Integration with stopforumspam

[moonbeam]

Forum URL: notmsnmoney.proboards.com

Hi.

I seem to recall hearing that a new member's IP was checked against stopforumspam.com, and if it was found, that user wasn't allowed to continue the process.

However, I've seen a few recently that are getting through. These 3 are from yesterday:

lindalee

IP: 65.49.2.180
Decimal: 1093730996
Hostname: 65.49.2.180
ISP: Hurricane Electric
Organization: Sophidea
Services: Confirmed proxy server
Recently reported forum spam source. (3)
Type: Corporate
Assignment: Static IP
Blacklist:
Geolocation Information

Country: Anonymous Proxy

stopsforumspam says - Found 209 entries for "65.49.2.180"

---

charleswilliam
IP: 117.220.113.128
Decimal: 1977381248
Hostname: 117.220.113.128
ISP: BSNL
Organization: BSNL
Services: None detected
Type: Broadband
Assignment: Static IP
Blacklist:
Geolocation Information

Country: India in flag
State/Region: Rajasthan
City: Jodhpur


Only one entry on stopforumspam for this one.

---

chihuahua12

IP: 36.73.23.22
Decimal: 608769814
Hostname: 36.73.23.22
ISP: PT Telkom Indonesia
Organization: PT Telkom Indonesia
Services: None detected
Type:
Assignment: Static IP
Blacklist:
Geolocation Information

Country: Indonesia

6 entries on stopforumspam



Any ideas why this might occur? Thanks, as always!

[Michael]

I'm not exactly sure how our stopforumspam filter works, but I'm assuming that the number of entries matters. The first one you would have thought would have been caught? Either way, I'll draw our sysadmins attention to this.

[moonbeam]

Thanks, Michael.

[Martyn Dale]

An IP simply having stopforumspam entries doesn't automatically have it blocked for being a spammer. For instance some ISPs share IPs, and its possible to even forge data to send to SFS.

In the event we detect questionable activity from an IP, our system decides what to do with it. SFS is one of several metrics we use to gague that action. If an IP has a high spam rating on SFS and we have seen questionable activity, it is sure to be blocked.

At this point in time we do not however retroactively clear up actions by an IP as determining the legit and malicious uses of a given IP can be difficult, and it is preferable to have some spam postings live, than nuke an innocent users work.

A very low volume of spam activity gets through the system these days, most of that being posted by humans. We do revisit the algorithms every so often and adjust things based on what we have learned from the months prior.

Recently for example, we blocked the kitchen spammers. I noticed just last night in fact that they are still trying it, and are being blocked before a single post is made (though some user accounts do remain)

Once we are more confident that certain filters have never had false positives, we can be more confident in cleaning up some of their actions

[moonbeam]

Thanks, Martyn Dale. I just really couldn't remember what had been said about it before, so it was a curiosity question more than anything. We almost never get spam on our forum, but that's because we are suspicious of anyone in certain countries and deny them outright. We also deny most proxies, and anyone we find on SFS.