Spamhaus Delisting

bacloud · 11:08AM

@aluy said:

@tentor said:
@aluy Have a look at https://nerd.cesnet.cz/nerd/ips/?subnet=&hostname=&asn=211507&source_op=or&cat_op=or&bl_op=or&tag_op=or&tc_category_op=or&tc_subcategory_key=&tc_subcategory_value=&tc_confidence=0.25&sortby=rep&limit=20

these are tor exits and mail ports are still blocked. spamhaus is also still sending reports for botnets and c2s which are usually suspended within 2-12h at most.

is there anything i should tell tor operators to do?

You should completely clean your network until the Spamhaus 0 complaints to get unblocked.

kait · 11:08AM

@aluy said:

@kait said:

@aluy said:

@kait said:

@bacloud said:
If the information is correct, it was a lot of badware, botnets, malware and no spam at all. They cleaned all the shit off the network, but were still ignored for 6 months.

Yeah thats aluys issue, his network and 2 shell corps are full of malware and botnet activity. Whack a mole is not the same as actually suspending and cleaning up the network. I suspect thats why spamhaus listed his ranges and ASN, because aluy isn't doing enough to keep his network clean and at some point you have to think to yourself, is this guy in the malware hosting business?

i have no shell companies active as im aware 🤔 at least not used or such.

and the ripe asns i sponsored have since also been deregistered as ripe reported it to me

Yeah I know, if you keep enough deniability its all Gucci he. I know what your doing and there is nothing you can say to make me believe otherwise. But that's beside the point, as long as you keep enough deniability you can keep your operation going without public scrutiny.

i have edited my comment and im not sure what "i know what you do" is. i know what i DID and pretty much everyone does. i will not repeat it

I know thats what you would say, but who cares. No one is going to change anyone's mind here and you will get fucked by spamhaus for what you're doing.

tentor · 11:09AM

@aluy said:

@tentor said:

@aluy said:

@tentor said:
@aluy Have a look at https://nerd.cesnet.cz/nerd/ips/?subnet=&hostname=&asn=211507&source_op=or&cat_op=or&bl_op=or&tag_op=or&tc_category_op=or&tc_subcategory_key=&tc_subcategory_value=&tc_confidence=0.25&sortby=rep&limit=20

these are tor exits and mail ports are still blocked. spamhaus is also still sending reports for botnets and c2s which are usually suspended within 2-12h at most.

is there anything i should tell tor operators to do?

You should not mix Tor Exits and ASN used for "clean" traffic to not cause problems for mail even without ASNDROP listing. A lot of RBLs hate portscan which is inevitable for Tor Exit. This is why e.g. Cloudflare has separate BYOIP ASN.

Also, if you have a lot of recurring cases of C2, Spamhaus will assume the worst especially if you market as No-KYC. No way around that.

while a nice idea i dont see this as a reason for such a listing. many asns do not have this issue

I am talking from my own experience and observation of other networks. It is up to you to accept my free advice or not.

aluy · 11:09AM

@bacloud said:

@aluy said:

@tentor said:
@aluy Have a look at https://nerd.cesnet.cz/nerd/ips/?subnet=&hostname=&asn=211507&source_op=or&cat_op=or&bl_op=or&tag_op=or&tc_category_op=or&tc_subcategory_key=&tc_subcategory_value=&tc_confidence=0.25&sortby=rep&limit=20

these are tor exits and mail ports are still blocked. spamhaus is also still sending reports for botnets and c2s which are usually suspended within 2-12h at most.

is there anything i should tell tor operators to do?

You should completely clean your network until the Spamhaus 0 complaints to get unblocked.

i have done exactly that. no mail ports unless checked. uceprotect checks and automatic abude handling. and no active "bad things" on my host

OscarCipriano · 11:10AM

Hi,

I had the exact same issue over the last 4 months, and yes, it took me a solid 4 months to get my ASN removed from the Spamhaus droplist.

I wasn’t receiving any abuse reports, except back in 2025 due to two malicious clients that I promptly suspended.

To fix this, I implemented an outbound email limit across all IPv4 blocks on my ASN, capped at a maximum of 100 emails per hour. Clients can only get unlimited SMTP access if they verify their identity and provide a valid justification. I also set up an automated system that instantly blocks outbound portscan attempts.

