-----Original Message----- From: Scott A Crosby [mailto:scrosby@cs.rice.edu] Sent: Thursday, September 09, 2004 5:23 PM

We should be a bit more careful than this --- require that a new URL has to resolve to the same IP address as, say, at least 3 other SURBL entries before being automatically added on. Also, there should also be a list of IP's for which this automatic logic won't be triggered. This would be important for a poorly run but popular virtual server that's slow at kicking off spamvertized sites.

This really sounds a lot like how DCC (w/greylisting) works. Use the public DCC servers to post detection of these same IP URLs, and when its confirmed by enough sites, it triggers a big score.

<<Dan>>