At 04:40 PM 8/2/2004, Pierre Thomson wrote:
Now I get the SURBL hits too... but not an hour ago! Maybe on weekends the updates get behind...

No, that's expected behavior. Someone always has to be the "first" one to get a spam.


SURBL, like razor, is a live-update system. New listings are added very rapidly, so from hour-to-hour the listed domains changes. If you're one of the first people to get a spam with a given spamvertized website in it before anyone has reported it, it obviously won't be in SURBL. An hour later, many people could have reported it, and it will be listed.

Pretty much all live update systems work well, but they can't get all of the "first wave" of a particular signature/ip/domain/whatever. It's all a matter of the difference in timing between when it was reported and when you got the message.

There's also a matter of if the spam hit any automated spamtraps, or only hit addresses that have manual reporting. Manual reports generally have a much higher latency. A spam hitting a large number spamtraps will get listed pretty quickly after it was sent. One that ends up depending on manual reports may take several hours.





Reply via email to