Charcoal HQ

metasmoke

16:02

Makyen/MS-Relay: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started at rev 6b79b1731 (Makyen: Ping Makyen for some new metasmoke users) (running on Makyen/MS-Relay, Python 3.11.0)

SmokeDetector

[ SmokeDetector | MS ] Bad ip for hostname in answer, blacklisted website in answer (191): How to expose PP2P without router port-forwarding (with ngrok?)‭ by Felix Arushanyan‭ on superuser.com

[ SmokeDetector | MS ] Potentially bad keyword in answer (1): Hedera-sdk-py Smart Contract Deployment and Querying‭ by Greg Scullard‭ on stackoverflow.com

metasmoke

tpu- feedback received on [MS] How to expose PP2P without router port-forwarding (with ngrok?)‭

BeastOfCaerbannog

Hello people! Its been a while!

We're wondering in RotLD why Smokey misses some very obvious spam posts today. Do you have any info?

Spevacus

@BeastOfCaerbannog Howdy! Do you have a couple of example posts that Smokey missed that you'd like to have caught?

BeastOfCaerbannog

@Spevacus I'm fine, thanks!

Yes, they are also in the link to the room above.

-5

Q: AED 05O91O128O Healthy Call #Girls In Al Zahiyah Abu Dhabi By Neat Clean Abu Dhabi Call #Girls

AED 05O91O128O Healthy Call #Girls In Al Zahiyah Abu Dhabi By Neat Clean Abu Dhabi Call #Girls AED 05O91O128O Healthy Call #Girls In Al Zahiyah Abu Dhabi By Neat Clean Abu Dhabi Call #Girls AED 05O91O128O Healthy Call #Girls In Al Zahiyah Abu Dhabi By Neat Clean Abu Dhabi Call #Girls AED 05O91O12...

and

askubuntu.com/questions/1453320

Spevacus

16:13

!!/report askubuntu.com/q/1453310/1110188 askubuntu.com/questions/1453320

BeastOfCaerbannog

Could be more. I'm not the one that noticed the uncaught posts.

SmokeDetector

[ SmokeDetector | MS ] Manually reported question (batch report: post 1 out of 2) (93): AED 05O91O128O Healthy Call #Girls In Al Zahiyah Abu Dhabi By Neat Clean Abu Dhabi Call #Girls‭ by saniya kumari‭ on askubuntu.com

@Spevacus Post 2: Could not find data for this post in the API. It may already have been deleted.

Spevacus

@BeastOfCaerbannog Gotcha. Yes, they appear to be obfuscating the phone number they're using and it's possible our number deobfuscation isn't detecting it as an obfuscated number with which it should detect and report. For this, particular, spam we can add that particular number to our watchlist so we'll know if it gets posted again.

metasmoke

tpu- feedback received on [MS] AED 05O91O128O Healthy Call #Girls In Al Zahiyah Abu Dhabi By Neat Clean Abu Dhabi Call #Girls‭

Spevacus

!!/deobfuscate-number 05O91O128O

SmokeDetector

16:14

@Spevacus Deobfuscated: 0509101280; deobfuscated and normalized: 0509101280

Spevacus

!!/watch-number 0509101280

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev ca246d87c9 (SmokeDetector: Auto watch of 0509101280 normalized numbers: {'0509101280'} by Spevacus) (running on teward/Thoth)

BeastOfCaerbannog

@Spevacus Thanks for the explanation! :D

Spevacus

@BeastOfCaerbannog No problem! In the future, as a privileged user, if you do notice some spam that we haven't caught, do feel free to use !!/report <link> so we're aware of it and can make changes to our watchlists to catch future cases.

BeastOfCaerbannog

Ok!

!!/amiprivileged

SmokeDetector

16:18

@BeastOfCaerbannog ╳ You are not a privileged user. Please see the privileges wiki page for information on what privileges are and what is expected of privileged users.

BeastOfCaerbannog

@Spevacus I'm not priviledged it seems.

Spevacus

@BeastOfCaerbannog Huh. It says you have the Reviewer and flagger roles, so I assumed you were privileged. My bad!

Well, in that case, doing as you just did and letting us know about spam we missed is perfectly fine. Thanks a bunch!

BeastOfCaerbannog

Ok then! Since that works! ;)

And thanks again!

Spevacus

!!/report stackoverflow.com/a/75267251/11171084 "Undisclosed affiliation: Twitter link and website page link both link to jobslo.com, heavily suggesting affiliation."

SmokeDetector

[ SmokeDetector | MS ] Manually reported answer (94): A nested gridview example‭ by Ghulam Fizza‭ on stackoverflow.com

Spevacus

16:21

@SmokeDetector custom flagged

Makyen

@BeastOfCaerbannog We're happy to give you SmokeDetector privileges if you want them, but we won't force them upon you. In other words: would you like to have SmokeDetector privileges?

Spevacus

!!/watch jobslo\.com

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 18a7f9cebd (SmokeDetector: Auto watch of jobslo\.com by Spevacus) (running on teward/Thoth)

BeastOfCaerbannog

@Makyen Since I haven't yet read the full instructions for participating in the room, and since I'm not here very often, I think that it's better that I don't have those privileges, just to avoid any accidental use from my part. If in the future I will be able to spend more time here, I'll be sure to ask for them.

metasmoke

tpu- feedback received on [MS] A nested gridview example‭

Makyen

16:25

@BeastOfCaerbannog OK. Sounds good. Thanks for letting us know about the spam which SD missed.

Spevacus

Huh, I could've sworn I'd seen "obfuscated number in X" as a detection reason, but I must've been confusing it with "obfuscated word".

Pilot6

!!/amiprivileged

SmokeDetector

@Pilot6 ╳ You are not a privileged user. Please see the privileges wiki page for information on what privileges are and what is expected of privileged users.

