I see where you write out the ip downloads from the threat list to the lookup files, but do not see where you are storing the urls, looks like in an index, any specific reason why the index and not a lookup file?.
