On Friday, September 10, 2004, 9:00:16 AM, Pete McNeil wrote:
On Friday, September 10, 2004, 10:43:39 AM, Jeff wrote:
JC>> What I'm talking about is an internal process where we keep track JC>> of resolved IP addresses and use that to add new domains to JC>> SURBLs sooner if they resolve to a similar IP range (probably JC>> /24s). We would use the resolved IP addresses to add domains JC>> to sc.surbl.org and possibly other lists sooner. Most would JC>> probably get added on the first report. :-)
I recommend a bit of caution on this point. My preliminary data on using /24s to drive recursive domain additions is that it is prone to false positives - The network surrounding a given web host is frequently populated with non-spam servers it seems... at least frequently enough that it's a challenge to generalize in this way.
Hi Pete, Thanks for your comments. By "recursive domain additions" to you mean to initiate a proactive search of domains within a given network? What I'm proposing is not to actively try to search, but simply to bias the inclusion of domains that are *actually reported to us as being in spams*.
Hopefully my description of the difference makes some sense and it can be seen why the potential for false inclusions might be lower when the space is *actual spam reports*, and not the space of all domains hosted in nearby networks.
Jeff C.