BeastOfCaerbannog

A related question: The content of those messages is certainly very clear spam. Why is the phone number needed for detection?

Isn't the content enough?

Makyen

!!/report askubuntu.com/q/1453318

SmokeDetector

16:27

[ SmokeDetector | MS ] Potentially bad keyword in body, potentially bad keyword in title (2): Abu Dhabi Call #Girls 05O91O128O Call #Girls in Abu Dhabi‭ by Ritu Rajput‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Abu Dhabi Call #Girls 05O91O128O Call #Girls in Abu Dhabi‭

Mast

@BeastOfCaerbannog For a human, yes. We'd still consider it spam without the numbers. However, the bot needs something to trigger on.

Apparently this wasn't caught.

BeastOfCaerbannog

@Mast I thought that the multiple repeated words in close succession would be such a trigger.

Ryan M

call\W*girls might be worth considering as a watch...

Mast

@BeastOfCaerbannog We have some triggers that work on repetition, but not one in general, no.

Makyen

16:31

@RyanM Yes, looking into it.

Spevacus

in Charcoal Test, 1 min ago, by SmokeDetector

@Spevacus Matched by call\W?girls? on line 141 of bad_keywords.txt

I'm considering call[\W_]*+(?:\w*)?girls? but I'm not certain that's a good idea, searches are running now.

Mast

Repeated url at end of long post, Repeating characters in answer, Repeating characters in body, but nothing about repeated words in general.

Oh, nvm, we do.

Repeating words in answer

Repeating words in body

Makyen

@Spevacus (?:\w*)? is equivalent to \w*

Spevacus

Oh, right. * is 0 to infinity.

Mast

Apparently this post evaded Repeating words in body, I do not know why.

Probably only picks up more severe cases.

Ryan M

16:34

it's repeating words, not repeating phrases

Makyen

@Spevacus I'm not sure what you're trying to catch with the \w*. It doesn't have any additional matches in MS.

Spevacus

Repeating phrases could potentially be something to look into.

BeastOfCaerbannog

@RyanM Yup. My bad.

Mast

Could be computationally expensive.

@RyanM Yea, scrolling through the results it takes that quite literally.

Ryan M

less cheekily, this is the regex: github.com/Charcoal-SE/SmokeDetector/blob/master/…

Spevacus

16:36

@Makyen The posts we missed evaded the "call girl" watch because they added a # before the "girl" part, I was just trying to catch a potential symbol there. It only seems to add those two posts to its TP list and actually reduces the overall TP there.

SmokeDetector

[ SmokeDetector | MS ] Bad keyword with a link in answer (81): How to patch JS function that doesn't belong to a class‭ by Michael Brook‭ on stackoverflow.com

[ SmokeDetector | MS ] Potentially bad keyword in username (1): Bulk edit DataStage jobs?‭ by Emily White‭ on stackoverflow.com

Spevacus

Well, it also would catch metasmoke.erwaysoftware.com/post/411018 , but they also used "call girls" in the body. This would've caught the title.

metasmoke

tpu- feedback received on [MS] How to patch JS function that doesn't belong to a class‭

Makyen

@Spevacus For call[\W_]*+girls? I get 280 Total / 275 TP (98.21% TP) / 5 FP / 0 NAA. For call[\W_]*+\w*girls? I get 280 Total / 275 TP (98.21% TP) / 5 FP / 0 NAA

Spevacus

sigh (at self) - I didn't tick the "OR" box on the search for the adjusted regex, nor did I adjust for bookending.

I didn't use your fancy bookmarklet for a search because I'm not currently at my normal PC.

SmokeDetector

16:42

[ SmokeDetector | MS ] Mostly non-latin answer (51): Changed URL of a site, now Google won't index it‭ by seomoshak‭ on webmasters.SE

[ SmokeDetector | MS ] Link at end of answer, potentially bad keyword in answer (63): Why is the internal hard drive not available when attempting to install Ubuntu 18.04 or 19.10 from a USB drive?‭ by sunils23‭ on askubuntu.com

Spevacus

@Makyen Hm. So, interestingly, that expression seems to be (?s)call(?<=(?:^|\b)call)[\W_]*+\w*girls?(?:\b|$) which isn't the exact same as what's currently on the keyword blacklist, which is call\W?girls? (or, in your search form, equivalently (?s)call(?<=(?:^|\b)call)\W?girls?(?:\b|$) ) - The search for which actually doesn't have two of the reports we missed:

metasmoke.erwaysoftware.com/…

273 TP / 5 FP / 0 NAA

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): When should I use dropdown or sheets in mobile design?‭ by Blayne‭ on ux.SE

metasmoke

tpu- feedback received on [MS] Why is the internal hard drive not available when attempting to install Ubuntu 18.04 or 19.10 from a USB drive?‭

Spevacus

I'm wondering why \W? has that difference from [\W_]*+ in these results.

Jeff Schaller

!!/watch ivcvisa\.sg

SmokeDetector

16:50

[ SmokeDetector ] Blacklists reloaded at rev 96b41d9b28 (SmokeDetector: Auto watch of ivcvisa\.sg by Jeff Schaller) (running on teward/Thoth)

Spevacus

@Spevacus Sorry, I think I bungled that explanation as well. We currently use call\W?girls? which would be (?s)call(?<=(?:^|\b)call)\W?girls?(?:\b|$) which doesn't have two TP that call[\W_]*+girls? has, which is (?s)call(?<=(?:^|\b)call)[\W_]*+girls?(?:\b|$)

Makyen

@Spevacus At this point, I'm not sure what you're asking. I 6 recently reported "call girl" posts on AU which are all caught by call[\W_]*+girls?.

