Here's some additional info on some of the recent sa-blacklist/ws.surbl.org/6dos goings on, copied from a message I sent to the SpamAssassin-users list:
1477667 Jun 21 18:48 /etc/spamassassin/RulesDuJour/blacklist.cf.20040623-0106 421286 Jun 21 18:49 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040623-0106 1459329 Jun 23 00:03 /etc/spamassassin/RulesDuJour/blacklist.cf.20040624-1602 415544 Jun 23 00:04 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040624-1602 1484137 Jun 24 15:48 /etc/spamassassin/RulesDuJour/blacklist.cf.20040627-0301 422228 Jun 24 15:49 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040627-0301 1559813 Jun 27 02:17 /etc/spamassassin/RulesDuJour/blacklist.cf.20040628-1544 443922 Jun 27 02:18 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040628-1544 5432965 Jun 28 15:25 /etc/spamassassin/RulesDuJour/blacklist.cf.20040628-1558 1544207 Jun 28 15:28 /etc/spamassassin/blacklist-uri.cf 7070231 Jun 28 15:54 /etc/spamassassin/blacklist.cf
I think I can help explain why sa-blacklist went from 1.5 MB to 5.5 MB in size suddenly. Chris Santerre added a fairly large set of records from 6dos (6 degrees of spam) around that time in order to get the records into ws.surbl.org and sa-blacklist. Chris, Bill and I then discussed this and decided to take them back out of sa-blacklist and therefore ws.surbl.org, and put the 6dos entries into its own SURBL instead.
However Bill's server experienced a hard disk problem around the same time so the entries have not come out of sa-blacklist yet. But they will come out once Chris gets access to Bill's server again. Until then, backing off to an earlier version of sa-blacklist makes perfect sense and it's what we've done for ws.surbl.org.
When Chris gets in again, he will get the 6dos entries off sa-blacklist, it will come back down in size, and I'll restore live feeds of ws.surbl.org from the sa-blacklist data instead of freezing it at the older version, as it is now.
Hopefully this makes some sense. If not I'll glady try to answer any questions or comments anyone has, though I'm not the original source of the changes.
Jeff C.