I also see incoming traffic to the unallowed mac address reported by the datacenter
tcpdump ether host d4:3d:7e:d8:c0:dc
15:09:52.060311 IP REMOTE.IP.41580 > SERVER.IP.47409: Flags , seq 2338244102, win 1024, length 0
where the DST server IP it's not owned by me!