@Makyen That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; append -force if you really want to do that.
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, pattern-matching website in body, potentially bad keyword in body, +1 more (394): keto 6x customer service by jeanettejwright on bricks.SE
[ SmokeDetector | MS ] Bad keyword in title, blacklisted website in body, pattern-matching website in body, potentially bad ns for domain in body, potentially bad keyword in body, +1 more (397): The 2-Minute Rule for male enhancement by emmaokelley on astronomy.SE
@Makyen That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@Makyen That pattern looks like it's already caught by Potentially problematic ns configuration in answer and Potentially problematic ns configuration in body; append -force if you really want to do that.
@Undo Got redis logging outlined, see this PR. Whenever you get a chance, can you look over it to ensure that I'm not storing more info than I should be? It's not fully done, so don't merge, but the only changes left are visual stuff, not actual content.
I like redis. It's really good for mildly relational data.
@Shree That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
[ SmokeDetector | MS ] Bad keyword in body, bad pattern in url body, pattern-matching product name in body, pattern-matching product name in title, pattern-matching website in body, +2 more (491): k2-slim-keto reviews by SandraChambers on wordpress.SE
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, +9 more (893): tips4facts.com/xexlift by avxzlaoho on askubuntu.com
[ SmokeDetector | MS ] Url-only title, bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, +4 more (790): pilpedia.com/testo-drive-365/ by zcito201 on askubuntu.com
@ThomasWard @NobodyNada It looks like Solar Flare and Raspberry Pi were in standby and did not recover from MS going down. If you could kick them, that would help.
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, body starts with title and ends in url, link at end of body, +3 more (688): hydra-life-serum by user444584 on meta.SE
@Makyen That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
[ SmokeDetector | MS ] Bad keyword in body, blacklisted website in body, body starts with title and ends in url, pattern-matching website in body, potentially bad asn for hostname in body, +1 more (462): Of the cake with healthy by user157684 on wordpress.SE
@Shree - Makyen is watching cutelittedarlings.com ( chat.stackexchange.com/transcript/message/48226572#48226572), that user posted a NAA with that link, if they continue that behavior we should be alerted. I CC'd Makyen since he has the background on this. Thanks for approving the PR, IF that would have been what he wanted.
@YvetteColomb Already on watch list SD caught with message 'potentially bad key word in ........' After 5 tp its goes to black list by some code privileged user.
@YvetteColomb general rule is we need 5 tp records in metasmoke before it's eligible for blacklisting. Exceptions happen sometimes, but if it needs one it's worth dropping a message to explain that as well as just the blacklist command :)
[ SmokeDetector | MS ] Few unique characters in body, no whitespace in body, repeating characters in body (260): Message decoding ✏️ by OverHype on puzzling.SE (@Mithrandir)
@iBug That pattern looks like it's already caught by Potentially problematic ns configuration in answer and Potentially problematic ns configuration in body; append -force if you really want to do that.
I, [2018-12-25T08:02:16.224173 #1685] INFO -- : Started GET "/api/posts/search/regex?query=(%5E%7C[%5EA-Za-z0-9_])positronx%5C.io([%5EA-Za-z0-9_]%7C$)&key=(...)&filter=" for xx.yy.zz.aa at 2018-12-25 08:02:16 +0000
