I've been running a Tor node for a couple of days (until I hit my bandwidth limit and got charged lots more), now I'm blacklisted by Spamhaus.
I decided not to run as an exit node by commenting #ExitPolicy accept *:*
, however on Aug 9th I got blacklisted and can't send email to almost anyone around the globe. My server has no open relay and I ran every kind of test possible.
The only list that currently lists me is CBL:
This IP is infected with, or is NATting for a machine infected with s_ddos_dirtjumper
Note: If you wish to look up this bot name via the web, remove the "s_" before you do your search.
This was detected by observing this IP attempting to make contact to a s_ddos_dirtjumper Command and Control server, with contents unique to s_ddos_dirtjumper C&C command protocols.
To find these infections, search for TCP/IP connections going to IP address 87.255.51.229 or 82.165.47.44, usually destination port 80 or 443, but you should look for all ports.
These infections are rated as a "severe threat" by Microsoft. It is a trojan downloader, and can download and execute ANY software on the infected computer.
You will need to find and eradicate the infection before delisting the IP address.
Reading the description, it looks like somebody was using Tor to anonymize that botnet's traffic and used my node as exit.
The problem is that I commented the ExitPolicy accept line, so I should be only relaying traffic internal to the Tor network.
My machine shouldn't be infected because it runs Linux and SSH is well secured.
What could be the problem? Is Tor my configuration wrong?