@tripleee Actually, metasmoke can search for those, but the syntax for using hex codes is: [\x{4E00}-\x{9FFF}], which is, of course, a different syntax than is used in spam wave definitions, which would need the syntax you were using: [\u4E00-\u9FFF]. For [\x{4E00}-\x{9FFF}] in titles it's this search.
What metasmoke can't do with a regular expression in search, or at least I've found no way to do it, is to search for characters which are at code points higher than 0xFFFF, because the \x{4E00} uses a max of 4 hex digits. MS can search for characters represented by higher code points (e.g. emoji) when not using a regex.
@tripleee A blacklist of that username doesn't appear justified by the results in MS: 18 Total / 13 TP (72.22% TP) / 5 FP / 1 NAA, which doesn't consider the issue that there are quite a few users with that username. Exact matches for that username still appear on page 11 when searching for it on SO. Given the limits of searching on SE, that includes a substantial number of non-matches for the exact character case used, but it's still on the order of hundreds.
@Makyen A normalized version, {{'19883366131', '9883366131'}}, of that pattern is already on the number blacklist. You can use !!/bisect-number 988-336-6131 to determine which entries on the number lists match that pattern, which would tell you: Matched by 988-336-6131 on line 845 of blacklisted_numbers.txt: 988-336-6131 found verbatim
@Makyen That pattern looks like it's already caught by Mostly punctuation marks in answer and Mostly punctuation marks in body Append -force to the command word(s) if you really want to add the pattern you provided.
[ SmokeDetector | MS ] Bad keyword in body, blacklisted website in body, link at beginning of body, potentially bad keyword in body (234): Slot Thailand sw303 by sw303 on meta.SE (@Ollie @Ethan)
@tripleee I probably should have discussed this more with you and let you remove it. I'm sorry I went ahead and removed it.
For this specific case, it didn't seem like a good trade-off to blacklist that username, (?-i:^Jhon$). The spammer has posted only 4 spam posts over 3 days. That implies it's not an urgent need (i.e. they're not blasting away with lots of posts) and that we'd need to leave the entry in there for days for it to be useful. On the other side of the tradeoff are probably a couple hundred accounts, just on SO, with that exact name. Overall, it seems it would be likely to see some FP.
I, as you've probably noticed, would strongly prefer we don't detect innocent people and their posts just because the username they've chosen happens to be being used by a spammer, particularly when it's their real name or a part of their real name. When the detection is on the username, it can really feel to the innocent user that they are being targeted, because, well, they are being targeted, although unintentionally.
So, while blacklisting a username is a very useful tool, it's something I'd prefer to see used fairly sparingly when there's a likelihood of detecting a notable number of innocent users, particularly when the username might be, or be directly related to, the person's real name.
For me, it, largely, comes down to the relative tradeoff between the need to detect additional inappropriate posts vs not harming innocent users by bringing more attention to their posts due to their username. In this case, the tradeoff of the potential positives didn't appear to be worth the potential negatives.
@Jesse That pattern may be a North American number. If it is, please use a format which starts with an optional 1 followed by possible separator text and has the main number in the format 886-397-1351 where - could be a single alpha character or any [\W_]*+. Alternately, you can add the comment (?#IS NorAm) to the end of the pattern to force also using the alternate normalized form, or (?#NO NorAm) if it's not a North American phone number and it's incorrectly recognized as one. Perhaps try !!/watch-number 886-397-1351. Append -force to the command word(s) if you really want to add the pattern you provided.
I actually am not sure if those are US numbers. The top one seems like it could be Taiwan. I'm just not quite sure how else to add them to the watchlist.
@Makyen That pattern looks like it's already caught by Bad keyword in answer and Bad keyword in body Append -force to the command word(s) if you really want to add the pattern you provided.
@Jesse What you added would normally be fine. The only issue is that for these support number spam wave numbers, we're going with directly blacklisting the numbers. As to them being North American or not, I don't believe anyone has actually tried them to find out. There are some indications both that they are and that they aren't. It's possible there's a mix. Overall, it's probably better to error on the side of them being North American and we can change that if we're getting FP specifically because SD is also looking for them with a "1".
