Hi,

I see various connections from my system to 88.99.142.95 (the rspamd
home).

The https ones seem to be targeted at "maps.rspamd.com", which are used
by the default config to download various "map" files.

I'd feel safer if an independent cronjob would handle those (and maybe
even disable it by default), or maybe deploy through a separate package?
(No idea how often those are updated.)

Then there are UDP connections to port 11335, which probably comes from:

    servers = "round-robin:fuzzy1.rspamd.com:11335,fuzzy2.rspamd.com:11335";

in /etc/rspamd/modules.d/fuzzy_check.conf.

This module should imho be disabled by default, especially given there
is a "usage policy" connected to it:

https://rspamd.com/doc/usage_policy.html

cheers,
Stefan

rspamd default configuration file contains a set of RBL servers, links
to different phishing/spamming feeds, public ASN lookup server, fuzzy
hashes server, etc.

All the data is refreshed with regular intervals.

https://github.com/rspamd/rspamd/blob/master/conf/modules.d/rbl.conf
https://github.com/rspamd/rspamd/blob/master/conf/modules.d/phishing.conf
https://github.com/rspamd/rspamd/blob/master/conf/modules.d/asn.conf
https://github.com/rspamd/rspamd/blob/52a281c58f31ba48e1d365c1646321747be501ff/conf/modules.d/fuzzy_check.conf#L21