outdoors.codidact.com/posts/284798), if y'all decide that's reason enough to watch it (I haven't been active enough recently to make that call).
I mean, I went "20 results and not detected? I'll just blacklist it immediately" and then decided to actually verify first. Wasn't anticipating the change in functionality.
[ SmokeDetector | MS ] Bad ip for hostname in body, bad keyword in link text in body, blacklisted website in body, potentially bad ns for domain in body, potentially bad keyword in username (270): Does reactjs have future? by swarali on askubuntu.com
Yes, it does seem to be completely erratic. Some of those posts in Mithical's linked query can be explained by a total failure to handle CJK characters properly, but others of them don't seem to have any apparent explanation.
@CodyGray That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer Append -force to the command if you really want to add this pattern.
Yes, I'm aware. Your point? It doesn't seem to result in any false positives, and if they're engaging in a spam campaign, I'd like to block it, regardless of how large they are.
If nothing else, just to keep the size of the watchlist more manageable by trimming obsolete entries in a way that doesn't require extreme amounts of manual effort.
[ SmokeDetector | MS ] Bad ip for hostname in body, blacklisted website in body, potentially bad ns for domain in body, potentially bad keyword in body, potentially bad keyword in title (202): Hire WordPress Developer by purav jha on meta.mathoverflow.net
[ SmokeDetector | MS ] Bad ip for hostname in body, blacklisted website in body, potentially bad ns for domain in body, potentially bad keyword in body, potentially bad keyword in title, +1 more (273): hire React JS developer by purav jha on meta.mathoverflow.net
[ SmokeDetector | MS ] Bad ns for domain in body, bad keyword in body, bad keyword in title, link at beginning of body, potentially bad asn for hostname in body, +1 more (332): What is ij.start.cannon? by Monica Geller on stackoverflow.com
@MartinSleziak It's something tripleee brought up recently. To my knowledge, we used to fully scan all meta sites the same way we scanned main sites (with some adjustments to prevent too much api quota drain) - but now we're... Not sure, I guess.
NS orangewebsite.com. is blacklisted, but there are a couple of FPs. Maybe we would want to move the domain back to watched and only blacklist ns5+ns6 (and possibly ns7+ns8, ns11+ns12, and ns15+ns16)
Yeah, it seems to be even a plausible answer, so it's not even naa, and we don't want to be blocking content just for that last sentence. (The post was deleted as spam, and the user nuked, but that was a site mod decision, and seeing the mod who (likely) handled it, I'm not surprised.)
