@SmokeDetector The history of this domain being linked shows a variety of posts where the link is just thrown into the post where it doesn't really make sense within the post. Considering that history, including the history with this user, this post looks a lot more like spam than just an off-topic question where the user linked to their site.
@SmokeDetector fp- Should be closed, though, since it's not actually asking a question. They seem to have posted it their based on the advice in that comment on their original question on security.SE. (I don't think the commenter intended to advise that.)
@EliahKagan That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
@SmokeDetector Answer has been edited to say 'Use jquery-dist ui in order to accumulate the modular components of the classes'interfaces within the nodejs environment as shown on the github page of StevePlayzMinecraft/jquery-ui which the example is "npm install jquery-ui-dist --dist --save --npm".'
@EliahKagan That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
> Potentially bad ns for domain in body, potentially bad ns for domain in title ---------- Potentially bad ns for domain in body - pcrecoverytools.com NS suspicious 1.namedc.com.,2.namedc.com. Potentially bad ns for domain in title - pcrecoverytools.com NS suspicious 1.namedc.com.,2.namedc.com.
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 31-42: -5nKb9TvBa8 Potentially bad keyword in title - Position 31-42: -5nKb9TvBa8 Potentially bad keyword in username - Position 31-42: -5nKb9TvBa8
> Potentially bad ns for domain in body, potentially bad ns for domain in title, potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Potentially bad keyword in body - Position 0-16: Sjavamusicza.com Potentially bad keyword in title - Position 0-16: Sjavamusicza.com Potentially bad keyword in username - Position 0-16: Sjavamusicza.com Potentially bad ns for domain in body - sjavamusicza.com NS suspicious dns1.namecheaphosting.com.,dns2.namecheaphosting.com.
@EliahKagan Because I copy & pasted it with the intent to look into doing that, then got distracted prior to clicking send. Thanks for bringing it to my attention.
@Makyen Why does that work? It does seem to work, but usually patterns (other than blacklisted usernames) are matched at word boundaries, and both = and - are non-word characters.
When surrounded by \b in an MS search, it doesn't match; an adjusted pattern to account for this does match as I expected.
But !!/test matches the URL to the existing pattern. So it seems correct, I'm just not sure why.
@EliahKagan The (?-i: is regex syntax and not part of the match. It begins a group in which the i flag (case insensitivity) is off. Under normal circumstances, case insensitivity is turned on for the watchlist and blacklists. Thus, (?-i:-5nKb9TvBa8) will match match "5nKb9TvBa8", but won't match "5NKB9TVBA8". If 5nKb9TvBa8 was used, then "5NKB9TVBA8" would match.
For something as long as 5nKb9TvBa8, it's not really critical, but it's a reasonable thing to do when the thing which is being detected must maintain case. It's more important in circumstances where case sensitivity can mean a significant difference in how many FP are detected.
