First thing to do? Full security audit on your server, as well as the router in front of it.
You can of course explicitly block traffic at your router from that IP, but even better to trigger an alert if unexpected traffic is sourced from that IP.
(In theory, there are ways for other IPs on your network to hijack that IP, but this is VERY unlikely.. )
But if you get on an RBL listing, you should take it seriously. BTW, on this list it helps if you provide the actual IP address in question.
On 2026-08-26 06:02, Ralph Seichter via mailop wrote:
My ISP notified me that an IPv4 address assigned to one of my servers is listed on Spamhaus. This came as a big surprise, because the server in question is not set up to send mail to the outside world. The occasional cron job report is forwarded to another server of mine, but that happens over via private network connection (vSwitch), and only to a fixed recipient mail address. The listed server has been chugging along for more than a year in this configuration. Logs show nothing out of the ordinary. This leads me to wonder how a Spamhaus CSS listing could occur? The explanatory text is not too helpful: Your IP address is either exhibiting suspect behavior, is misconfigured, or has a poor sending reputation. As a result, this IP is listed in the CSS Blocklist (CSS). I tried to initiate Spamhaus' delisting process, but that attempt gets stuck on step 2 "Troubleshooting PTR and HELO issues". Possibly because the server does not even listen on TCP port 25, I guess. If you have ideas about what may have caused the CSS listing, or suggestions about how to proceed with delisting, I'd appreciate you sharing your thoughts. Thanks. -Ralph _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
-- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
