Blocking scanning bots like stretchoid, deepfield...etc

NLUSER

(Search in the forums but can’t find anything.)
How do you manage (/handle) scanning bots like stretchoid, deepfield…etc
I do not like to find these sniffing ip’s in the postfix logs 200+ every day!

I use a fail2ban regex rule to block them:
connect from .*.(deepfield.net|stretchoid.com|censys-scanner.com|shadowserver.org)[[0-9a-fA-F.:]+]

Any thoughts on this?

esackbauer

200+? For so few entries I would not do anything.
That being said, try to use blocking mechanisms like abuseipdb.net or crowdsec (search forum).

NLUSER

esackbauer
Don’t want to use unsupported / old GitHub scripts.
I only have about 10 mailboxes with little traffic, since i use the above fail2ban regex rule there not appear in the logs anymore :-) !!!

esackbauer

NLUSER Don’t want to use unsupported / old GitHub scripts.

abuseipdbnet integration is neither “old” nor “unsupported”. It’s supported by the active community.