Anyway, I spent a good 3-4 months fighting with Spamhaus while my ticket just sat there with no replies.

Feel free to ping me on Telegram if you want to chat about it colleague to colleague.

iceman · 11:11AM

@aluy spamhaus won't blacklist your ASN for no reason, they may blacklist some shady IPs but not ASn until there is really a reason to!

aluy · 11:12AM

@OscarCipriano said:
Hi,

I had the exact same issue over the last 4 months, and yes, it took me a solid 4 months to get my ASN removed from the Spamhaus droplist.

I wasn’t receiving any abuse reports, except back in 2025 due to two malicious clients that I promptly suspended.

To fix this, I implemented an outbound email limit across all IPv4 blocks on my ASN, capped at a maximum of 100 emails per hour. Clients can only get unlimited SMTP access if they verify their identity and provide a valid justification. I also set up an automated system that instantly blocks outbound portscan attempts.

Anyway, I spent a good 3-4 months fighting with Spamhaus while my ticket just sat there with no replies.

Feel free to ping me on Telegram if you want to chat about it colleague to colleague.

well that sounds pretty good in the end especially since mail ports are fully blocked currently

aluy · 11:13AM

@iceman said:
@aluy spamhaus won't blacklist your ASN for no reason, they may blacklist some shady IPs but not ASn until there is really a reason to!

i dont see a reason even if i tried. i just dont know what to do anymore

tentor · 11:13AM

@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

aluy · 11:16AM

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

the majority shows a 404 page? the rest is suspended. urlhaus would get suspended automatically which the malware urls/ips there are, but no urlhaus entry for them

rpqu · 11:17AM

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

Wait, @aluy host fileditchfiles.me ?
And https://urlscan.io/result/019bd582-85fd-71b5-84f3-1da3e963d8b0/ . Very good

tentor · 11:21AM

@aluy said:

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

the majority shows a 404 page? the rest is suspended. urlhaus would get suspended automatically which the malware urls/ips there are, but no urlhaus entry for them

As I said, Spamhaus always assumes the worst, so as long as you have recurring cases of phishing, malware, spam, botnets etc they won't delist you.

aluy · 11:23AM

@rpqu said:

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

Wait, @aluy host fileditchfiles.me ?
And https://urlscan.io/result/019bd582-85fd-71b5-84f3-1da3e963d8b0/ . Very good

i dont know fileditchfiles really and archive.ph .is whatever all the tlds are doesnt host with me anymore im pretty sure

rpqu · 11:25AM

@aluy said:

@rpqu said:

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

Wait, @aluy host fileditchfiles.me ?
And https://urlscan.io/result/019bd582-85fd-71b5-84f3-1da3e963d8b0/ . Very good

i dont know fileditchfiles really and archive.ph .is whatever all the tlds are doesnt host with me anymore im pretty sure

Okay.

aluy · 11:27AM

@tentor said:

@aluy said:

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

the majority shows a 404 page? the rest is suspended. urlhaus would get suspended automatically which the malware urls/ips there are, but no urlhaus entry for them

As I said, Spamhaus always assumes the worst, so as long as you have recurring cases of phishing, malware, spam, botnets etc they won't delist you.

barely any reports, 14 urlhaus ips since january, all suspended within hours

regarding botnet/c2 reports from spamhaus it was even less and all suspended in same time range

tentor · 11:28AM

@aluy said:

@tentor said:

@aluy said:

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

the majority shows a 404 page? the rest is suspended. urlhaus would get suspended automatically which the malware urls/ips there are, but no urlhaus entry for them

As I said, Spamhaus always assumes the worst, so as long as you have recurring cases of phishing, malware, spam, botnets etc they won't delist you.

barely any reports, 14 urlhaus ips since january, all suspended within hours

regarding botnet/c2 reports from spamhaus it was even less and all suspended in same time range

No need to convince me or anyone else here, you need to communicate with Spamhaus and ensure they believe that you genuinely care about abuse and have some measures to prevent it or detect early. Otherwise, they will keep you listed.

aluy · 11:30AM

@tentor said:

@aluy said:

@tentor said:

@aluy said:

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

the majority shows a 404 page? the rest is suspended. urlhaus would get suspended automatically which the malware urls/ips there are, but no urlhaus entry for them

