Skip to content

Commit 7b5d29e

Browse files
ZabuzardZabuzard
authored
Updating scam detector for new scam and false positives (#1345)
* fixed steam false positives * fixed a hacking false positive * fixed microsoft false positive * fixed stacktrace false positives
1 parent b573623 commit 7b5d29e

File tree

3 files changed

+65
-12
lines changed

3 files changed

+65
-12
lines changed

‎application/config.json.template‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,10 @@
4040
"whatsapp",
4141
"crypto",
4242
"^claim",
43-
"teen",
43+
"^teen$",
4444
"adobe",
45-
"hack",
45+
"^hack$",
46+
"hacks",
4647
"steamcommunity",
4748
"freenitro",
4849
"^earn$",
@@ -62,7 +63,10 @@
6263
"youtube.com",
6364
"www.youtube.com",
6465
"cdn.discordapp.com",
65-
"media.discordapp.net"
66+
"media.discordapp.net",
67+
"store.steampowered.com",
68+
"help.steampowered.com",
69+
"learn.microsoft.com"
6670
],
6771
"hostBlacklist": [
6872
"bit.ly",

‎application/src/main/java/org/togetherjava/tjbot/features/moderation/scam/TokenAnalyse.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55

66
import java.net.URI;
77
import java.util.Locale;
8+
import java.util.function.Predicate;
9+
import java.util.regex.Pattern;
810

911
/**
1012
* Analyzes a given text token. Populates various metrics regarding the token possibly being
@@ -14,6 +16,10 @@
1416
* {@link #analyze(String, AnalyseResults)}.
1517
*/
1618
final class TokenAnalyse {
19+
// Tokens like: "org.schema.game.common.data.world.Sector.access$200(Sector.java:120)"
20+
private static final Predicate<String> IS_STACKTRACE_TOKEN =
21+
Pattern.compile("(org|com|de|dev)(\\.[^.()]+){4,15}\\([^.()]+\\.java:\\d+\\)")
22+
.asMatchPredicate();
1723
private final ScamBlockerConfig config;
1824

1925
TokenAnalyse(ScamBlockerConfig config) {
@@ -27,7 +33,7 @@ final class TokenAnalyse {
2733
* @param results metrics representing how suspicious the token is
2834
*/
2935
void analyze(String token, AnalyseResults results) {
30-
if (token.isBlank()) {
36+
if (token.isBlank() || IS_STACKTRACE_TOKEN.test(token)) {
3137
return;
3238
}
3339

‎application/src/test/java/org/togetherjava/tjbot/features/moderation/scam/ScamDetectorTest.java‎

Lines changed: 51 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,13 @@ void setUp() {
3636

3737
when(scamConfig.getSuspiciousKeywords()).thenReturn(Set.of("nitro", "boob", "sexy", "sexi",
3838
"esex", "steam", "gift", "onlyfans", "bitcoin", "btc", "promo", "trader", "trading",
39-
"whatsapp", "crypto", "^claim", "teen", "adobe", "hack", "steamcommunity",
40-
"freenitro", "^earn$", "^earning", ".exe$", "mrbeast"));
41-
when(scamConfig.getHostWhitelist()).thenReturn(Set.of("discord.com", "discord.media",
42-
"discordapp.com", "discordapp.net", "discordstatus.com", "thehackernews.com",
43-
"gradle.org", "help.gradle.org", "youtube.com", "www.youtube.com",
44-
"cdn.discordapp.com", "media.discordapp.net"));
39+
"whatsapp", "crypto", "^claim", "teen", "adobe", "^hack$", "hacks",
40+
"steamcommunity", "freenitro", "^earn$", "^earning", ".exe$", "mrbeast"));
41+
when(scamConfig.getHostWhitelist())
42+
.thenReturn(Set.of("discord.com", "discord.media", "discordapp.com", "discordapp.net",
43+
"discordstatus.com", "thehackernews.com", "gradle.org", "help.gradle.org",
44+
"youtube.com", "www.youtube.com", "cdn.discordapp.com", "media.discordapp.net",
45+
"store.steampowered.com", "help.steampowered.com", "learn.microsoft.com"));
4546
when(scamConfig.getHostBlacklist()).thenReturn(Set.of("bit.ly", "discord.gg", "teletype.in",
4647
"t.me", "corematrix.us", "u.to", "steamcommunity.com", "goo.su", "telegra.ph",
4748
"shorturl.at", "cheatings.xyz", "transfer.sh", "tobimoller.space"));
@@ -428,7 +429,25 @@ B2CWorkflow Builder (React Flow)
428429
https://cdn.discordapp.com/attachments/1234/5678/1.png?ex=688cd552&is=688b83d2&hm=5787b53f08a488a22df6e3d2d43b4445ed0ced5f790e4f6e6e82810e38dba2aa&
429430
https://cdn.discordapp.com/attachments/1234/5678/2.png?ex=688cd552&is=688b83d2&hm=5787b53f08a488a22df6e3d2d43b4445ed0ced5f790e4f6e6e82810e38dba2aa&
430431
https://cdn.discordapp.com/attachments/1234/5678/3.png?ex=688cd552&is=688b83d2&hm=5787b53f08a488a22df6e3d2d43b4445ed0ced5f790e4f6e6e82810e38dba2aa&
431-
https://cdn.discordapp.com/attachments/1234/5678/4.png?ex=688cd552&is=688b83d2&hm=5787b53f08a488a22df6e3d2d43b4445ed0ced5f790e4f6e6e82810e38dba2aa&""");
432+
https://cdn.discordapp.com/attachments/1234/5678/4.png?ex=688cd552&is=688b83d2&hm=5787b53f08a488a22df6e3d2d43b4445ed0ced5f790e4f6e6e82810e38dba2aa&""",
433+
"""
434+
I’ll help the first 10 interested people learn how to start earning over $100,000 within a week.
435+
You only send me 10% of your profits after you receive them.
436+
No pressure. No gimmicks. Just results.
437+
Send a friend request or DM me (HOW) on Telegram:
438+
@Joinna_Dwayno
439+
(Or use the link in my bio.)
440+
If you’re not serious, don’t message.""",
441+
"""
442+
I'll help the first 10 people interested on how to start earning $100k or more within a week, but you will reimburse me 15% of your profits when you receive it.
443+
Note: only interested people should send a friend request or send me a dm! ask me (HOW) via Telegram
444+
@laula_david2
445+
Or Click /use the the telegram link on my bio""",
446+
"""
447+
I’m looking for a couple of reliable people (🇺🇸) to help with simple recurring tasks. It’s only 1–2 hours of work per week, fully flexible on your schedule,
448+
and pays $150+ per month, with the potential to increase to $300+ later. If you’re interested in easy side income with minimal time commitment,
449+
send me a message💬 and I’ll share more details.
450+
WhatsApp: +12534267893""");
432451
}
433452

