At 22:14 2004-07-18 +0200, Raymond Dijkxhoorn wrote:
I picked the 10 most recently reported domains to the SC blocklist and manually checked what dns servers they used, and if the IPs for those dns servers where already listed in SBL. For 9 out of 10, they where. Data included below.
But those are also in SURBL, except one, but that one isnt active anymore. So for me, i would save the resolving and use SURBL for now :)
They are in SURBL now, but where they when the first spam run using those domains started? I see a few spam (not many, but more than I would like...) getting under the SURBL radar daily, using new domains that are not reported/listed until a few hours later. The point is that the IPs for the NS records had been listed in SBL for quite some time before the domains even showed up in spam.
Very fresh example: instantbodyhealer.com Not listed in any SURBL list at the moment. NS servers IPs listed in SBL since May 2nd.
Its however a nice addon to what SURBL does, it goes 2 steps further, but it also more expensive on busy servers to do many more lookups and resolving....
As the SBL catches the first run of the "new domain of the day" from certain domain morphing spammers that isn't caught by SURBLs, I can live with some extra dns lookups and potential time-outs.
But I agree, they are complementary.
Patrik