As I said, Spamhaus always assumes the worst, so as long as you have recurring cases of phishing, malware, spam, botnets etc they won't delist you.

barely any reports, 14 urlhaus ips since january, all suspended within hours

regarding botnet/c2 reports from spamhaus it was even less and all suspended in same time range

No need to convince me or anyone else here, you need to communicate with Spamhaus and ensure they believe that you genuinely care about abuse and have some measures to prevent it or detect early. Otherwise, they will keep you listed.

i am trying exactly that right now and i hope they will rethink their decision. i am really trying

tentor · 11:31AM

@aluy said:

@tentor said:

@aluy said:

@tentor said:

@aluy said:

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

the majority shows a 404 page? the rest is suspended. urlhaus would get suspended automatically which the malware urls/ips there are, but no urlhaus entry for them

As I said, Spamhaus always assumes the worst, so as long as you have recurring cases of phishing, malware, spam, botnets etc they won't delist you.

barely any reports, 14 urlhaus ips since january, all suspended within hours

regarding botnet/c2 reports from spamhaus it was even less and all suspended in same time range

No need to convince me or anyone else here, you need to communicate with Spamhaus and ensure they believe that you genuinely care about abuse and have some measures to prevent it or detect early. Otherwise, they will keep you listed.

i am trying exactly that right now and i hope they will rethink their decision. i am really trying

The wording you used previously won't convince them. They might consider 14 cases as a lot for your network. You need better strategy.

bacloud · 11:32AM

@aluy said:

@bacloud said:

@aluy said:

@tentor said:
@aluy Have a look at https://nerd.cesnet.cz/nerd/ips/?subnet=&hostname=&asn=211507&source_op=or&cat_op=or&bl_op=or&tag_op=or&tc_category_op=or&tc_subcategory_key=&tc_subcategory_value=&tc_confidence=0.25&sortby=rep&limit=20

these are tor exits and mail ports are still blocked. spamhaus is also still sending reports for botnets and c2s which are usually suspended within 2-12h at most.

is there anything i should tell tor operators to do?

You should completely clean your network until the Spamhaus 0 complaints to get unblocked.

i have done exactly that. no mail ports unless checked. uceprotect checks and automatic abude handling. and no active "bad things" on my host

Mail, mailing is nothing, tip of the iceberg, nothing more. You can even be listed on Spamhaus for hosting spamvertised websites. Look at other activities, what are your clients doing. Here are activities, which can cause a listing in Spamhaus:

Phishing URLs, malware URLs, scam domains, botnet command-and-control hosting, hijacked servers, compromised servers, bulletproof hosting, ignored abuse reports, malware distribution, trojan downloaders, ransomware-related infrastructure, DDoS activity, data harvesting, exploit attempts, authentication attacks, spam-support infrastructure, malicious redirects, fake login pages, credential theft, command-and-control infrastructure and etc.

aluy · 11:33AM

@tentor said:

@aluy said:

@tentor said:

@aluy said:

@tentor said:

@aluy said:

@tentor said:
@aluy have a look at these too https://urlscan.io/search/#page.asn: AS211507

the majority shows a 404 page? the rest is suspended. urlhaus would get suspended automatically which the malware urls/ips there are, but no urlhaus entry for them

As I said, Spamhaus always assumes the worst, so as long as you have recurring cases of phishing, malware, spam, botnets etc they won't delist you.

barely any reports, 14 urlhaus ips since january, all suspended within hours

regarding botnet/c2 reports from spamhaus it was even less and all suspended in same time range

No need to convince me or anyone else here, you need to communicate with Spamhaus and ensure they believe that you genuinely care about abuse and have some measures to prevent it or detect early. Otherwise, they will keep you listed.

i am trying exactly that right now and i hope they will rethink their decision. i am really trying

The wording you used previously won't convince them. They might consider 14 cases as a lot for your network. You need better strategy.

you are right and thats why the email is not phrased as here, here i post more casual

aluy · 11:36AM

@bacloud said:

@aluy said:

@bacloud said:

@aluy said:

@tentor said:
@aluy Have a look at https://nerd.cesnet.cz/nerd/ips/?subnet=&hostname=&asn=211507&source_op=or&cat_op=or&bl_op=or&tag_op=or&tc_category_op=or&tc_subcategory_key=&tc_subcategory_value=&tc_confidence=0.25&sortby=rep&limit=20

these are tor exits and mail ports are still blocked. spamhaus is also still sending reports for botnets and c2s which are usually suspended within 2-12h at most.

is there anything i should tell tor operators to do?

