Bad keyword in body - Position 2697-2713: writing services Bad ns for domain in body - rplforaustralia.com NS suspicious ns1.cp-48.bigrockservers.com.,ns2.cp-48.bigrockservers.com. Pattern-matching website in body - Position 3065-3084: rplforaustralia.com Potentially bad ip for hostname in body - www.rplforaustralia.com suspicious IP address 207.174.215.236 for NS Potentially bad keyword in body - Position 3065-3084: rplforaustralia.com
@SmokeDetector mixed bag, fair amount of legitimate domains in that AS too ... but a good watch to have overall - perhaps we should whitelist more domains though
Potentially bad asn for hostname in body - africansafari-ugandasafari.com address 107.190.129.90 in ASN 33182 Potentially bad ip for hostname in body - africansafari-ugandasafari.com suspicious IP address 107.190.129.90 Potentially bad keyword in body - Position 2542-2572: africansafari-ugandasafari.com
Bad keyword with email in body - Keyword *opportunity, investors, we develop, investors, interested, contact us* with email *fanacoins@gmail.com* Potentially bad keyword in body - Position 2800-2804: rape
@CodyGray The regex contains an unescaped ".", which should be "\." in most cases. Append -force to the command if you really want to add this pattern.
@CodyGray Bad keyword in body - Position 1708-1716: ketodiet
Makyen/EC2-num02: In getting MS post information, recovered from requests.exceptions.ConnectionError: HTTPSConnectionPool(host='metasmoke.erwaysoftware.com', port=443): Max retries exceeded with url: /api/v2.0/posts/urls?key=[METASMOKE KEY REDACTED]&filter=GHOOIJGNLKHIIOIKGILKIJGHFMNKKGFJ&urls= (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f6797c00b90>: Failed to establish a new connection: [Errno -2] Name or service not known'))
@Ollie That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body Append -force to the command if you really want to add this pattern.
When MS isn't available, and not marked as down, SD makes a lot of attempts to get the MS whitelist tag (looks like once per tested post), which isn't surprising, given the code, but it would probably be better to limit that.
Yeah, that makes sense, actually. The attempt to retrieve it from cache returns "null", so it tries to fetch to populate the cache, and... well, here we are.
In some ways, I think it is reasonable to just accept that the two systems are tightly coupled, though. Outages like this are an extreme rarity.
The fact that we're limping along at all, with most of the essential functionality in-place, is pretty good.
ED0EU5E3LDSME67U84A8UT2BMLLTU36S.com. 86400 IN RRSIG NSEC3 8 2 86400 20211130060859 20211123045859 15549 com. q8K+2fJcUNTDolMNniExDQ+X4p9gYhtquYqGv2lyuK0OXDh4nkV+imXI LNEDze3O/XPvOBgxe19bJXHsS5Pr4sZY0ZWET5yLwdsygRg9qWYLz5Z/ 3anOe4WynbQKa9n2+zO2Khy9eJ8DhN4Xd73G2oSfRx+Bl0jNvycYV3Cx 8AiHakWDISi/vbd7vX3r98WS1p5mr9ayjY5G+TW8NexSww==
;; Received 920 bytes from 192.42.93.30#53(g.gtld-servers.net) in 54 ms
metasmoke.erwaysoftware.com. 300 IN NS dns.thomas-ward-consulting.llc.
;; Received 100 bytes from 172.64.32.217#53(reza.ns.cloudflare.com) in 30 ms
after the root server resolution etc
dns.thomas-ward-consulting.llc has address 50.211.70.69
@Ollie This is most likely caching. The list of blacklisters, imported as raw bytes, so not easily editable, was copied from the data which my "EC2-linux" instance had. From the fact that it doesn't appear to include you, I assume that instance obtained a copy from MS a long time ago and was just never operational at a time when you previously tried to blacklist/watch something.
@Ollie The overall source for the code privileged list is MS. There's not an easy way to add a single user to the list with MS down. It's probably possible, but would require at least changing the configuration file (maybe, I'd have to double-check how I implemented something), making code changes, or writing separate code to decode the data stored in the pickle, modifying it, and then writing it out. So, it's possible. I'll take a look, but I'm working on something else for a bit first.
@tripleee An invalid pattern was provided, please check your command.
@tripleee That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body Append -force to the command if you really want to add this pattern.
@tripleee Added khakisahib\d*(?:[\W_]*+(?:at[\W_]*+)?gmail[\W_]*+(?:dot[\W_]*+)?com)? to watchlist
