blocklist-ipsets

For me personally, one of the most effective means of knocking out the first 95% of spam was using the S25R regex methodology [1] created by Asami Hideo which seems to keep the load on SpamAssassin and ClamAV really low. I've had to adjust the regex rules over the years a little bit but it's really low maintenance for my setup. There are also lists of IP addresses and networks you can block that are known to be malicious which also reduces the load and log volume. [2] [1] - http://www.gabacho-net.jp/en/anti-spam/anti-spam-system.html [No HTTPS, Sorry] [2] - https://github.com/firehol/blocklist-ipsets.git

For what it's worth, many of these IP addresses are listed in FireHol [1][2] The git repo is a clone and not the master so I would suggest a clone depth of 1. [1] - https://iplists.firehol.org/ [2] - https://github.com/firehol/blocklist-ipsets.git

Anti-malware don't like that IP. There is probably something more going on than just posing as github. VirusTotal [1] also has a couple findings. You could try calling their ISP's customer service in the off chance they may do something with it. That network also shows up in the firehol [2] blocklists so they may cycle their IP within that network to evade some anti-malware. I would wager they have many domains and IP addresses to choose from. grep -c "^115.111.91" 2>/dev/null *set | grep -E -v ":0$" cruzit_web_attacks.ipset:1 firehol_level4.netset:1 iblocklist_cruzit_web_attacks.netset:1 nullsecure.ipset:1 whois: organisation: ORG-TCL6-AP org-name: Tata Communications Limited country: IN address: Customer Service & Operations address: Plot Nos. C-21 & C-36 address: 'G' Bloc

That IP is in a subnet with many entries in the firehol [1] ip blocklist. That is a known spammer network. Spammers use data from search engines, chat rooms, irc logs and shodan [2] to find sites. There are many other sources. Has anyone ever mentioned your private mailing list URL's on a chat server? Specifically: grep -c "^91.90.120." * 2>/dev/null|grep -v ":0" firehol_abusers_30d.netset:6 stopforumspam.ipset:6 stopforumspam_180d.ipset:15 stopforumspam_30d.ipset:3 stopforumspam_365d.ipset:26 stopforumspam_7d.ipset:2 stopforumspam_90d.ipset:6 tor_exits_30d.ipset:1 [Revised after a git update] [1] - https://github.com/firehol/blocklist-ipsets.git [2] - https://www.shodan.io/

The IP's they list on that page are all listed in the netset/ipset files at firehol's ip blocklist [1] They are just open proxies. These files are explained on firehol's site. [2] Make sure your home routers admin interface is only listening on the LAN and not the WAN interface, as blocking scanners is an endless game of whack-a-mole. Another option to consider would be installing OpenWRT if your router model supports it. [3] Example: grep -E "45.155.205.86" *.ipset bi_any_0_1d.ipset:45.155.205.86 bi_badbots_0_1d.ipset:45.155.205.86 bi_bruteforce_0_1d.ipset:45.155.205.86 bi_ssh-ddos_0_1d.ipset:45.155.205.86 bi_ssh_0_1d.ipset:45.155.205.86 bi_sshd_0_1d.ipset:45.155.205.86 blocklist_de.ipset:45.155.205.86 blocklist_de_ssh.ipset:45.155.205.86 blocklist_de_strongips.ipset:45.155.205.86 bruteforceblocker.ipset:45.155.