--- a/example.conf	Sun Sep 06 22:02:54 2009 +0300
+++ b/example.conf	Sun Sep 06 22:07:22 2009 +0300
@@ -58,7 +58,7 @@
 
 ## How many "hits" the IP needs until it is eligible to be filtered.
 ## (the "hits" can be from any check, e.g. sshd crack, httpd, etc.)
-FILTER_THRESHOLD = 3
+FILTER_THRESHOLD = 5
 
 ## Weeding threshold in hours. Entries older than this will be removed
 ## off from current netfilter settings. Also, entries older than this
@@ -202,7 +202,7 @@
 ## Number of hits required before host IP goes to submission queue.
 ## This setting is independent of the general THRESHOLD value and
 ## only affects DroneBL submissions.
-DRONEBL_THRESHOLD    = 5
+DRONEBL_THRESHOLD    = 3
 
 ## Maximum age of hits counted towards DroneBL submission threshold.
 ## NOTICE! Value this is in _minutes_!

--- a/maltfilter	Sun Sep 06 22:02:54 2009 +0300
+++ b/maltfilter	Sun Sep 06 22:07:22 2009 +0300
@@ -34,7 +34,7 @@
   "SYSACCT_MAX_UID"     => 999,
 
   "FILTER"              => 0,
-  "FILTER_THRESHOLD"    => 3,
+  "FILTER_THRESHOLD"    => 5,
   "FILTER_MAX_AGE"      => 168,  # in hours
   "FILTER_TARGET"       => "DROP",
   "FILTER_CHAIN"        => "INPUT",
@@ -59,7 +59,7 @@
   "EVIDENCE_DIR"        => "",
 
   "DRONEBL"             => 0,
-  "DRONEBL_THRESHOLD"   => 5,
+  "DRONEBL_THRESHOLD"   => 3,
   "DRONEBL_MAX_AGE"     => 30, # in minutes
   "DRONEBL_RPC_URI"     => "http://dronebl.org/RPC2",
   "DRONEBL_RPC_KEY"     => "",