On Wed, Aug 26, 2026 at 10:25:16PM +0200, Ralph Seichter via mailop wrote:
> * Atro Tossavainen via mailop:
>> If the machine actually sent spam, there's a possibility those who
>> collect spam have a copy. But it's damn hard to look for it when you
>> don't know what you're looking for. As Michael Peddemors said...
> Alright, I can take a hint. ;-) The affected IPv4 address is 95.216.145.1
> (owned by Hetzner).
Hetzner has an elaborate filtering and monitoring system in place on its
customer servers to prevent abuse. Those which seem relevant here are that
servers are effectively directly plugged into a router[0] and cannot use IP
addresses not assigned to them, and outgoing port 25 is blocked by default
and is only lifted on request.
I see a handful of possibilities here for how your machine ended up on
Spamhaus CSS.
The one I'm inclined to believe most is that Spamhaus is in error. Spamhaus
CSS is not manually curated like their other lists but "based on a wide
range of inputs, and always the result of multiple events and heuristics".
As per the standard CYA disclaimer we see everywhere today, "AI may make
mistakes".
If the listing is *not* in error, this means that at least one TCP three-way
handshake really did succeed and actual spam was sent.
Given Hetzner's filtering, it would not have come from some other customer,
nor from your server unless you had lifted the block. I suggest you do a
quick `telnet some.smtp.server 25` from it to see if the connection
succeeds. If it does yet you haven't asked Hetzner to lift the block, that
might suggest that your Hetzner account is itself compromised along with the
server.
Otherwise, the spam source IP was forged, but in that case it would involve
something like a BGP hijack. That sort of thing is extremely obvious and
somebody doing that wouldn't just stick to your server's IP address but
forge spam from all over Hetzner address space to get the biggest bang for
their effort.
A BGP hijack is very unlikely. For a while it was relatively common and it
is still a thing today, but reputable ISPs (stop tittering at the back) have
finally gotten around to not doing the BGP equivalent of running an open
mail relay.
[0] I don't know the exact implementation details, just how it appears from
the customer side. I expect managed switches and 802.1q is involved
somewhere since we're surely not getting a router port each.
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
