I have some experience with Linux, currently running Ubuntu 14.04.2 LTS. I've disabled (a long time ago) root login - via ssh or webmin. I've changed my tomcat's username (good luck to the f**kers in china that is still trying "tomcat", "admin" or "root"). I have clamAv and maldetect running (finding nothing).

I do run a Tor exit node (I use Tor, I like to give back, not doing anything illegal, just valuing my privacy). So I can (like to try and) understand being black listed for running a Tor exit node - it is under my control but I get black listed for being hacked or have a virus or spamming or Natting for a trojan etc.

The latest one was CBL, I've looked at all their suggestion but can't find anything.

(I'm assuming that these services are not just adding me randomly): What should I look for?

Can the listing services pick up malware using my tor exit node? (If so, how do I block it?)

Many thanx


It could be any number of things but the page link you listed is pretty precises. Network traffic from your ip matches the pattern of an infected machine.

The pattern it matches is "Win32/Zbot" so it's not likely to be your Linux box, but you also mention running a Tor Endpoint which means you effectively have no idea what traffic your allowing to go out your IP address.

There is, or was, more then likely, a windows client, connected via Tor that sent out some data that matched the pattern of this malware.

Rather right or wrong, your responsible for the network traffic leaving your network, including the stuff that originated via Tor, thus an infected machine somewhere out there on the Tor network, could cause your IP to be listed.

To correct the problem you have to fix the issue. You have a few options.

  1. Stop running a Tor Endpoint
  2. Restrict the Tor Endpoint to specific type of access
  3. Do some SPI on the outgoing packets

Of course all of these options rather defeat the point of Tor, so ...

Once the problem has been addressed, you can de-list the IP, but, as the page states, there only going to do that a few times. Your only two real options seem to be stop being a Tor endpoint, or live with the effects of being on a CBL.

  • I'll live with being black listed for having a Tor Endpoint, as long as my server is not infected or hacked. – TungstenX Jun 25 '15 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.