[tor-relays] suspicious exit?

Hi All,

FP! :)

I just setup my relay node today, and am keeping a hawkish(ish) eye on traffic.... And noticed a flurry of activity from SSH port (22) at 5.104.224.5 - which is listed as an exit.

But it's also listed on http://cbl.abuseat.org/lookup.cgi?ip=5.104.224.5 as infected (or NATting for a computer that is infected) with the Conficker botnet.

I've black-holed it in the meantime, but am wondering if I'm being overly cautious...

Any advice/response/input appreciated.

TIA

Jeff.