ABUSE filter management

ABUSE filter navigation (Home | Recent filter changes | Examine past edits | ABUSE log)
Jump to: navigation, search

Back to filter editor | Back to filter history

Differences between versions

ItemVersion from 17:57, 18 March 2012 by TepplesVersion from 22:00, 9 August 2014 by Tepples
Basic information

Description:

(publicly viewable)
 
17-letter anonymous talk edits
 
17-letter anonymous talk edits
Filter group:
 
+
Default
Flags:
 
Enabled
 
Enabled
Notes:
 
Spambots following this pattern of test edits either create a new talk page or replace an entire section of a talk page with an over-generic message of praise for the associated article, with one misspelled word whose internal letters have been scrambled. If it's a new talk page, the section title is a single "word" with 11 or more random letters of both cases. We currently detect only the new talk page, and we detect it by the section title.
 
Spambots following this pattern of test edits either create a new talk page or replace an entire section of a talk page with an over-generic message of praise for the associated article, with one misspelled word whose internal letters have been scrambled. If it's a new talk page, the section title is a single "word" with 11 or more random letters of both cases. We currently detect only the new talk page, and we detect it by the section title.
  
 
2011-08-01: Made the heuristic broader because it wasn't catching all edits that fit this pattern.
 
2011-08-01: Made the heuristic broader because it wasn't catching all edits that fit this pattern.
  
 
2011-08-09: moved OR operator into the regex to possibly save a few conditions
 
2011-08-09: moved OR operator into the regex to possibly save a few conditions
  
 
2012-01-06: decreased minimum length to 9
 
2012-01-06: decreased minimum length to 9
  
 
2012-02-01: added lUUlUU pattern
 
2012-02-01: added lUUlUU pattern
  
 
2012-03-17: Tightened significantly. Any pattern of aAAa and AaaA is matched, and minimum length is 8. Because it's so tight (for example it'll match "HyperCard"), I've added a user guidance message (for example say "HyperCard stacks").
 
2012-03-17: Tightened significantly. Any pattern of aAAa and AaaA is matched, and minimum length is 8. Because it's so tight (for example it'll match "HyperCard"), I've added a user guidance message (for example say "HyperCard stacks").
 +
 +
2014-08-09: I found a blog post about the 17-letter testing campaign. http://dw-antispam.dreamwidth.org/67987.html
 +
But a new pattern has become apparent over the past month or two. It puts a 16-letter keysmash at the end of the comment instead of in the edit summary like the classic 17-letter, and the keysmash uses only letters a-p and mostly a-h, which appears to indicate that it's a 64-bit number converted a nibble at a time.
Filter conditions
Conditions:
 
!user_editcount
 
!user_editcount
& summary rlike "^[a-zA-Z]{8,}$"
+
& (
& (summary rlike "[zZ]\w+[zZ]|[A-Z]{5}|[a-z][A-Z]+[a-z]|[A-Z][a-z]+[A-Z]")
+
(summary rlike "^[a-zA-Z]{8,}$" & summary rlike "[zZ]\w+[zZ]|[A-Z]{5}|[a-z][A-Z]+[a-z]|[A-Z][a-z]+[A-Z]")
 +
| (added_lines rlike "\s+[a-p]{10,}\s*$")
 +
)
Actions to take when matched
Actions to take when matched
 
Disallow
 
Disallow
 
Warn: abusefilter-warning-editsummary
 
Warn: abusefilter-warning-editsummary

← Older change