SmokeDetector

[ SmokeDetector | MS ] Mostly non-latin title (79): نکات طلایی سئو عنوان و تعداد کاراکتر انها‭ by seomoshak‭ on webmasters.SE

[ SmokeDetector | MS ] Potentially bad ip for hostname in body, potentially bad keyword in body (2): Is S23 Plus worth buying?‭ by Thế Giới Di Động‭ on meta.SE (@Ollie @Ethan)

[ SmokeDetector | MS ] Potentially bad asn for hostname in body (1): Bubble wall thickness - false vacuum decay. How can derive it in the thin wall limit?‭ by Jennifer Derleth‭ on physics.SE

Spevacus

@Makyen I apologize for being unclear. What I'm trying to say is that, currently on the keyword blacklist, we use the expression call\W?girls?, which is 273 TP:

metasmoke.erwaysoftware.com/…

This is different than the search you provided, which uses the expression call[\W_]*+girls?, which includes two reports that weren't caught by the existing blacklisted keyword (i.e. 275 TP):

m.erwaysoftware.com/…

sigh not like this, chat

!!/bisect call girls

SmokeDetector

@Spevacus Matched by call\W?girls? on line 141 of bad_keywords.txt

metasmoke

17:03

tp feedback received on [MS] Is S23 Plus worth buying?‭

Spevacus

What I'm asking is.... Why does [\W_]*+ provide that difference of two TP there?

The two reports that call\W?girls? is missing are metasmoke.erwaysoftware.com/post/411044 and metasmoke.erwaysoftware.com/post/411046 , both of which were manually reported.

the second one was one you reported, but was caught by the number watchlist item I recently added

Mast

The hashtag?

Spevacus

right

What I'm also saying is: We should probably change that keyword blacklist item from call\W?girls? to call[\W_]*+girls? as it seems to catch this specific kind of instance.

Mast

Which apparently should be caught for this watch, thanks to our obfuscating spammers.

Makyen

@Spevacus Because there's more than one \W between "call" and "girls".

The blacklist actually uses \W? in quite a few entries, mostly older. While some of those might be intentional, it was probably the go-to use for potential word separation when entered. It, however, doesn't account for a wide variety of potential text (e.g. just using two spaces). I'm considering changing all such entries which use that where it's followed by a word character to [\W_]*+, which is our current go-to word separator.

jmoerdyk

17:11

@Mayken are you able to activate a metasmoke account for me?

Spevacus

Oh, wow. there's 1153 instances of \W? in our keyword blacklist. The last of which was added back in 2021

@Makyen Thanks for following up. I... Dunno why I didn't just consider that # would be included in a \W. It matches any non-word character, which I sometimes fool myself into thinking is any whitespace character.

SmokeDetector

[ SmokeDetector | MS ] Link at beginning of body, pattern-matching website in body (136): Transformation-HealthCare‭ by linda Martin‭ on scifi.SE

metasmoke

tpu- feedback received on [MS] Transformation-HealthCare‭

Spevacus

!!/watch transformationhealthcare\.com

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev be51fc6979 (SmokeDetector: Auto watch of transformationhealthcare\.com by Spevacus) (running on teward/Thoth)

Makyen

17:18

@jmoerdyk Sure. I assume you mean yours. Done. I'm sorry it didn't happen shortly after you created it. I've changed things a bit, so new MS accounts with and associated existing SE account should be less likely to slip through the cracks like yours did.

Spevacus

@Makyen Is this something you were considering doing in the near term, or should I just make the change to this specific expression for now?

I recognize that your to-do list is an ever-expanding and nebulous thing, so I'm not trying to add any pressure to that, just asking for this specific scenario.

Makyen

@Spevacus Yes, I've edited the keyword blacklist file for that change. I'm considering if others are appropriate at this time.

Spevacus

Cool, thank ya :)

!!/approve 7536

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 465791b3bf (SmokeDetector: Merge pull request #7535 from Charcoal-SE/auto-blacklist-1675377763) (running on teward/Thoth)

[ SmokeDetector ] Blacklists reloaded at rev fe752810f5 (SmokeDetector: Merge pull request #7536 from Charcoal-SE/auto-blacklist-1675377930) (running on teward/Thoth)

jmoerdyk

@Makyen thanks. Not a problem, never nade it a priority when I joined the world of SOCVR and SOBotics as it was a bit overwhelming in the beginning

SmokeDetector

17:26

[ SmokeDetector | MS ] Potentially bad keyword in username (1): How can I center my GridLayout in the middle of the screen in Kivy?‭ by Zezo‭ on stackoverflow.com

jmoerdyk

@Mayken now how do I connect it to the AdvancedFlagging userscript?

Spevacus

@jmoerdyk In the footer of an SE site, click the Advanced Flagging configuration link. Click "clear metasmoke configuration". Then, reload the page and AF will walk you through this.

metasmoke

fp- feedback received on [MS] How can I center my GridLayout in the middle of the screen in Kivy?‭

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): Problemas para enviar enlace‭ by Santiago Barreiro‭ on es.stackoverflow.com

jmoerdyk

@Spevacus I tried that, I'm getting a "Your account is not approved to use the write API." from metasmoke when I do that

Makyen

17:31

@jmoerdyk That's actually a little different ask; not in a bad way. I just didn't know that's what you wanted, so didn't enable that. Would you also like SmokeDetector privileges?

jmoerdyk

@Makyen yes please

Spevacus

Ah, right, you do also need some extra privileges for that.

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ip for hostname in body, potentially bad keyword in body (2): why return none in using bs4?‭ by Hadi Farahani‭ on stackoverflow.com

Makyen

@jmoerdyk OK. I'll do that in a bit. I'm right in the middle of re-reviewing a change to a file and making the change for SD privileges would make me loose my place, so it's going to be a couple/few minutes.

