On 11/29/2011 10:27 AM, Rob McEwen wrote:
Instead, imo, the RBLs that you *do* need are the ones with (1) extreme few FPs and (2) which block spams that your other currently implemented RBLs are missing (particularly compared to those other RBLs w/extreme low FPs since RBLs with moderate-to-high FPs are either worthless, or can't be depended upon except for very low scoring... and that makes their unique "hits" not nearly as valuable as such hits are on a dependable low FP list).
I'm not really against a couple DNSBLs with high overlap either, these combine nicely in a scoring configuration.
I don't allow any single DNSBL to cause a block on it's own, but when two or three separately managed lists trip on the same IP, I take notice.
-- Dave Warren, CEO Hire A Hit Consulting Services http://ca.linkedin.com/in/davejwarren
