Hi Team

I got notified that email from service@sbb.ch sent from the US ServiceNow IP Address: 37.98.234.2 contain an URI blacklisted as 'spamtrap hit' in uribl.swinog.ch which causes most emails to get handled as spam (in our case rejected)

Unfortunately I have not yet managed to get my hands on an email which contains this URI which is blacklisted.

I opened a case with the SBB Customer service and they sent me such an email in an attempt to reproduce the issue:

Received: from outbound09.service-now.com (outbound09.service-now.com [37.98.234.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by idefix.imp.ch (Postfix) with ESMTPS id 296EEC07A5 for abuse@imp.ch; Tue, 31 Mar 2026 17:14:35 +0200 (CEST)

Unfortunately that email they sent me, contains no URI listed @uribl.swinog.ch

sbb.ch and swisspass.ch are whitelisted, same for servicenow.com.

What other URI could be contained in 'most' of the replies sent from service@sbb.ch?

Any help appreciated!

Mit freundlichen Grüssen

-Benoît Panizzon-