Spam Defense - Email Blacklist Check

[Clover13]

A user messaged me via the Contact Form indicating they've tried to register and keep getting blocked from doing so.  Sure enough, the IPS Spam Defense logs have their email address listed as a level 4 "User is a known spammer" yet I Google their email address and get zero results.  Is there somewhere I can check the email address for spam/blacklisting?  I'm not sure if this is a legit user or truly a spammer.  The fact that they messaged me after 4 attempts to register seems to be an unlikely spammer.

FWIW, I did check on Stop Forum Spam and it seems like some level 4 blocks are listed there and some aren't.  If I do some Googling, at least one user appears to be legit and they attempted to register like 10 times.  Yikes, that's not good if this is blocking legitimate users.

https://www.stopforumspam.com/search

 

[bfarber]

We use stopforumspam as one signal out of many.

You can obviously look at SFS, email spam blacklists, and the like, and if you feel the user is legitimate then you can manually register their account. Typically if a user takes the time to reach out to you in this manner, it means they're serious about joining your site.

[Clover13]

SFS is the only tool I can find where I can look up an email address.  The rest of the blacklist checks are for server or IP.  I can run their IP used but it comes up clean.  How do I determine where or why this email was blocked?

[bfarber]

You can't, frankly. If they were blocked by our spam service, then they were blocked by our spam service and there is no where you can go to look this up or change it.

You can, however, whitelist their email address (and any others) in the AdminCP should you wish to do so. In the AdminCP under Members > Spam Prevention you can click the "Spam Defense Whitelist" button at the top right to do this.

[Clover13]

Thanks @bfarber

In these cases, I've now set the level 4 action to be manual review/approval so it comes up in the AdminCP dashboard and I can make a call on it versus them just being denied automatically.  It would be great if we could get a notification (email or otherwise) when these manual reviews/approvals are required.  I didn't see a setting for that, so I'm left with logging into the AdminCP and checking the dashboard periodically.

The other aspect is a user attempting to register may ask why they were blocked as a spammer and I don't have an answer for them or anywhere to send them for more information.  Another potential enhancement to IPS could be to add more information to the Spam Defense logs (whatever information your spam service used to identify the email address or IP they're registering from as a spammer).  Without that, I'm left with just saying "the forum software blocked you but I don't know why", which of course reflects poorly on the software and the site owner in the eyes of the user (assuming it's a false positive).

 

[bfarber]

Well, conversely, if we give out too much information about how blocks occur, real spammers will just find ways to work around our system. 😉 Unfortunately that's just not very likely to happen.

As of 4.4, the AdminCP notifications system allows you to request notifications of accounts pending approval.

[Clover13]

True, if your spam defense is utilizing custom methods for blocking.  I just figured it was using an aggregation of spam protection blacklists (similar to MxToolbox checking a host IP or hostname).

Good news on the notifications, will look at that when I upgrade to 4.4!

[bfarber]

20 hours ago, Clover13 said:

True, if your spam defense is utilizing custom methods for blocking.  I just figured it was using an aggregation of spam protection blacklists (similar to MxToolbox checking a host IP or hostname).

Good news on the notifications, will look at that when I upgrade to 4.4!

Our spam defense uses several external indicators (such as SFS and spam blacklists), but also uses the data gathered from communities using the service. We try to use as many signals as we can to piece together whether a user is a spammer or not.