Loren Wilton wrote: > Since you are using spamcop, I'd guess you could drop sc_top200. I > think those two are related.
Not related, sc_top200 is the top 200 senders of spam based on IP address, targetting recent hijacked high utilized pc's for spamming. The list is generated from the Top 200 spam ip's at the SpamCop.net website. I wrote a script to pull those off and create simple but low memory usage ruleset to catch all 200 ip's in about 10-15 rules. It's updated each time I update my rules, so some days it's multiple times a day, other times it's not for a few days. The other spamcop_uri plugin is targetting spamvertised URL's found to be in spam messages. Some rare spams have no url and only advertise a phone number or other method of delivery (reply via e-mail).
