{"action":"created","issue":{"url":"https://api.github.com/repos/Charcoal-SE/SmokeDetector/issues/2537","repository_url":"https://api.github.com/repos/Charcoal-SE/SmokeDetector","labels_url":"https://api.github.com/repos/Charcoal-SE/SmokeDetector/issues/2537/labels{/name}","comments_url":"https://api.github.com/repos/Charcoal-SE/SmokeDetector/issues/2537/comments","events_url":"https://api.github.com/repos/Charcoal-SE/SmokeDetector/issues/2537/events","html_url":"https://github.com/Charcoal-SE/SmokeDetector/pull/2537","id":380662799,"node_id":"MDExOlB1bGxSZXF1ZXN0MjMwODA3MDg1","number":2537,"title":"Add IP blacklisting and watch","user":{"login":"tripleee","id":2160915,"node_id":"MDQ6VXNlcjIxNjA5MTU=","avatar_url":"https://avatars0.githubusercontent.com/u/2160915?v=4","gravatar_id":"","url":"https://api.github.com/users/tripleee","html_url":"https://github.com/tripleee","followers_url":"https://api.github.com/users/tripleee/followers","following_url":"https://api.github.com/users/tripleee/following{/other_user}","gists_url":"https://api.github.com/users/tripleee/gists{/gist_id}","starred_url":"https://api.github.com/users/tripleee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tripleee/subscriptions","organizations_url":"https://api.github.com/users/tripleee/orgs","repos_url":"https://api.github.com/users/tripleee/repos","events_url":"https://api.github.com/users/tripleee/events{/privacy}","received_events_url":"https://api.github.com/users/tripleee/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-14T11:49:38Z","updated_at":"2018-11-14T13:59:08Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/Charcoal-SE/SmokeDetector/pulls/2537","html_url":"https://github.com/Charcoal-SE/SmokeDetector/pull/2537","diff_url":"https://github.com/Charcoal-SE/SmokeDetector/pull/2537.diff","patch_url":"https://github.com/Charcoal-SE/SmokeDetector/pull/2537.patch"},"body":"This is a rough proof of concept, but I'm hoping it can be accepted as a baseline for future work in this direction.\r\n\r\nThere is some fugly code duplication between the IP and ASN lookups in particular; the code should arguably be refactored and modularized to have a single \"loop over URL hosts\" function with different options and parameters depending on what you are looking up.\r\n\r\nI have blacklisted two IP addresses and added a bunch of IP addresses to watch based on completely ad-hoc exploration of recent Halflife reports.  Briefly speaking, [search for an AS and take note of recurring IP addresses](https://chat.stackexchange.com/search?q=26496&Room=65945&page=2&pagesize=50&sort=newest) then maybe search for each of those in turn. I focused on big providers which we cannot just plonk in the ASN watch list, though this could obviously be repeated for many other scenarios.\r\n\r\nAs a brief test, I have scanned some 600 posts during the last hour or two (one hit on a spam which was reported for other reasons too; watched IP match on `goldencondor.org`; no false positives)."},"comment":{"url":"https://api.github.com/repos/Charcoal-SE/SmokeDetector/issues/comments/438670844","html_url":"https://github.com/Charcoal-SE/SmokeDetector/pull/2537#issuecomment-438670844","issue_url":"https://api.github.com/repos/Charcoal-SE/SmokeDetector/issues/2537","id":438670844,"node_id":"MDEyOklzc3VlQ29tbWVudDQzODY3MDg0NA==","user":{"login":"tripleee","id":2160915,"node_id":"MDQ6VXNlcjIxNjA5MTU=","avatar_url":"https://avatars0.githubusercontent.com/u/2160915?v=4","gravatar_id":"","url":"https://api.github.com/users/tripleee","html_url":"https://github.com/tripleee","followers_url":"https://api.github.com/users/tripleee/followers","following_url":"https://api.github.com/users/tripleee/following{/other_user}","gists_url":"https://api.github.com/users/tripleee/gists{/gist_id}","starred_url":"https://api.github.com/users/tripleee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tripleee/subscriptions","organizations_url":"https://api.github.com/users/tripleee/orgs","repos_url":"https://api.github.com/users/tripleee/repos","events_url":"https://api.github.com/users/tripleee/events{/privacy}","received_events_url":"https://api.github.com/users/tripleee/received_events","type":"User","site_admin":false},"created_at":"2018-11-14T13:59:08Z","updated_at":"2018-11-14T13:59:08Z","author_association":"MEMBER","body":"Having the lists statically in the code is obviously a wart. Maybe with the SQLite (or some variation of that initiative) we could make these easy to manage from chat, and perhaps via some sort of API.  I'm thinking SmokeDetector (or perhaps Halflife) could do the bulk of the routine work which we currently perform manually."}}
{"actor":{"display_login":"tripleee"}}