On Monday, July 26, 2004, 9:13:16 AM, Fred Fred wrote: > Loren Wilton wrote: >> Since you are using spamcop, I'd guess you could drop sc_top200. I >> think those two are related.
> Not related, sc_top200 is the top 200 senders of spam based on IP address, > targetting recent hijacked high utilized pc's for spamming. The list is > generated from the Top 200 spam ip's at the SpamCop.net website. I wrote a > script to pull those off and create simple but low memory usage ruleset to > catch all 200 ip's in about 10-15 rules. It's updated each time I update my > rules, so some days it's multiple times a day, other times it's not for a > few days. > The other spamcop_uri plugin is targetting spamvertised URL's found to be in > spam messages. Some rare spams have no url and only advertise a phone > number or other method of delivery (reply via e-mail). Right. sc_top200 would be a partial replacement for bl.spamcop.net, SpamCop's sender blocklist. In some ways sc_top200 is better since it's filtered to get only the biggest spamming senders as far as can be determined from SpamCop reports. Both the list and ruleset operate on message headers (envelope senders). SURBLs, spamcopuri, urirhsbl, etc. operate on message bodies, looking for spammy URIs mentioned in them. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
