[ SmokeDetector | MS ] Blacklisted website in body, link at beginning of body, potentially bad ip for hostname in body, potentially problematic ns configuration in body (146): Marketing Softwares by Jeevan Kumar on superuser.com
@tripleee Since I reformatted that entry to not have a variable-length look-behind in order to check its performance on MS, ^.{0,207}(?:contact|offer|join).{0,99}?\d{9}(?=.{0,99}+$), I figured I should post it in here along with a link to the search: 486 Total / 348 TP (71.6% TP) / 94 FP / 52 NAA
[ SmokeDetector | MS ] Blacklisted website in body, link at beginning of body, potentially bad ip for hostname in body, potentially problematic ns configuration in body, blacklisted user (218): Marketing Softwares by Jeevan Kumar on superuser.com
@SmokeDetector This "answer" was posted only a few minutes after the blog was posted. I find it highly unlikely that it was for any reason other than to promote the blog, particularly given that the unregistered account was created at essentially the same time (i.e., just to post that "answer").
@Cow I think the author is exaggerating the impact of this "discovery." It doesn't take much to say, "Oh, there are only twelve semitones? You can just permute them all to get every combination of notes," as if to say, "this is all music". This, of course, completely ignores the fact that rhythm is a thing, excluding percussion and rap, which is silly. It's not the only thing being ignored here, but that's a big one.
@JeffSchaller That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body Append -force to the command word(s) if you really want to add the pattern you provided.