Hi!
So basicly if you block with DSBL i dont see a point using this.
The point is that DSBLs have delays in getting new IPs listed, but the same URIs may tend to get advertised from fresh zombies. Therefore if we get the URIs we will catch spams even before the fresh zombie IPs get listed.
What delays? No more delays then XS also has with reloading the zonefiles. If there were noticable delays i would have seen hits would i?
I dont say XS is a bad idea, i just post what i have seen, its a test ...
:)
My test results are allmost below 0.... thats all.
The particular set of data currently in XS won't show much 0 hour spams because it's set so conservatively. It takes a lot of spams already seen to get included. What is more interesting to checking at this conservative setting is how spammy the URIs it detects are. When we crank down the settings and catch more URIs sooner, then we should catch more zero hour spams, including ones where the sender IPs don't show up on RBLs yet (because URIs likely change more slowly than sender IPs).
If thats raised i can test again, no problem at all, but the ammount of FP's is also high, disney cough cough ... :)
Bye, Raymond.