SmokeDetector

teward/Thoth: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started at rev fe752810f5 (SmokeDetector: Merge pull request #7536 from Charcoal-SE/auto-blacklist-1675377930) (running on teward/Thoth, Python 3.10.6)

Restart: API quota is 70628.

jmoerdyk

17:35

@Makyen whenever you get a chance, not in a hurry, I've waited this long....

Makyen

@jmoerdyk I did add the "Reviewer" role on MS, so you should be able to proceed with Advanced Flagging.

jmoerdyk

@Makyen many thanks

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ip for hostname in body, potentially bad keyword in body (2): why return none in using bs4? ✏️‭ by Hadi Farahani‭ on stackoverflow.com

metasmoke

fp feedback received on [MS] why return none in using bs4?‭

PR#7537 ("Give jmoerdyk chat privileges in Charcoal HQ") opened by Spevacus

Spevacus

Might've saved you a couple minutes. Hope I made it in time :)

metasmoke

17:44

[ SmokeDetector ] GitHub Actions: success on de88bbd by Spevacus in the patch-1 branch

naa- feedback received on [MS] Changed URL of a site, now Google won't index it‭

fp- feedback received on [MS] Problemas para enviar enlace‭

[ SmokeDetector ] GitHub Actions: success on fea4074 by Spevacus in the patch-1 branch

[ SmokeDetector ] GitHub Actions: success on d8c5d17 by makyen in the master branch

SmokeDetector

[ SmokeDetector ] SmokeDetector started at rev d8c5d172cc (Makyen: Merge pull request #7537 from Spevacus/patch-1) (running on teward/Thoth, Python 3.10.6)

Restart: API quota is 70345.

[ SmokeDetector | MS ] Potentially bad ip for hostname in body, potentially bad keyword in body (2): why return none in using bs4? ✏️‭ by Hadi Farahani‭ on stackoverflow.com

[ SmokeDetector | MS ] Potentially bad ip for hostname in body, potentially bad ns for domain in body, potentially bad keyword in body (3): What is the design system of gumroad? ✏️‭ by user164547‭ on ux.SE

metasmoke

18:06

fp- feedback received on [MS] What is the design system of gumroad?‭

fp- feedback received on [MS] When should I use dropdown or sheets in mobile design?‭

SmokeDetector

[ SmokeDetector | MS ] Offensive answer detected, potentially bad keyword in answer (79): No module named 'project_name' with Django + Celery?‭ by Vinko Oakniiv‭ on stackoverflow.com

metasmoke

fp- feedback received on [MS] No module named 'project_name' with Django + Celery?‭

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Como diminuir o espaço de clicavel de um link? todos os meus links com os nomes baixar disco 01, 02 , 03... esta muito grande ao passar o mouse!‭ by Anna Kezhya‭ on pt.stackoverflow.com

metasmoke

fp- feedback received on [MS] Como diminuir o espaço de clicavel de um link? todos os meus links com os nomes baixar disco 01, 02 , 03... esta muito grande ao passar o mouse!‭

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in answer (1): What do you call the pointy parts of a text bubble that's not the tail?‭ by Herman p Espinoza‭ on ell.SE

metasmoke

18:13

tpu- feedback received on [MS] What do you call the pointy parts of a text bubble that's not the tail?‭

SmokeDetector

18:25

[ SmokeDetector | MS ] Potentially bad keyword in body (1): UI Kit / Design System for React and Figma?‭ by e23‭ on stackoverflow.com

[ SmokeDetector | MS ] Potentially bad keyword in body, potentially bad keyword in title (2): Dubai Call #Girls 05O91O128O Call #Girls in Dubai‭ by pooja kumari485‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Dubai Call #Girls 05O91O128O Call #Girls in Dubai‭

Jesse

!!/watch-number 0509101280

SmokeDetector

@Jesse A normalized version, {{'0509101280'}}, of that pattern is already on the number watchlist. You can use !!/bisect-number 0509101280 to determine which entries on the number lists match that pattern, which would tell you: Matched by 0509101280 on line 3424 of watched_numbers.txt: 0509101280 found verbatim

Jesse

Hmm... What would we do to catch this now that they're replacing 0s with Os in the number?

Oh wait nevermind it already caught it, it just said potentially bad keyword not bad phone number.

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): vue3 reactive unexpected behaviour‭ by douglas martins‭ on stackoverflow.com

Mast

18:35

The different methods and lists can be confusing.

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, potentially bad keyword in body, potentially bad keyword in title, blacklisted user (264): Al Warqa'a Call #Girls 05O91O128O #Call Girls in Dubai‭ by pooja kumari485‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Al Warqa'a Call #Girls 05O91O128O #Call Girls in Dubai‭

Pilot6

!!/report askubuntu.com/questions/1453341/…

SmokeDetector

@Pilot6 You are not a privileged user. Please see the privileges wiki page for information on what privileges are and what is expected of privileged users.

[ SmokeDetector | MS ] Few unique characters in answer, potentially bad keyword in answer, repeating words in answer, toxic answer detected (256): Entropy change upon mixing cold and hot water‭ by jamal‭ on chemistry.SE

[ SmokeDetector | MS ] Potentially bad keyword in body, potentially bad keyword in title (2): Dip Call #Girls 05O91O128O Call #Girls in Dubai‭ by soniya khan‭ on askubuntu.com

[ SmokeDetector | MS ] Manually reported question (93): Al Barsha Call #Girls O528648O7O Call #Girls in Al Barsha‭ by pinkibisnoi‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Dip Call #Girls 05O91O128O Call #Girls in Dubai‭

tpu- feedback received on [MS] Entropy change upon mixing cold and hot water‭

New metasmoke user 'Sven Hippler' created @Makyen

Spevacus

18:42

@Pilot6 I've submitted a report for this here, thanks for linking it. A change necessary to catch this particular type of spam is being worked on by Makyen, but he's also making a bunch of other changes to expressions on the list he's working with.

