audit-noise: distinguish brand-match hits from BARE_PUNYCODE audit trail

1070e77aeba043db0d48ac7ffd3a8e7a8613343e · 2026-05-12 18:54:56 -0700 · steve

Bug: tool was flagging every unfiltered suffix as a 'candidate' to add
to NOISE_PATTERNS, including BARE_PUNYCODE rows which are intentional
homoglyph-monitor logging (xn--srna-loa.nu, certsbridge.com etc).
Suppressing those would silence the audit trail.

Fix: parallel tally tracks SUBSTRING+TYPO hits separately from the raw
count. Candidate-suggestion at bottom only proposes suffixes that have
3+ REAL brand-match hits AND are not yet filtered. The top-N raw lists
relabeled from [candidate] -> [unfiltered] to remove the now-implicit
'should suppress' suggestion.

Also confirmed cumulative 0/180 v1 spot-checks (5.27h slice 2-3 #3,
0/10) and both watcher PIDs alive (brand-typo 56788, dashboard 15791).

Files touched

M audit-noise.js

Diff

commit 1070e77aeba043db0d48ac7ffd3a8e7a8613343e
Author: steve <steve@designerwallcoverings.com>
Date:   Tue May 12 18:54:56 2026 -0700

    audit-noise: distinguish brand-match hits from BARE_PUNYCODE audit trail
    
    Bug: tool was flagging every unfiltered suffix as a 'candidate' to add
    to NOISE_PATTERNS, including BARE_PUNYCODE rows which are intentional
    homoglyph-monitor logging (xn--srna-loa.nu, certsbridge.com etc).
    Suppressing those would silence the audit trail.
    
    Fix: parallel tally tracks SUBSTRING+TYPO hits separately from the raw
    count. Candidate-suggestion at bottom only proposes suffixes that have
    3+ REAL brand-match hits AND are not yet filtered. The top-N raw lists
    relabeled from [candidate] -> [unfiltered] to remove the now-implicit
    'should suppress' suggestion.
    
    Also confirmed cumulative 0/180 v1 spot-checks (5.27h slice 2-3 #3,
    0/10) and both watcher PIDs alive (brand-typo 56788, dashboard 15791).
---
 audit-noise.js | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/audit-noise.js b/audit-noise.js
index 631583e..ec6502a 100755
--- a/audit-noise.js
+++ b/audit-noise.js
@@ -27,49 +27,67 @@ if (!fs.existsSync(FILE)) {
   process.exit(2);
 }
 
+// Two parallel tallies:
+//   tally2/tally3   — every hit (raw audit view, includes BARE_PUNYCODE)
+//   brand2/brand3   — ONLY real brand-match hits (SUBSTRING/TYPO). These are
+//                     the ones worth proposing as NOISE_PATTERNS additions —
+//                     suppressing BARE_PUNYCODE rows would silence the
+//                     intentional homoglyph-monitoring audit trail.
 const tally2 = new Map();
 const tally3 = new Map();
+const brand2 = new Map();
+const brand3 = new Map();
 let total = 0;
+let totalBrand = 0;
 const lines = fs.readFileSync(FILE, 'utf8').split('\n').filter(Boolean);
 for (const ln of lines) {
   let r; try { r = JSON.parse(ln); } catch { continue; }
   const d = (r.domain || '').toLowerCase().replace(/^\*\./, '');
   if (!d) continue;
   total++;
+  const isBrandHit = r.matchType === 'SUBSTRING' || r.matchType === 'TYPO';
+  if (isBrandHit) totalBrand++;
   const parts = d.split('.');
   if (parts.length >= 2) {
     const s = parts.slice(-2).join('.');
     tally2.set(s, (tally2.get(s) || 0) + 1);
+    if (isBrandHit) brand2.set(s, (brand2.get(s) || 0) + 1);
   }
   if (parts.length >= 3) {
     const s = parts.slice(-3).join('.');
     tally3.set(s, (tally3.get(s) || 0) + 1);
+    if (isBrandHit) brand3.set(s, (brand3.get(s) || 0) + 1);
   }
 }
 
 const ranked2 = [...tally2.entries()].sort((a, b) => b[1] - a[1]).slice(0, TOP_N);
 const ranked3 = [...tally3.entries()].sort((a, b) => b[1] - a[1]).slice(0, TOP_N);
 
-console.log(`\n  audit-noise :: ${lines.length} hit rows  /  ${total} domain entries\n`);
+console.log(`\n  audit-noise :: ${lines.length} hit rows  /  ${total} domain entries  /  ${totalBrand} real brand-match hits (rest = BARE_PUNYCODE audit trail)\n`);
 console.log(`  top ${TOP_N} 2-label suffixes (registrable parent):`);
 console.log(`  ` + '-'.repeat(72));
 for (const [s, n] of ranked2) {
-  const flag = isFiltered(s) ? '\x1b[32m[filtered]\x1b[0m' : '\x1b[33m[candidate]\x1b[0m';
+  const flag = isFiltered(s) ? '\x1b[32m[filtered]\x1b[0m' : '\x1b[33m[unfiltered]\x1b[0m';
   console.log(`  ${String(n).padStart(5)}  ${s.padEnd(40)}  ${flag}`);
 }
 
 console.log(`\n  top ${TOP_N} 3-label suffixes (rolled-up subdomains):`);
 console.log(`  ` + '-'.repeat(72));
 for (const [s, n] of ranked3) {
-  const flag = isFiltered(s) ? '\x1b[32m[filtered]\x1b[0m' : '\x1b[33m[candidate]\x1b[0m';
+  const flag = isFiltered(s) ? '\x1b[32m[filtered]\x1b[0m' : '\x1b[33m[unfiltered]\x1b[0m';
   console.log(`  ${String(n).padStart(5)}  ${s.padEnd(40)}  ${flag}`);
 }
 
-const candidates = ranked2.filter(([s]) => !isFiltered(s) && tally2.get(s) >= 3);
+// Real candidates = BRAND-match suffixes only. BARE_PUNYCODE rows are the
+// intentional homoglyph-monitor audit trail and must not be suppressed.
+const ranked2Brand = [...brand2.entries()].sort((a, b) => b[1] - a[1]);
+const candidates = ranked2Brand.filter(([s]) => !isFiltered(s) && brand2.get(s) >= 3);
 if (candidates.length) {
-  console.log(`\n  candidate NOISE_PATTERNS to consider adding (≥3 hits, not yet filtered):`);
+  console.log(`\n  candidate NOISE_PATTERNS to add (≥3 real brand-match hits, not yet filtered):`);
   for (const [s, n] of candidates.slice(0, 10)) {
-    console.log(`    /\\.${s.replace(/\./g, '\\.')}$/i,    // ${n} hits`);
+    console.log(`    /\\.${s.replace(/\./g, '\\.')}$/i,    // ${n} brand-match hits`);
   }
   console.log('');
+} else {
+  console.log(`\n  no candidate NOISE_PATTERNS — all brand-match suffixes either filtered or <3 hits.\n`);
 }

← 0d22891 watch-outbound: extend INTEL allowlist with RIRs, CZDS, 2026 · back to Domain Sniper · brand-typo-watcher: docstring guards future-me against suppr c7ac9f6 →