For what it's worth, most of the URLs hitting SURBL in my ham are spam URLs anyway.

On Saturday, 140 messages hit BE or WS SURBL out of 14971 total ham in my corpus.

Retesting those 140 messages now, only 105 messages hit, so you've probably removed some domains since Friday. Hopefully, because they're not spamming domains.

In those 105 messages, there were about 123 hits (40 when looking for unique domain-rule pairs) on 34 different domains as follows:

count domain rule 80 xxxxx.xxx URIBL_WS_SURBL 3 xxxxxxxxxx.xxx URIBL_WS_SURBL 2 xxxxxxxxx.xxx URIBL_WS_SURBL 2 xxxxxxxxxxxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxxx.xxx URIBL_BE_SURBL 1 xxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxx.xxx URIBL_BE_SURBL 1 xxxxxxxxxxxxxxx.xxxx URIBL_WS_SURBL 1 xxxxxxxxxxxxxxx.xxxx URIBL_BE_SURBL 1 xxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxx.xxx URIBL_BE_SURBL 1 xxxxxxxxxxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxxxxxxxxx.xxx URIBL_BE_SURBL 1 xxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxx.xxx URIBL_WS_SURBL 1 xxxx.xxx URIBL_BE_SURBL 1 xxxxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxxx.xxx URIBL_BE_SURBL 1 xxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxxxxx.xxx URIBL_WS_SURBL 1 x-xxxxxx.xxx URIBL_BE_SURBL 1 xxxxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxxxxxxx.xxx URIBL_WS_SURBL 1 xxxxxxxxxxx.xxx URIBL_WS_SURBL 1 xx-xxxxxx-xxxxxxxxxx.xxx URIBL_WS_SURBL

Most of them look like spam domains.