Pilot6

@Spevacus OK, thx

Today we've got a lot of "girls"

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): Software for unit aware calculations?‭ by Martin Meier‭ on math.SE

Spevacus

Yeah, can't say I'm too interested. :)

metasmoke

fp- feedback received on [MS] Software for unit aware calculations?‭

Pilot6

Especially in Dubai

:-)

Spevacus

18:45

:)

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body, potentially bad keyword in title, blacklisted user (72): Marina Call# Girls O5O91O128O Call #Girls in Marina‭ by soniya khan‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Marina Call# Girls O5O91O128O Call #Girls in Marina‭

Spevacus

!!/blacklist-number 0509101280

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 1a2150e691 (SmokeDetector: Auto blacklist of 0509101280 normalized numbers: {'0509101280'} by Spevacus) (running on teward/Thoth)

Spevacus

!!/deobfuscate-number O528648O7O

SmokeDetector

18:47

@Spevacus Deobfuscated: 0528648070; deobfuscated and normalized: 0528648070

Spevacus

!!/watch-number 0528648070

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev c6fa566302 (SmokeDetector: Auto watch of 0528648070 normalized numbers: {'0528648070'} by Spevacus) (running on teward/Thoth)

[ SmokeDetector | MS ] Potentially bad ip for hostname in body (1): Google search console mobile usage test/friendly usage issue ✏️‭ by BAZAAR CLICK‭ on stackoverflow.com

Spevacus

Looks like an AU mod is in the house now. Frontpage just got nuked.

metasmoke

fp- feedback received on [MS] Google search console mobile usage test/friendly usage issue‭

SmokeDetector

[ SmokeDetector | MS ] Bad phone number in body, bad phone number in title (200): Deira Call #Girls @*< O5O91O128O >@* Call #Girls in Deira‭ by pooja kumari876‭ on askubuntu.com

metasmoke

18:50

tpu- feedback received on [MS] Deira Call #Girls @*< O5O91O128O >@* Call #Girls in Deira‭

SmokeDetector

[ SmokeDetector | MS ] Bad phone number in body, bad phone number in title, blacklisted user (270): Al Dhagaya Call #Girls @! O5O91O128O @!Call #Girls in Al Dhagaya‭ by pooja kumari876‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Al Dhagaya Call #Girls @! O5O91O128O @!Call #Girls in Al Dhagaya‭

SmokeDetector

[ SmokeDetector | MS ] Bad phone number in body, bad phone number in title (200): Fujairah Call #Girls O5O91O128O Call #Girls in Fujairah‭ by Queen Banni2‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Fujairah Call #Girls O5O91O128O Call #Girls in Fujairah‭

SmokeDetector

[ SmokeDetector | MS ] Blacklisted user (70): Sharjah Call #Girls O5O57214O7 Call #Girls in Sharjah‭ by Queen Banni2‭ on askubuntu.com

metasmoke

18:53

tpu- feedback received on [MS] Sharjah Call #Girls O5O57214O7 Call #Girls in Sharjah‭

SmokeDetector

[ SmokeDetector | MS ] Blacklisted user (70): Ajman Call #Girls O5817O81O5 Call #Girls in Ajman‭ by Queen Banni2‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Ajman Call #Girls O5817O81O5 Call #Girls in Ajman‭

Spevacus

!!/deobfuscate-number O5817O81O5

Jesse

Dang what's with all these spam posts all of a sudden?

SmokeDetector

@Spevacus Deobfuscated: 0581708105; deobfuscated and normalized: 0581708105

Spevacus

18:54

!!/blacklist-number 0581708105

!!/blacklist-number 0528648070

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev d0cdcb00ea (SmokeDetector: Auto blacklist of 0581708105 normalized numbers: {'0581708105'} by Spevacus) (running on teward/Thoth)

[ SmokeDetector | MS ] Bad phone number in body, bad phone number in title (200): Fujairah Call #Girls O5O91O128O Call #Girls in Fujairah‭ by monika khan786‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Fujairah Call #Girls O5O91O128O Call #Girls in Fujairah‭

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 6522bb38a6 (SmokeDetector: Auto blacklist of 0528648070 normalized numbers: {'0528648070'} by Spevacus) (running on teward/Thoth)

Spevacus

I'm just going to throw these on the blacklist. It's clearly all a campaign and there's no sense waiting for them to hit the acceptable threshold with this volume.

SmokeDetector

[ SmokeDetector | MS ] Bad phone number in body, bad phone number in title, blacklisted user (270): Ras Al Khaimah Call# Girls O5O91O128O Call #Girls in Ras Al Khaimah‭ by monika khan786‭ on askubuntu.com

Jesse

18:56

What's the difference between the blacklist and the watchlist?

metasmoke

tpu- feedback received on [MS] Ras Al Khaimah Call# Girls O5O91O128O Call #Girls in Ras Al Khaimah‭

Spevacus

@Jesse Higher weight, which triggers autoflagging more quickly. The list is generally used on expressions that have a very high chance to be spam.

Jesse

Ah alright.

Spevacus

It looks like SpamRam might be kicking in, as the wave is slowing now that a mod has swept things up again.

