# Linode box listed in spamhaus blacklist

**URL:** <https://discourse.mailinabox.email/t/linode-box-listed-in-spamhaus-blacklist/464>\
**Category:** Help with Setup/Upgrade\
**Created:** [May 10, 2015, 3:43pm UTC](https://discourse.mailinabox.email/t/linode-box-listed-in-spamhaus-blacklist/464 "2015-05-10T15:43:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![l1cache](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/l/919ad9/32.png) [@l1cache](https://discourse.mailinabox.email/u/l1cache)\
**Post date:** [May 10, 2015, 3:43pm UTC](https://discourse.mailinabox.email/t/linode-box-listed-in-spamhaus-blacklist/464/1 "2015-05-10T15:43:48Z")

</div>

Hi,

I’ve been running mail in a box on linode for around a month now. Today there was a status change notification about the ip address being added to spamhaus blacklist: [http://www.spamhaus.org/query/ip/213.52.130.213](http://www.spamhaus.org/query/ip/213.52.130.213)

What can I do to get my ip removed from the blacklist? I’ve raised a support ticket with linode. They replied asking me to investigate why the ip was blacklisted.

---

<div class="post-metadata">

**Author:** ![mrcbrown](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/mrcbrown/32/428_2.png) [@mrcbrown](https://discourse.mailinabox.email/u/mrcbrown)\
**Post date:** [May 10, 2015, 5:27pm UTC](https://discourse.mailinabox.email/t/linode-box-listed-in-spamhaus-blacklist/464/2 "2015-05-10T17:27:01Z")

</div>

Is this for your internal use? or are you using this as a service for customers who you can’t 100% monitor?

Only other issue I could suggest is to any computers connecting (smartphones too) run some sort of Anti-Virus program, check for malware too, some viruses are smart and can piggy back on various apps.

Logs would be a great place to start, look through the mail.log and mail.err files in /var/log - would give you some history of what your box is sending out, may find a compromised workstation, or someone using an account that had a weak password and thus someone brute forced it and are blasting spam.

Password changes would be a great safe spot to start. Linode crew is awesome, just be polite, ask questions not accusations and they’ll help best they can but as it’s your management, they will point back to YOU being the primary issue, but some support crew is awesome and happily help when and where time allows - be humble, goes a long way with highly under appreciated staffers handling tickets.

---

<div class="post-metadata">

**Author:** ![l1cache](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/l/919ad9/32.png) [@l1cache](https://discourse.mailinabox.email/u/l1cache)\
**Post date:** [May 11, 2015, 5:35am UTC](https://discourse.mailinabox.email/t/linode-box-listed-in-spamhaus-blacklist/464/3 "2015-05-11T05:35:08Z")

</div>

This is for my personal use. Only I have access to the box (unless the box is compromised). auth.log shows brute force attempts to break into the box. However I’ve disabled password login and only 1 user can login to the box. Looking at the output of “sudo last -n 100” I do not see any suspicious logins.

I’ve looked at the outgoing email addresses in /var/log/mail.log (sudo grep -o ‘to=\<.\*\>,’ /var/log/mail.log|sort|uniq) and all the addresses are my contacts.

Btw I am having trouble understanding the contents of [http://www.spamhaus.org/sbl/query/SBL255928](http://www.spamhaus.org/sbl/query/SBL255928). The page says 213.52.128.0/22 has been blocked. Is it possible the subnet is blocked because of other hosts in the subnet?

---

<div class="post-metadata">

**Author:** ![mrcbrown](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/mrcbrown/32/428_2.png) [@mrcbrown](https://discourse.mailinabox.email/u/mrcbrown)\
**Post date:** [May 11, 2015, 4:54pm UTC](https://discourse.mailinabox.email/t/linode-box-listed-in-spamhaus-blacklist/464/4 "2015-05-11T16:54:48Z")

</div>

Then I’d guess they are blocking the range then, probably seeing a high spam trend - give your findings to linode and let them know what you see from your end, and see what they can do on their end.

---

<div class="post-metadata">

**Author:** ![l1cache](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/l/919ad9/32.png) [@l1cache](https://discourse.mailinabox.email/u/l1cache)\
**Post date:** [May 13, 2015, 12:00pm UTC](https://discourse.mailinabox.email/t/linode-box-listed-in-spamhaus-blacklist/464/5 "2015-05-13T12:00:24Z")

</div>

The issue has been resolved now. Thanks for the help!