Ryan Thompson wrote to Jeff Chan and SURBL Discussion list on Tue, Dec 7th...:
If I find anything interesting, I'll report back.
Ok, thankfully, nothing *too* interesting. :-) Out of the few thousand messages we processed during those hours (10:15GMT - 13:22GMT; early in the morning for us), about ten of them had URIBL hits on at least one of the domains in Jeff's last message, and all ten of them were obvious spam. Our other rules seemingly came to the rescue to separate the wheat from the chaff. This is precisely why I like rules from multiple sources/technologies. :-)
I don't have an easy way to tell if anything scored as _nonspam_ hit the whitelisted entries[1], but that's not a concern, because anything under 7.0 points was already delivered normally.
[1] We don't include SA reports with nonspam, of course, so, it's possible to see if the SC_URIBL rule hit, but it isn't possible (without re-checking each message *against a modified SC blocklist with the bad data included*) to see if the URIBL rule hit one of the domains in question. And, anyway, for reasons discussed above, this would be for academic reasons only. :-)
Thanks again, Jeff. This would have taken a lot longer (and resulted in further delayed mail delivery if there were any FPs) without the timeline and domains you provided.
- Ryan