434453
private static List<String> provideRealFalsePositiveMessages() {
@@ -516,6 +535,30 @@ public static void main(String[] args){
516535
It was pretty pricey, and the costs likely differ a lot from country to country
517536
(keeping in mind that a portion is importing of equipment to NZ and some is labour in a very different market).
518537
We have 13.5KW of storage, a 10KW inverter, 11.5KW of generation and an EV charger.
519-
All up, on a 1% 'green loan', it was $40k NZD (~$23k USD)""");
538+
All up, on a 1% 'green loan', it was $40k NZD (~$23k USD)""",
539+
"https://store.steampowered.com/app/3176060/Emissary_Zero/",
540+
"https://store.steampowered.com/app/3028330/Battlefield_REDSEC/",
541+
"https://help.steampowered.com/en/faqs/view/49A1-B944-48B8-FF00",
542+
"https://store.steampowered.com/api/appdetails?appids=8930 this endpoint is so cool",
543+
"id play it if it was free maybe https://store.steampowered.com/app/1349230/5DChessWithMultiverseTime_Travel/",
544+
"Why wouldn't they just take the $150 and not bother hacking an account to get the petfood sent?",
545+
"""
546+
https://learn.microsoft.com/en-us/powershell/scripting/discover-powershell?view=powershell-7.5
547+
What makes PowerShell unique is that it accepts and returns .NET objects, rather than text.
548+
because of that, but well it says that it returns .NET objects not that the commands are from .NET,
549+
but well as i said i use cmd.exe because i do not know .NET nor powershell""",
550+
"""
551+
Exception in thread "ServerEntityWriterThread"
552+
java.lang.NoSuchMethodError: org.schema.game.common.controller.rails.RailRelation.isLocked()Z
553+
at org.schema.game.common.controller.rails.RailController.getDockedTag(RailController.java:2686)
554+
at org.schema.game.common.controller.rails.RailController.getTag(RailController.java:2652)
555+
at org.schema.game.common.controller.SegmentController.toTagStructure(SegmentController.java:2813)
556+
at org.schema.game.common.data.EntityFileTools.write(EntityFileTools.java:57)
557+
at org.schema.game.server.controller.GameServerController.writeEntity(GameServerController.java:2938)
558+
at org.schema.game.common.data.world.Sector.writeSingle(Sector.java:2570)
559+
at org.schema.game.common.data.world.Sector.writeEntity(Sector.java:2546)
560+
at org.schema.game.common.data.world.Sector.access$200(Sector.java:120)
561+
at org.schema.game.common.data.world.Sector$3.run(Sector.java:2665)
562+
at org.schema.schine.network.server.ServerEntityWriterThread.run(ServerEntityWriterThread.java:74)""");
520563
}
521564
}

0 commit comments

Comments
 (0)