← back to Domain Sniper

brand-typo-watcher: suppress known-noise patterns (Let's Encrypt + Beutl)

549f3fbc2210f9f718cadb1ee3c3237c957ab50e · 2026-05-12 17:24:06 -0700 · steve

209 hits over the last ~50min of firehose audit: 206 were
*.haplorrhini.com (LE internal HTTP-01 challenge subdomains) and 3 were
audiobookshelf.beutl.in (legit Beutl app, Levenshtein-2 collision with
'butlr'). Zero real squats. Added NOISE_PATTERNS array + isKnownNoise()
filter so these drop before matchBrand/notify/logHit. Adds noise= column
to minute summary so the noise rate stays visible.

Also logged 3.74h slice 6-7 FRESH datapoint: 0/10. 80% of batch (40 of
50 baits) now DoH-checked at least once with zero confirmed snipes.

Files touched

• M brand-typo-watcher.js

Diff

commit 549f3fbc2210f9f718cadb1ee3c3237c957ab50e
Author: steve <steve@designerwallcoverings.com>
Date:   Tue May 12 17:24:06 2026 -0700

    brand-typo-watcher: suppress known-noise patterns (Let's Encrypt + Beutl)
    
    209 hits over the last ~50min of firehose audit: 206 were
    *.haplorrhini.com (LE internal HTTP-01 challenge subdomains) and 3 were
    audiobookshelf.beutl.in (legit Beutl app, Levenshtein-2 collision with
    'butlr'). Zero real squats. Added NOISE_PATTERNS array + isKnownNoise()
    filter so these drop before matchBrand/notify/logHit. Adds noise= column
    to minute summary so the noise rate stays visible.
    
    Also logged 3.74h slice 6-7 FRESH datapoint: 0/10. 80% of batch (40 of
    50 baits) now DoH-checked at least once with zero confirmed snipes.
---
 brand-typo-watcher.js | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/brand-typo-watcher.js b/brand-typo-watcher.js
index 774282c..83e5128 100644
--- a/brand-typo-watcher.js
+++ b/brand-typo-watcher.js
@@ -31,6 +31,15 @@ const HITS_LOG = path.join(DATA_DIR, 'brand-typo-hits.jsonl');
 const MAX_DISTANCE = parseInt(process.env.MAX_DISTANCE || '2', 10);
 const NOTIFY = process.env.NOTIFY !== '0';
 
+// Known-noise domain patterns — suppressed from hit-counter, notification, and JSONL log.
+// These are catalogued false positives from real CT firehose runs; add new ones here as they
+// emerge to keep the signal-to-noise ratio honest. Audit at: data/brand-typo-hits.jsonl.
+const NOISE_PATTERNS = [
+  /\.haplorrhini\.com$/i,         // Let's Encrypt internal HTTP-01 challenge subdomains
+  /\.beutl\.in$/i,                // Beutl video-editor app — Levenshtein-2 collision with "butlr"
+];
+function isKnownNoise(d) { return NOISE_PATTERNS.some((r) => r.test(d)); }
+
 const BRAND_KEYWORDS = (
   process.env.BRAND_KEYWORDS ||
   [
@@ -118,7 +127,7 @@ function notify(title, msg) {
   } catch {}
 }
 
-let count = { seen: 0, hits: 0, substring: 0, typo: 0, puny: 0 };
+let count = { seen: 0, hits: 0, substring: 0, typo: 0, puny: 0, noise: 0 };
 const perLog = {}; // log_name -> { fetched, x509, precert, emitted }
 function ts() { return new Date().toISOString(); }
 
@@ -132,6 +141,7 @@ function handleCertEvent(msg) {
   const domains = (msg.data && msg.data.leaf_cert && msg.data.leaf_cert.all_domains) || [];
   for (const d of domains) {
     count.seen++;
+    if (isKnownNoise(d)) { count.noise++; continue; } // drop without further work
     const m = matchBrand(d);
     const puny = isPunycode(d);
     if (puny) count.puny++;
@@ -203,7 +213,7 @@ function connect() {
 }
 
 setInterval(() => {
-  console.error(`[${ts()}] seen=${count.seen} hits=${count.hits} (substring=${count.substring} typo=${count.typo}) puny=${count.puny}`);
+  console.error(`[${ts()}] seen=${count.seen} hits=${count.hits} (substring=${count.substring} typo=${count.typo}) puny=${count.puny} noise=${count.noise}`);
   const logs = Object.keys(perLog).sort();
   if (logs.length) {
     const parts = logs.map((l) => {

← 49089a1 package.json: wire npm scripts for inspect + drops:list + dr  ·  back to Domain Sniper  ·  honeypot: 3.87h full 50-bait check — 0/50 across all 5 bucke 7b71df7 →