Since spamhaus lookup are done using DNS queries, some of them result in NXDomains, which lead slips to tread every 10 failed lookup as DGA