Abuse Reports - Revision history

Astropoint at 14:36, 5 January 2016

2016-01-05T14:36:40Z

← Older revision		Revision as of 14:36, 5 January 2016
Line 45:		Line 45:
	# Check their home directory for any unrecognised/altered scripts.		# Check their home directory for any unrecognised/altered scripts.
	# Check for any unrecognised cron jobs.		# Check for any unrecognised cron jobs.

			==SpamCop Reports==

			Spamcop reports are usually a bit useless unfortunately, so not something to act on that regularly unless you really think something's up.

			Sample email for client if they want more information:

			<blockquote>
			Hi Timothy.

			I agree that the SpamCop complaints are rather terse. Unfortunately, this is all the information they give as they don't want to give away the recipient's details wherever possible.

			I believe that SpamCop complaints are all human-originated. However, if we don't receive that many complaints, we can safely ignore them.

			Can you confirm that where users sign up themselves, that there is a double opt in process, i.e. users need to click on a link sent to their email address in order to confirm the subscription? If not, can you please implement this as it's best practice for email newsletters.

			Kind regards,

			Marc
			GigaTux Support
			</blockquote>

Cocodude: /* The IP address is anything else */

2015-10-25T11:18:09Z

The IP address is anything else

← Older revision		Revision as of 11:18, 25 October 2015
Line 30:		Line 30:
	# Work out which user this relates to. If you are given an URL, you can simply ping it to see whether it is a shared hosting service. If you are given an IP address you do not recognise, type it into WHMCS to see if it comes up with an active user, or look at DTC.		# Work out which user this relates to. If you are given an URL, you can simply ping it to see whether it is a shared hosting service. If you are given an IP address you do not recognise, type it into WHMCS to see if it comes up with an active user, or look at DTC.
	# Create a new ticket to the applicable user from the Abuse department. There are a number of templates that can be used, e.g. ''Immediate Suspension - Fraudulent Sites'' for phishing sites. Ensure the status of the ticket is ''Customer Reply Required'' so it can be followed up.		# Create a new ticket to the applicable user from the Abuse department. There are a number of templates that can be used, e.g. ''Immediate Suspension - Fraudulent Sites'' for phishing sites. Ensure the status of the ticket is ''Customer Reply Required'' so it can be followed up.
	# Set the status of the original abuse report to ''~~In Progress~~''.		# Set the status of the original abuse report to ''Answered''.
	# Add a note to the customer's ticket detailing the ticket number of the abuse report. Also, do the opposite, so add a note to the abuse report listing the customer ticket.		# Add a note to the customer's ticket detailing the ticket number of the abuse report. Also, do the opposite, so add a note to the abuse report listing the customer ticket.
	# Reply to the person submitted the original abuse complaint to say what you have done.		# Reply to the person submitted the original abuse complaint to say what you have done.

Cocodude: /* The IP address is anything else */

2015-10-25T11:17:11Z

The IP address is anything else

← Older revision		Revision as of 11:17, 25 October 2015
Line 30:		Line 30:
	# Work out which user this relates to. If you are given an URL, you can simply ping it to see whether it is a shared hosting service. If you are given an IP address you do not recognise, type it into WHMCS to see if it comes up with an active user, or look at DTC.		# Work out which user this relates to. If you are given an URL, you can simply ping it to see whether it is a shared hosting service. If you are given an IP address you do not recognise, type it into WHMCS to see if it comes up with an active user, or look at DTC.
	# Create a new ticket to the applicable user from the Abuse department. There are a number of templates that can be used, e.g. ''Immediate Suspension - Fraudulent Sites'' for phishing sites. Ensure the status of the ticket is ''Customer Reply Required'' so it can be followed up.		# Create a new ticket to the applicable user from the Abuse department. There are a number of templates that can be used, e.g. ''Immediate Suspension - Fraudulent Sites'' for phishing sites. Ensure the status of the ticket is ''Customer Reply Required'' so it can be followed up.
			# Set the status of the original abuse report to ''In Progress''.
	# Add a note to the customer's ticket detailing the ticket number of the abuse report. Also, do the opposite, so add a note to the abuse report listing the customer ticket.		# Add a note to the customer's ticket detailing the ticket number of the abuse report. Also, do the opposite, so add a note to the abuse report listing the customer ticket.
	# Reply to the person submitted the original abuse complaint to say what you have done.		# Reply to the person submitted the original abuse complaint to say what you have done.

Cocodude: /* The IP address is anything else */

2013-02-07T20:27:03Z

The IP address is anything else

← Older revision		Revision as of 20:27, 7 February 2013
Line 30:		Line 30:
	# Work out which user this relates to. If you are given an URL, you can simply ping it to see whether it is a shared hosting service. If you are given an IP address you do not recognise, type it into WHMCS to see if it comes up with an active user, or look at DTC.		# Work out which user this relates to. If you are given an URL, you can simply ping it to see whether it is a shared hosting service. If you are given an IP address you do not recognise, type it into WHMCS to see if it comes up with an active user, or look at DTC.
	# Create a new ticket to the applicable user from the Abuse department. There are a number of templates that can be used, e.g. ''Immediate Suspension - Fraudulent Sites'' for phishing sites. Ensure the status of the ticket is ''Customer Reply Required'' so it can be followed up.		# Create a new ticket to the applicable user from the Abuse department. There are a number of templates that can be used, e.g. ''Immediate Suspension - Fraudulent Sites'' for phishing sites. Ensure the status of the ticket is ''Customer Reply Required'' so it can be followed up.
			# Add a note to the customer's ticket detailing the ticket number of the abuse report. Also, do the opposite, so add a note to the abuse report listing the customer ticket.
	# Reply to the person submitted the original abuse complaint to say what you have done.		# Reply to the person submitted the original abuse complaint to say what you have done.
	# If a site suspension is not made, follow this up after 24 hours if no response is received.		# If a site suspension is not made, follow this up after 24 hours if no response is received.