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): First time user looking for some assistance‭ by stonkbonker‭ on stackoverflow.com

cocomac

18:58

@Jesse See also charcoal-se.org/smokey/Guidance-for-Blacklisting-and-Watching

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ip for hostname in body, potentially bad ns for domain in body (2): Google search console mobile usage test/friendly usage issue‭ by BAZAAR CLICK‭ on meta.SE (@Ollie @Ethan)

Spevacus

@SmokeDetector k Given the profile's content and the fact that this was crossposted on SO, I'm going to say this is spam.

metasmoke

fp feedback received on [MS] First time user looking for some assistance‭

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 54de8c6b03 (Makyen: keyword blacklist: Change \W? to [\W_]*+ when followed by a \w) (running on teward/Thoth)

metasmoke

[ SmokeDetector ] GitHub Actions: success on 54de8c6 by makyen in the master branch

SmokeDetector

19:00

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad phone number in body, bad phone number in title (392): Palm Jumeirah Call #Girls O5O91O128O Call #Girls in Palm Jumeirah‭ by queen rani‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Palm Jumeirah Call #Girls O5O91O128O Call #Girls in Palm Jumeirah‭

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad phone number in body, bad phone number in title, blacklisted user (462): Al Nahda Second Call #Girls O5O91O128O Call #Girls in Al Nahda Second‭ by queen rani‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Al Nahda Second Call #Girls O5O91O128O Call #Girls in Al Nahda Second‭

tp feedback received on [MS] Al Barsha Call #Girls O528648O7O Call #Girls in Al Barsha‭

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title (192): Ras Al Khaimah Call #Girls O56486O4O9 Call #Girls in Ras Al Khaimah‭ by nehakhalifa2‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Ras Al Khaimah Call #Girls O56486O4O9 Call #Girls in Ras Al Khaimah‭

Spevacus

19:04

!!/blacklist-number 0564860409

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 2b70e524f4 (SmokeDetector: Auto blacklist of 0564860409 normalized numbers: {'0564860409'} by Spevacus) (running on teward/Thoth)

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted user (262): Marina Call #Girls O5286O4116 Call #Girls in Marina‭ by nehakhalifa2‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Marina Call #Girls O5286O4116 Call #Girls in Marina‭

Jesse

Ah they're back

Spevacus

!!/blacklist-number 0528604116

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 9cc8df7e25 (SmokeDetector: Auto blacklist of 0528604116 normalized numbers: {'0528604116'} by Spevacus) (running on teward/Thoth)

Jesse

19:09

My main question is, of all the Stack Exchange sites, why Ask Ubuntu?

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad phone number in body, bad phone number in title (392): Al Nahda Second Call #Girls O5O91O128O Call #Girls in Al Nahda Second‭ by Ritu kumari897‭ on askubuntu.com

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad phone number in body, bad phone number in title (392): Al Barsha Call #Girls O528648O7O Call #Girls in Al Barsha‭ by babitasharma‭ on askubuntu.com

Makyen/EC2-linux: Executing automatic scheduled reboot.

metasmoke

tpu- feedback received on [MS] Al Nahda Second Call #Girls O5O91O128O Call #Girls in Al Nahda Second‭

tpu- feedback received on [MS] Al Barsha Call #Girls O528648O7O Call #Girls in Al Barsha‭

SmokeDetector

[ SmokeDetector ] SmokeDetector started in standby mode at rev 6e4e67bc72 (tripleee: Typo in comment) (running on Makyen/EC2-linux)

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted user (262): Deira Call #Girls O5659O4O81 Call #Girls in Deira‭ by babitasharma‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Deira Call #Girls O5659O4O81 Call #Girls in Deira‭

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad phone number in body, bad phone number in title, blacklisted user (462): Ajman call #girls %% O5O91O128O %% call #girls in Ajman‭ by Ritu kumari897‭ on askubuntu.com

metasmoke

19:12

tpu- feedback received on [MS] Ajman call #girls %% O5O91O128O %% call #girls in Ajman‭

Pilot6

It seems to be working now

Spevacus

!!/blacklist-number 0565904081

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev e5ca480b69 (SmokeDetector: Auto blacklist of 0565904081 normalized numbers: {'0565904081'} by Spevacus) (running on teward/Thoth)

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title (192): Al Nahda Call #Girls O5O2483OO6 Call #Girls in Al Nahda‭ by fatimaqueen‭ on askubuntu.com

Spevacus

@Pilot6 Yeah, they're all being caught pretty consistently now. It's not going to be instant due to how often new questions are scanned as they hit the question feed, as well as how long it takes to scan each new post, but it'll be pretty quick.

metasmoke

tpu- feedback received on [MS] Al Nahda Call #Girls O5O2483OO6 Call #Girls in Al Nahda‭

Spevacus

19:15

!!/blacklist-number 0502483006

Pilot6

@Spevacus It is quick enough now

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev e19338cb07 (SmokeDetector: Auto blacklist of 0502483006 normalized numbers: {'0502483006'} by Spevacus) (running on teward/Thoth)

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title (192): Jumierah Call #Girls O58195O41O Call #Girls in Jumierah‭ by poojakhalifa‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Jumierah Call #Girls O58195O41O Call #Girls in Jumierah‭

Spevacus

!!/blacklist-number 0581950410

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted user (262): Palm Jumeirah Call #Girls O58993O4O2 Call #Girls in Palm Jumeirah‭ by poojakhalifa‭ on askubuntu.com

metasmoke

19:22

tpu- feedback received on [MS] Palm Jumeirah Call #Girls O58993O4O2 Call #Girls in Palm Jumeirah‭

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev a83445c630 (SmokeDetector: Auto blacklist of 0581950410 normalized numbers: {'0581950410'} by Spevacus) (running on teward/Thoth)

Spevacus

!!/blacklist-number 0589930402

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 6c19e07282 (SmokeDetector: Auto blacklist of 0589930402 normalized numbers: {'0589930402'} by Spevacus) (running on teward/Thoth)

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad phone number in body, bad phone number in title (392): Palm Jumeirah Call #Girls O58993O4O2 Call #Girls in Palm Jumeirah‭ by nayrakhalifa‭ on askubuntu.com

metasmoke

tpu- feedback received on [MS] Palm Jumeirah Call #Girls O58993O4O2 Call #Girls in Palm Jumeirah‭

Makyen

@Jesse There's usually not a good answer to this, other than "it's the one they picked", which is basically ¯\_(ツ)_/¯.