You should completely clean your network until the Spamhaus 0 complaints to get unblocked.

i have done exactly that. no mail ports unless checked. uceprotect checks and automatic abude handling. and no active "bad things" on my host

Mail, mailing is nothing, tip of the iceberg, nothing more. You can even be listed on Spamhaus for hosting spamvertised websites. Look at other activities, what are your clients doing. Here are activities, which can cause a listing in Spamhaus:

Phishing URLs, malware URLs, scam domains, botnet command-and-control hosting, hijacked servers, compromised servers, bulletproof hosting, ignored abuse reports, malware distribution, trojan downloaders, ransomware-related infrastructure, DDoS activity, data harvesting, exploit attempts, authentication attacks, spam-support infrastructure, malicious redirects, fake login pages, credential theft, command-and-control infrastructure and etc.

you are right at the time there was probably a lot more since wording on my site was different and the hosting was new and i was known as a bad guy. people thought it would be the same so they tried. in the past months this has improved a lot and im sure now that spamhaus will take this into account in the future even if not now. i have tried with one subnet and will see what they if anything. otherwise ill try in a few months again. this thread has helped me though to understand it more.

and with improved i dont mean the abuse handling (even if that aswell, but it was never horrible) i mean the people trying got considerably less

sorry if i am again explaining my situation, i just feel its informative

luckypenguin · 11:44AM

@aluy On the other side of things, if people want a no-BS hoster, they will find this thread and get services from you. On some forums, an ASN listen on spamhaus and still operating is a sign of quality. Means even with sanctions and pressure, you keep hosting customers. I'm not talking full malware or illegal stuff, but "questionable" content.
Tor/VPN exists fall in that category I guess.

aluy · 11:46AM

@luckypenguin said:
@aluy On the other side of things, if people want a no-BS hoster, they will find this thread and get services from you. On some forums, an ASN listen on spamhaus and still operating is a sign of quality. Means even with sanctions and pressure, you keep hosting customers. I'm not talking full malware or illegal stuff, but "questionable" content.
Tor/VPN exists fall in that category I guess.

well, i am not against tor or vpns and this is not something ill ever be against.

either way im thankful for all the info in this post and it can be closed ig

rpqu · 12:22PM

@aluy said:

@luckypenguin said:
@aluy On the other side of things, if people want a no-BS hoster, they will find this thread and get services from you. On some forums, an ASN listen on spamhaus and still operating is a sign of quality. Means even with sanctions and pressure, you keep hosting customers. I'm not talking full malware or illegal stuff, but "questionable" content.
Tor/VPN exists fall in that category I guess.

well, i am not against tor or vpns and this is not something ill ever be against.

either way im thankful for all the info in this post and it can be closed ig

Yes. Other hosts are sensitive about tor and afraid of getting TOR tag on bgp.tools and such

totally_not_banned · 12:32PM

@rpqu said:

@aluy said:

@luckypenguin said:
@aluy On the other side of things, if people want a no-BS hoster, they will find this thread and get services from you. On some forums, an ASN listen on spamhaus and still operating is a sign of quality. Means even with sanctions and pressure, you keep hosting customers. I'm not talking full malware or illegal stuff, but "questionable" content.
Tor/VPN exists fall in that category I guess.

well, i am not against tor or vpns and this is not something ill ever be against.

either way im thankful for all the info in this post and it can be closed ig

Yes. Other hosts are sensitive about tor and afraid of getting TOR tag on bgp.tools and such

Well, it's sadly not just a tag. I'm a big fan of TOR and similar tools but having neighbors running exits comes with a penalty that might or might not matter depending on what you are using your server for.

If you are planning on running VPN for example having exits (or public TOR activity in general) inside the same ASN is probably a no go as just having exits on the same ASN (doesn't even have to be the same subnet) will automatically downgrade your IP's reputation, which in turn increases your risk of captchas, fraudchecks, getting your accounts blocked and so on, so it's not so much about a tag but more about if you are OK with likely scaring a bunch of non problematic clients away.

Howdy, Stranger!

Categories

In this Discussion

Spamhaus Delisting

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Spamhaus Delisting

Comments