Spam filter needs adjusting?

[blair]

I'm using the spam filter to automatically ban "known spammers"...

Action to take for Code 4

Code 4 is sent by the service if the account is a known spammer

Codes other than 4, I let register. It's worked pretty well. However, in the past couple of months, and more recently in the past couple weeks it seems more NON-spammers are getting banned. People are contacting us via our contact page, and Faceboook that they register but can't visit the site. Upon investigation it's because they've been automatically banned as a spammer.

It's seems to me if the criteria is "known spammer", the filters have to be tightened some. Currently there are too many false positives. If it's not adjusted I'll have to disable it.

[Biker.GA]

I've noticed this as well and have had to do some sleuthing to see if the ban was warranted or not. In a couple of cases, I've had to undo the ban because the service was a bit over zealous when the individual registered.

[blair]

I always felt that if there's one person contacting me with an issue, there are probably 10 others that don't bother. I really like the spam filter, and overall it does a good job. We just work too hard gaining new members to slam the door in their face once they register. There really isn't much tolerance for false positives (at least with code 4).

[Amy T]

I prefer using the stop forum spam site and compare all new members to the list on that site. It seems to be very accurate. Maybe the spam filter for IP.Board needs to see how they do it and make it like that.

[bfarber]

Known spammers are primarily determined by reports from sites using our spam service. If enough people report a user as a spammer, they get marked as a known spammer in our service. If you have trouble with individual members please do use the ticket system to report this to us so we can investigate. The possibilities are limited - either the user was considered as a spammer by individual sites enough times for our service to flag him as such, the user happened to obtain an IP address that was similarly marked as a spammer IP address, or the user was unfairly marked as a spammer on several sites (rather unlikely, but we would investigate to be sure).

[Mat Barrie]

I prefer using the stop forum spam site and compare all new members to the list on that site. It seems to be very accurate. Maybe the spam filter for IP.Board needs to see how they do it and make it like that.

Stop Forum Spam is a joke. It's based only on user reports, and doesn't have a single heuristic to speak of. It's as good as relying on Wikipedia as sources for a Bachelor's Degree thesis. It may be good as a part of your overall spammer research, but it's silly to rely entirely on it.

[Amy T]

Ya I still get a spammer that is not listed on that site but it took my spam down form 100s a day to 1 or 2 a day.

[blair]

If you have trouble with individual members please do use the ticket system to report this to us so we can investigate.

I will do. Expect a few tickets. ;)

...the user happened to obtain an IP address that was similarly marked as a spammer IP address...

I haven't investigated the IPs, but I do know this is a dangerous approach. Not only are shared IPs common on universities, but some countries like the Phillipines rely almost entirely on shared IP addresses. If you're familiar with Cloudflare, IP banning is one of their major downfalls.

[bfarber]

It takes more than one report before someone is considered a spammer. ;) However, realistically if 500 people say "a user at this IP with a variable name is spamming my site" it makes sense to block that IP for most other sites through any sort of spam service.

[Millipede]

It just reported my forum's co-owner as a probable spammer! I'm assuming this is based on his IP as he's a reputable businessman well-known in his area and certainly not a spammer. I'll use the ticket system too to report it.

[Mike Finn]

However, realistically if 500 people say "a user at this IP with a variable name is spamming my site" it makes sense to block that IP for most other sites through any sort of spam service.

I have had false positives all involving a dynamic AOL.com IP, 205.188.116.73. That seems to be a very active IP address. I have multiple members who drew that IP when making posts. Those unfortunate enough to draw it when trying to register find themselves banned simply because they drew a dynamic IP used by AOL user spammers.

I don't think the spam monitor service needs adjusting. But I do think we should have an additional feature where in our ACP we list problematic IP addresses and when one of those problem IP's are used to register, we could have an option to flag for manual administrator approval. In my case. it's easier to preview someone's registration than to deal with a member who found himself banned.

Our board focuses on our neighborhood and our members are my neighbors. Banning a neighbor automatically based on a dynamic IP doesn't make for cordial relations when I meet them in the neighborhood. They get the impression that I don't know what I'm doing running a forum.

[Millipede]

Our board focuses on our neighborhood and our members are my neighbors. Banning a neighbor automatically based on a dynamic IP doesn't make for cordial relations when I meet them in the neighborhood. They get the impression that I don't know what I'm doing running a forum.

This is very similar to our forum, which is regional in France and wouldn't interest most of the rest of the world. The dynamic IP in our case is one from a very commonly used French ISP so could, in theory, affect a large percentage of people who'd want to register.

[crabpaws]

Sorry, I'm new to this so I have to ask some newbie questions.

Where do I find code 2, code 3, code 4, etc.?

If I mark a registration as a spammer, why doesn't the IP go into the ban filter? Or should it and I missed a setting? Or is banning an IP not the way to ban a spammer (I look at Project Honeypot)?

My site is gaining traffic plus spammer IPs and a swarm of bots, I have to reduce that traffic.

[Mike Finn]

Where do I find code 2, code 3, code 4, etc.?

http://community.invisionpower.com/resources/documentation/index.html/_/documentation/administrator-control-panel/system-tab/system-settings/members-spam-service-r384

In your ACP under Admin CP --> System --> System Settings --> Members --> Spam Service

You will find the list of codes, their meanings and a drop down box to choose what action you want to be taken on each report code when it occurs.

[Millipede]

The spam service was new to me too and it wasn't till the other day that I found the spam service is dotted all over the ACP in various areas, which was when and where I found some valid registrations had got flagged.

Having set it up as Mike Finn mentioned, you'll also find a log of all registrations with their respective codes under System -> Tools and Settings -> Logs -> Spam Service Logs.

In Forums -> Statistics Center -> Spam Service, you can search for stats.

But it wasn't till I went to Members -> Manage Spam Members, that I saw that some genuine validating members had been flagged for "adminstrator review" and could unflag them.

I don't think there's any way of knowing if a registration has been flagged or not unless one checks some or all of the above. I wish there could be some form of notification, like in the notification emails of new registrations, to say a member's been flagged by the spam service so that we can take action without having to constantly check the ACP - unless I'm missing something?

[blair]

Or is banning an IP not the way to ban a spammer (I look at Project Honeypot)?

I really question the same. If so, the bar has to be set pretty high to avoid false positives for "known spammers".

How many of you have a static IP address? Most home users do not. Most of the countries where these spammers operate do not. What kind of self-respecting spam bot doesn't use a proxy?

[Misi]

What kind of self-respecting spam bot doesn't use a proxy?

:thumbsup:

[crabpaws]

The spam service was new to me too and it wasn't till the other day that I found the spam service is dotted all over the ACP in various areas, which was when and where I found some valid registrations had got flagged.

....

I don't think there's any way of knowing if a registration has been flagged or not unless one checks some or all of the above. I wish there could be some form of notification, like in the notification emails of new registrations, to say a member's been flagged by the spam service so that we can take action without having to constantly check the ACP - unless I'm missing something?

I had this set up, too -- I expected a "flag" would be a message of some sort. I didn't know I had to check Manage Spam Members until I read your post.