Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

UCEPROTECT: PInk Meat?

356 views
Skip to first unread message

gkarasik

unread,
May 8, 2009, 2:19:11 PM5/8/09
to
Hi,

After a week of not hitting spamtraps and waiting until this morning
when my client's listing was supposed to be removed, I now see a new
Level 1 block called "Pink Meat: *Pink Meat can't be removed because
they are part of a current spamrun"

I can't find any information on this? Can you tell me what it means?

GaryK

--
Comments posted to news.admin.net-abuse.blocklisting
are solely the responsibility of their author. Please
read the news.admin.net-abuse.blocklisting FAQ at
http://www.blocklisting.com/faq.html before posting.

Claus v. Wolfhausen

unread,
May 8, 2009, 5:57:15 PM5/8/09
to
gkarasik wrote:


> After a week of not hitting spamtraps and waiting until this morning
> when my client's listing was supposed to be removed, I now see a new
> Level 1 block called "Pink Meat: *Pink Meat can't be removed because
> they are part of a current spamrun"
>
> I can't find any information on this? Can you tell me what it means?
>

That is nothing to worry about, it is in your case a display failure
only and you have caused it by doing queries at the expected exiration time.

Our website is looking up to 2 sources to find out if an IP is listed:

1. DNS (cached for a maximum of 60 minutes)
2. Centerdatabase (Live request)

If an IP exists in the DNS but not in the downloadable Zonefiles then
this is regularly a sign of it got listed within the last hour, because
downloadable Zones are build once per hour, but DNS is rebuild
permanently to cover fresh spammers as fast as possible.

Normally it takes between 1 minute to 5 minutes for new spammers to end
up in our DNS. We are calling those spammers "frehs meat":-)

If you are waiting for an automatic expiration and testing a still
listed IP within that time between new blacklist-files are build and
distributed to all our mirrors out there then you are feeding it into
the Website's DNS-Cache.

Result: Your IP is still in the DNS-Cache of the website but no longer
in the Centerdatabase resulting in exactly what you have seen.

So sorry for the wrong display - I can assure you that your IP
173.8.137.169 is no longer listed at Level 1.

If you wouldn't have got panic and tested your IP an hour later you
would have found that it is out of Level 1.

See: http://www.uceprotect.net/rblcheck.php?ipr=173.8.137.169

--
Claus von Wolfhausen
Technical Director
UCEPROTECT-Network
http://www.uceprotect.net

Chris Witkowski

unread,
May 8, 2009, 5:56:50 PM5/8/09
to
"gkarasik" <gkar...@fea.net> wrote in message news:a1bfe1c7-57fe-494c...@d38g2000prn.googlegroups.com...

> Hi,
>
> After a week of not hitting spamtraps and waiting until this morning
> when my client's listing was supposed to be removed, I now see a new
> Level 1 block called "Pink Meat: *Pink Meat can't be removed because
> they are part of a current spamrun"
>
> I can't find any information on this? Can you tell me what it means?

You're kidding, right?

It's been a few decades since I opened up a can, but, as best as I can
recall, it was pink. Hint: http://www.ncf.ca/~ab234/spam.mp3.
--
Christopher Witkowski chr...@ncf.ca http://web.ncf.ca/chrisw
Ph: (705) 256-5359

gkarasik

unread,
May 9, 2009, 4:17:49 PM5/9/09
to
On May 8, 2:56 pm, "Chris Witkowski" <chr...@ncf.ca> wrote:
> "gkarasik" <gkara...@fea.net> wrote in messagenews:a1bfe1c7-57fe-494c...@d38g2000prn.googlegroups.com...

Nope, was not kidding. Didn't know what it meant when the database
query came back with the IP still listed and called Pink Meat when it
was supposed to be delisted and there was no information to tell me
exactly what that meant or how long it was going to be listed or how
to get delisted. Now I do thanks to the explanation from Claus.

Live long and prosper.

GaryK

gkarasik

unread,
May 9, 2009, 5:18:40 PM5/9/09
to
On May 8, 2:57 pm, "Claus v. Wolfhausen" <use-reply-to-mail...@remove-
> UCEPROTECT-Networkhttp://www.uceprotect.net

>
> --
>         Comments posted to news.admin.net-abuse.blocklisting
>         are solely the responsibility of their author.  Please
>         read the news.admin.net-abuse.blocklisting FAQ at
>        http://www.blocklisting.com/faq.htmlbefore posting.

Thanks for the explanation.

GaryK

0 new messages