On Friday, September 10, 2004, 9:00:16 AM, Pete McNeil wrote: > On Friday, September 10, 2004, 10:43:39 AM, Jeff wrote:
JC>> What I'm talking about is an internal process where we keep track JC>> of resolved IP addresses and use that to add new domains to JC>> SURBLs sooner if they resolve to a similar IP range (probably JC>> /24s). We would use the resolved IP addresses to add domains JC>> to sc.surbl.org and possibly other lists sooner. Most would JC>> probably get added on the first report. :-) > I recommend a bit of caution on this point. My preliminary data on > using /24s to drive recursive domain additions is that it is prone to > false positives - The network surrounding a given web host is > frequently populated with non-spam servers it seems... at least > frequently enough that it's a challenge to generalize in this way. Hi Pete, Thanks for your comments. By "recursive domain additions" to you mean to initiate a proactive search of domains within a given network? What I'm proposing is not to actively try to search, but simply to bias the inclusion of domains that are *actually reported to us as being in spams*. Hopefully my description of the difference makes some sense and it can be seen why the potential for false inclusions might be lower when the space is *actual spam reports*, and not the space of all domains hosted in nearby networks. Jeff C.
