Roger Dingledine arma@torproject.org wrote:
Typically the way these blocklists work is that they run "honey services" somewhere secret on the internet, often on ports like 80 that are different from the ones they will apply the blocklist to. And if anybody connects to their secret honey IP address on port 80, they call them a likely spammer and refuse to allow emails/etc to their other services from that address.
I don't think that it is the reason.
Most likely G-Core Labs received automatic abuse reports from hosts that complained that there were attempts to scan some website or brute force an SMTP relay.
Then they triggered the filtering in fear of being put in blacklists.