Truncate
How IPs are Removed
IPs are removed from this list automatically and there is no provision for manual removals. The IPs on the Truncate blacklist are not stored in a conventional database. Instead, the statistics that drive the Truncate blacklist are gathered in near-real-time from systems that use Message Sniffer spam and virus protection. Message Sniffer uses a collaborative machine learning system to rapidly build IP reputations. The Truncate blacklist gets it's data by monitoring the "conversations" between thousands of these systems as they share information about the IPs that send messages through them.
IPs are generally removed from this list as the statistical data supporting the IPs reputation ages. Every 24 hours (at minimum) the "good" and "bad" message counts for an IPs reputation are divided by 2. This reduces the confidence figure for the statistics over time without changing the predicted probability of receiving spam or malware from the IP. As a result any new events that are recorded tend to have an enhanced impact on the reputation for a given IP so that any "good" events become more likely to cause the IP to be removed from this list.
If no further events for the IP are recorded then the confidence figure will eventually drop to a point where the IP is no longer listed. In most cases this happens within a day or two. However, if the event was severe and a large number of "bad" messages were detected then it may take a week or more for an IP to be "forgotten".