Jesse

19:35

Fair. I would think they would have picked one of the bigger ones. Maybe they though it was a good mid area where there's a decent amount of people but not as many moderators?

Makyen

@Spevacus Yeah, I should have just made that change and then worked on any others.

SmokeDetector

[ SmokeDetector | MS ] Link at end of body (98): Ddossed ap0xx windows and multiple payloads installed‭ by Learningopsec‭ on superuser.com

[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): Вывести данные в datagridview EF Core‭ by AGRONOM‭ on ru.stackoverflow.com

Makyen

@Jesse Maybe. It's #2 when the sites are sorted by traffic.

Jesse

Oh interesting. I would have thought Super User would be second.

Pilot6

@Jesse Probably someone got angry with us ;-) for moderation

Jesse

19:42

Yeah could be that too.

metasmoke

fp- feedback received on [MS] Ddossed ap0xx windows and multiple payloads installed‭

SmokeDetector

19:59

[ SmokeDetector | MS ] Link at beginning of answer (36): Number of asymmetric relation ✏️‭ by john‭ on math.SE

metasmoke

naa feedback received on [MS] Number of asymmetric relation‭

SmokeDetector

[ SmokeDetector | MS ] Repeating characters in body (62): Java Box Grid - Receiving Question Marks Instead of a Grid‭ by Jason C‭ on stackoverflow.com

[ SmokeDetector | MS ] Potentially bad ip for hostname in body, potentially bad ns for domain in body (2): Why are developers important?‭ by Ronald F. Bradley‭ on wordpress.SE

metasmoke

tpu- feedback received on [MS] Why are developers important?‭

Spevacus

!!/watch wootech\.io

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 087e536dad (SmokeDetector: Auto watch of wootech\.io by Spevacus) (running on teward/Thoth)

metasmoke

20:19

fp- feedback received on [MS] Java Box Grid - Receiving Question Marks Instead of a Grid‭

Catija

5

Q: 2023 DOM Changelog for Userscript Community

Here's a thread to catalog any minor DOM updates we do throughout 2023 just to give folks in the user community a bit of a heads up and an official source of documentation around any DOM changes. This is a "best effort" source and we will try to note any changes here that will impact user script...

discussion userscript

Possibly relevant to y'all ^^^

Spevacus

<3 thank you

SmokeDetector

20:34

[ SmokeDetector | MS ] Bad phone number in body, bad phone number in title, phone number detected in title, potentially bad asn for hostname in body, potentially bad ns for domain in body, +1 more (381): 📲Jetblue Airlines📲📲 I 844 (919)-4592📲📲Reservation Number📲‭ by stevedodd96‭ on meta.SE (@Ollie @Ethan)

metasmoke

tpu- feedback received on [MS] 📲Jetblue Airlines📲📲 I 844 (919)-4592📲📲Reservation Number📲‭

SmokeDetector

20:45

[ SmokeDetector | MS ] No whitespace in title (71): asassasaasjjasjasjjasasjasjas‭ by Ashkan Mehrvarz‭ on astronomy.SE

metasmoke

20:57

fp- feedback received on [MS] asassasaasjjasjasjjasasjasjas‭

SmokeDetector

[ SmokeDetector | MS ] Potentially bad asn for hostname in body (1): Unable to access array within an array from Salesforce flow http callout (beta)‭ by Kashona‭ on stackoverflow.com

[ SmokeDetector | MS ] Mostly punctuation marks in answer (35): Parse JSON object with multiple arrays based on specific value‭ by Fra‭ on stackoverflow.com

metasmoke

21:13

fp feedback received on [MS] Unable to access array within an array from Salesforce flow http callout (beta)‭

Cody Gray

@tripleee #stuff-up really seems like the wrong annotation for an intentional obfuscation. To me, #stuff-up should be the people who get the link-creation syntax wrong or have some other copy-paste or editor-usage issue.

@Spevacus Twins! :-)

Spevacus

:O

Cody Gray

@Jesse There's rarely any rhyme or reason, in my experience. It's just the site that was arbitrarily chosen by the spammer(s).

Oh, never mind. Makyen already said essentially that same thing. :-)

SmokeDetector

21:43

[ SmokeDetector | MS ] Bad keyword with email in body, email in body, potentially bad ns for domain in body, potentially bad keyword in body (97): How do I get back my stolen bitcoin?‭ by grant suzanne‭ on money.SE

metasmoke

tpu- feedback received on [MS] How do I get back my stolen bitcoin?‭

Cody Gray

!!/watch- cybegal\.com

!!/watch-number +19892640381

!!/watch Spyware[\W_]*+Cyber

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev a0f6ccb0c0 (SmokeDetector: Auto watch of cybegal\.com by Cody Gray) (running on teward/Thoth)

@CodyGray A normalized version, {{'19892640381', '9892640381'}}, of that pattern is already on the number watchlist. You can use !!/bisect-number +19892640381 to determine which entries on the number lists match that pattern, which would tell you: Matched by +19892640381 on line 3347 of watched_numbers.txt: +19892640381 found verbatim

Cody Gray

!!/bisect [email protected]

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev d045ab27a4 (SmokeDetector: Auto watch of Spyware[\W_]*+Cyber by Cody Gray) (running on teward/Thoth)

@CodyGray Matched by (?:spyware[\W_]*+)?cybergal[\W_]*+com on line 44758 of watched_keywords.txt

Cody Gray

21:47

Hmm... I wonder why it was done like that.

