Ich checked both of my Exit nodes:
IP Address 91.219.238.107 is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet. <- uptime ~16 days
IP Address 84.201.38.234 is not listed in the CBL. <-- New node, uptime < 24hrs
>
This was detected by observing this IP attempting to make contact to a s_patcher Command and Control server, with contents unique to s_patcher C&C command protocols.
Not cool at all, let's see how the new node works out.
> I have been running a Tor exit node for only 2 days on a fresh IP address. However, that IP address is now blocked by spamhaus because it apparently tried to contact the Command and Control server of the "pony" malware:
>
> http://cbl.abuseat.org/lookup.cgi?ip=5.79.81.200
>
> Other node operators, could you please try your IP address? Perhaps this could explain the recent increase in connections?
>