OK, OK... How about an "evilmulti" that included "unconfirmed", which would increase surbl's data size and processing-- having to build two multi lists, but would significantly reduce DNS query traffic since those using the "unconfirmed" list and the "multi" list could use a single query per URI instead of 2 per URI.
Bret
Sounds like a good compromise to me.... maybe call it unconfirmed_and_multi.surbl.org ??
Rob McEwen