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ip for hostname in answer (1): Which culture believed in a bird whose flight sustains the universe?‭ by Minnowquick‭ on mythology.SE

[ SmokeDetector | MS ] Bad keyword with email in body (55): I get this error while running spring boot with intellij ERROR 13240 --- [ restartedMain] o.s.boot.SpringApplication : Application run failed‭ by Tyson‭ on stackoverflow.com

[ SmokeDetector | MS ] Potentially bad ip for hostname in answer (1): Use pandas to extract XML with the redundant tags ✏️‭ by sam.rudloff‭ on stackoverflow.com

Cody Gray

Oh wow. One with an "r", one without.

metasmoke

fp feedback received on [MS] I get this error while running spring boot with intellij ERROR 13240 --- [ restartedMain] o.s.boot.SpringApplication : Application run failed‭

fp feedback received on [MS] Which culture believed in a bird whose flight sustains the universe?‭

fp feedback received on [MS] Use pandas to extract XML with the redundant tags‭

Cody Gray

!!/unwatch (?:spyware[\W_]*+)?cybergal[\W_]*+com

!!/unwatch cybegal\.com

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 23b7bc1264 (SmokeDetector: Auto unwatch of (?:spyware[\W_]*+)?cybergal[\W_]*+com by Cody Gray) (running on teward/Thoth)

Cody Gray

21:51

!!/watch cyber?gal[\W_]*+com

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev a08333016b (SmokeDetector: Auto unwatch of cybegal\.com by Cody Gray) (running on teward/Thoth)

[ SmokeDetector ] Blacklists reloaded at rev fe68e760d6 (SmokeDetector: Auto watch of cyber?gal[\W_]*+com by Cody Gray) (running on teward/Thoth)

metasmoke

Makyen/MS-Relay: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started at rev 6b79b1731 (Makyen: Ping Makyen for some new metasmoke users) (running on Makyen/MS-Relay, Python 3.11.0)

SmokeDetector

22:20

[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): How to get proper backtrace in process signal handler (armv7-uclibc)?‭ by LeoneChen‭ on stackoverflow.com

Cody Gray

!!/report stackoverflow.com/a/75306152

SmokeDetector

[ SmokeDetector | MS ] Manually reported answer (94): Unban ID | I've used an unban command but still cant unban with an ID‭ by Ron Gaming‭ on stackoverflow.com

[ SmokeDetector | MS ] Potentially bad keyword in body (1): why I can't do if d < 25 :? ✏️‭ by Cresendo‭ on stackoverflow.com

Cody Gray

!!/report stackoverflow.com/a/74147489

SmokeDetector

[ SmokeDetector | MS ] Manually reported answer (94): Unban ID | I've used an unban command but still cant unban with an ID‭ by Abhinash Kumar‭ on stackoverflow.com

metasmoke

fp feedback received on [MS] How to get proper backtrace in process signal handler (armv7-uclibc)?‭

fp feedback received on [MS] why I can't do if d < 25 :?‭

SmokeDetector

22:28

[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): Skilled Worker Visa: Teaching Assistant‭ by Elegant Vogue‭ on expatriates.SE

[ SmokeDetector | MS ] Potentially bad keyword in body (1): a split second error on StreamBuilder Flutter‭ by Yigit Kaya‭ on stackoverflow.com

metasmoke

fp feedback received on [MS] a split second error on StreamBuilder Flutter‭

SmokeDetector

API quota rolled over with 68221 requests remaining. Current quota: 79999.

stackoverflow: 2279
math: 1116
ru.stackoverflow: 498
physics: 345
electronics: 341
superuser: 337
askubuntu: 287
unix: 280
es.stackoverflow: 274
stats: 265
gis: 254
tex: 228
mathoverflow.net: 209
pt.stackoverflow: 178
blender: 155
salesforce: 145
serverfault: 145
dba: 135
codegolf: 131
diy: 129
ell: 120
meta: 115
mathematica: 114
english: 94
apple: 92
philosophy: 92
webapps: 91
ethereum: 91
scifi: 89
politics: 88
law: 85
datascience: 84
dsp: 81
hermeneutics: 76
worldbuilding: 76
chemistry: 71
magento: 67

SmokeDetector

22:48

[ SmokeDetector | MS ] Potentially bad keyword in body (1): What other times has a Chinese high-altitude balloon entered US airspace?‭ by David Eugene Pratt‭ on aviation.SE (@Federico)

metasmoke

fp feedback received on [MS] What other times has a Chinese high-altitude balloon entered US airspace?‭

SmokeDetector

[ SmokeDetector | MS ] Mostly punctuation marks in title (37): "Don't be ....." or "Be not ....."‭ by Konstantin Volkov‭ on english.SE

metasmoke

fp feedback received on [MS] "Don't be ....." or "Be not ....."‭

SmokeDetector

23:08

[ SmokeDetector | MS ] Bad ns for domain in body, bad keyword in body, blacklisted website in body (288): HOW TO BE COME MILLIONEAR‭ by Umutoni Aminah‭ on meta.SE (@Ollie @Ethan)

metasmoke

23:20

tp feedback received on [MS] HOW TO BE COME MILLIONEAR‭

SmokeDetector

[ SmokeDetector | MS ] Link at beginning of answer (36): How to find the recording time for a video from the linux command line‭ by szilike‭ on stackoverflow.com

metasmoke

fp feedback received on [MS] How to find the recording time for a video from the linux command line‭

SmokeDetector

23:58

teward/Thoth: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started at rev fe68e760d6 (SmokeDetector: Auto watch of cyber?gal[\W_]*+com by Cody Gray) (running on teward/Thoth, Python 3.10.6)

Restart: API quota is 79274.

Transcript for