OK, OK... How about an "evilmulti" that included "unconfirmed", which would increase surbl's data size and processing-- having to build two multi lists, but would significantly reduce DNS query traffic since those using the "unconfirmed" list and the "multi" list could use a single query per URI instead of 2 per URI.
Bret ----------
Send your spam to: bretmiller@wcg.org Thanks for keeping the internet spam-free!