Spammers could add some fake URIs like yahoo.com, gmail.com, microsoft.com to their spam runs so that their mails get a hammy score(if surbl gives a negative score using some whitelisted URIs).
We don't use any negative scores anywhere. Our internal whitelist is only used to exclude domains from blacklisting.
ok. so the idea is to have grey scores instead if listed or unlisted, so that a bigger score means the URI is found in a lot of spam runs, while lesser score means the URI isn't so prevalent?
-- skar.