This is the information from Spamhaus: (xxx is my static IP)
-----------------------
Why was this IP listed?
xxx.xxx.xxx.xxx has been classified as part of a proxy network. There is a type of malware using this IP that installs a proxy that can be used for nearly anything, including sending spam or stealing customer data. This should be of more concern than a Spamhaus listing, which is a symptom and not the problem.
The proxy is installed on a device - usually an Android mobile, firestick, smart doorbell, etc, but also iPads, and Windows computers - that is using your IP to send spam DIRECTLY to the internet via port 25: This is very often the result of third party "free" apps like VPNs, channel unlockers, streaming, etc being installed on someone's personal device, usually a phone.
Technical information
Important: If this IP operates as a mail server, it should look and behave like a mail server. The HELO currently used appears to be dynamic and that is behaviour commonly observed in malware/proxy networks.
Recent connections:
(IP, UTC timestamp, HELO value)
xxx.xxx.xxx.xxx 2024-03-03 20:05:00 goliath.geekstorage.com
Important points:
The HELOs are often dynamic-looking rDNS and usually claim to be from geographically very different networks OR spoofs of major brands.
They can include impossible HELOs like "gmail.com", "outlook.com", "comcast.net" - Gmail, Outlook and Comcast do not use these. These are all fake.
If the HELO does not make sense for the IP generating it, it should be looked at closely.
There is often more than one compromised device.
Guest networks should also be secured.
This is a simple explanation of how it can work:
https://www.spamhaus.com/resource-center/when-doorbells-go-rogue/
Any devices with "free" VPNs, TV streaming, channel unlocking, or 3rd-party apps installed are the first things to check.
What should be done about it?
We very strongly recommend securing your firewall to not allow any packets outbound on port 25, except those coming from any email server(s) on your local network. Remote sending of email to servers on the Internet should still work if web-based, or configured properly to use port 587 using SMTP-AUTH. Guest networks should be secured too.
-----------------------
I presume the UTC timestamp is my local time in the UK? I know a lot of devices that were not on at 20:05 on the 3rd March.
I have turned on traffic manager on the router, also system Log > General Log doesn't look informative unless I'm interpreting it wrong.
I was on CGNAT originally so thought it was someone else, so I got a Static IP about two weeks a go and it started again, so I'm the culprit! IT always seemed to happen on a weekend.
Regards
Mark
