cron check reports false positives - email address matches 255 times

Hi,

The cron-induced check uses the 'Spammer criteria' from /admin/settings/spambot, so it might have triggered on IP address.

Maybe visit the 'Spam' tab of these user accounts and do a 'Check if this account matches a known spammer' to get some clues?

Cron-induced checking uses the same criteria as registration checks.

The IP addresses in the 'Spam' tab come from PHP sessions, ownership of comments, statistics module and user_stats.module (if present).

My guess is that 'Track page visits' uses different criteria and doesn't show all of these IP addresses. And 'Track page visits' data may expire as well.

The only way to find out would be to peer inside the database tables to see what's happening.

I've had a similar experience. Spambot, on the first cron run, claims that my *client's* email address is associated with spammer. When I click "Check if this account matches a known spammer", I get the reply "This account's email address matches 255 times". When I look for the email on stopforumspam.com, it comes up with nothing.

Needless to say, false positives are very alarming, especially when it is your client and an administrator of the site. Bumping priority to critical.

Spambot is doing a MARVELLOUS job stopping 95% of spam registrations and would block virtually all of them if I relaxed the threshold on number of reports in StopForumSpam.

I am seeing the same problem as reported in #4. When I did a scan of my user base today, two users were flagged as spammers. I went to their profile, clicked on the Spam tab and did a Spambot check on each user. Spambot reported 255 hits in StopForumSpam on the email address (neither of these users has logged in so there is no associated IP address or content). However, neither e-mail address shows up in the StopForumSpam database.

The problem is repeatable. The two users have sequential uids. Spambot is not reporting any problems with the users before or after the two false positives.

This latest description in comments 4 and 5 sounds like a different bug than the original post.

However ...

@mattgilbert, @nhoeller: Can you please have a look at your Drupal log messages and see if there are any relevant messages reported by spambot?

Hi,

This looks like a problem with the data returned by stopforumspam itself.

See http://www.stopforumspam.com/forum/viewtopic.php?id=5053

Please see the reply posted at http://www.stopforumspam.com/forum/viewtopic.php?id=5053 (post #2).

It's not a bug.

An match of 255 times indicates an email address that is not to be trusted.

<sarcasm> So i guess my client, a Harvard professor with a Harvard email address, is a comment spammer. Thanks for letting me know.</sarcasm>

Hi,

I'm only passing through the data from www.stopforumspam.com. If you disagree with it, please bring it up with them.

Thank you.

Yes, I know it has something to do on their end, not yours. Sorry, I shouldn't have been rude. I really appreciate your work on this module (and their work on the database). It has made many sites usable that would otherwise be overrun with spam.

Thank you.

Hi!

To clarify the forum post mentioned above: http://www.stopforumspam.com/forum/viewtopic.php?id=5053 (post #2) actually says:

It isn't a bug.
A reported value of "255" means that the email domain is recognised as "toxic" or as a disposable email service. The specific email address in question may or may not appear in the database, but by way of being attached to a disposable service is not expected to be owned by a legitimate user.
Hope that helps.

So, it is not the email address that is bad but the email domain.

I would like to request that a message be add when the number of results for an email address checked is 255 that says something like this:

This account's email address matches 255 times. 255 can also mean that the email domain is blacklisted: checked@emailaddress.com

This is more user friendly than having to come check the issue queue.

Thanks for your consideration of this feature request.

God Bless!

Frederick

Drupal 7 is long out of support and ticket has sat for many years with no patch