Cocodude at 07:45, 10 December 2012

2012-12-10T07:45:24Z

← Older revision		Revision as of 07:45, 10 December 2012
Line 1:		Line 1:
			=Abuse Policies=

			There are a few rules of thumb which should be followed when handling abuse complaints. These are:

			* We have a duty to handle abuse complaints, but the law makes it a good idea to know as little as possible about what is being hosted there.
			* Do not actively search for illegal content.
			* If you get a link to a specific page hosting content, do not click it.
			* If you suspend a user's account, they cannot fix the issue because they cannot get access to their site. Thus, always try and give a warning first.
			* Please offer users 24 hours to handle abuse complaints. Only if it's obvious that the user themselves is actively abusing the service (e.g. they are clearly a spammer) or there is a phishing site active should you lower the time limit. Anything else, please give 24 hours.

			=Abuse Reports=

	You get an email detailing information of an abuse report sent that needs to be responded within 24 hours.		You get an email detailing information of an abuse report sent that needs to be responded within 24 hours.

Cocodude at 06:51, 3 May 2012

2012-05-03T06:51:09Z

← Older revision		Revision as of 06:51, 3 May 2012
Line 8:		Line 8:

	These reports will need to be responded to by following whatever instructions are in the email message. Ideally, these would be sent to abuse@gigatux.com so you can respond against the ticket in WHMCS.		These reports will need to be responded to by following whatever instructions are in the email message. Ideally, these would be sent to abuse@gigatux.com so you can respond against the ticket in WHMCS.

	~~You will need to do the following determine the IP address that this abuse relates to. This will be at the top of the abuse message in the control panel.~~

	==The IP address is 109.169.23.202==		==The IP address is 109.169.23.202==

Cocodude at 06:50, 3 May 2012

2012-05-03T06:50:46Z

← Older revision		Revision as of 06:50, 3 May 2012
Line 4:		Line 4:

	* A few of our customers send out mass mailings to people who have double opted in to receive them. The abuse reports often are raised because some of these user accounts are turned into automatic triggers of abuse reports.		* A few of our customers send out mass mailings to people who have double opted in to receive them. The abuse reports often are raised because some of these user accounts are turned into automatic triggers of abuse reports.
	* Media associations (e.g. MPAA affiliates) report torrent uploads from the tor node at 78.~~129~~.~~201~~.~~189~~.		* Media associations (e.g. MPAA affiliates) report torrent uploads from the tor node at 109.169.23.202.
	* A service has been hacked and hackers have put up pages of their own, e.g. phishing pages.		* A service has been hacked and hackers have put up pages of their own, e.g. phishing pages.

Cocodude at 06:50, 3 May 2012

2012-05-03T06:50:17Z

← Older revision		Revision as of 06:50, 3 May 2012
Line 5:		Line 5:
	* A few of our customers send out mass mailings to people who have double opted in to receive them. The abuse reports often are raised because some of these user accounts are turned into automatic triggers of abuse reports.		* A few of our customers send out mass mailings to people who have double opted in to receive them. The abuse reports often are raised because some of these user accounts are turned into automatic triggers of abuse reports.
	* Media associations (e.g. MPAA affiliates) report torrent uploads from the tor node at 78.129.201.189.		* Media associations (e.g. MPAA affiliates) report torrent uploads from the tor node at 78.129.201.189.
			* A service has been hacked and hackers have put up pages of their own, e.g. phishing pages.

	These reports will need to be responded to by ~~going to~~ the ~~appropriate control panel (e~~.~~g. [http://myservers.rapidswitch~~.com~~/ MyServers] for Rapidswitch abuse reports. You will need to~~ respond against the ~~appropriate~~ ticket~~, which should be easy to find (under a 'Ticket' button hopefully).~~		These reports will need to be responded to by following whatever instructions are in the email message. Ideally, these would be sent to abuse@gigatux.com so you can respond against the ticket in WHMCS.

	~~As an example, for tickets at Rapidswitch, the main report can be seen~~ in ~~the [https://myservers.rapidswitch.com/ Rapidswitch Control Panel] under My Tickets -> Abuse:~~

	~~[[Image:MyServers-Abuse~~.~~png]]~~

	You will need to do the following determine the IP address that this abuse relates to. This will be at the top of the abuse message in the control panel.		You will need to do the following determine the IP address that this abuse relates to. This will be at the top of the abuse message in the control panel.
Line 17:		Line 14:

	# This is a tor node that we run.		# This is a tor node that we run.
	# Create a very terse reply in the ~~[https://myservers.rapidswitch.com/ Rapidswitch Control Panel], with a response type of 'Problem has been resolved'~~. This response can simply be 'tor' if you like.		# Create a very terse reply to the user. This response can simply be 'tor' if you like.

	==The IP address is anything else==		==The IP address is anything else==

	# ~~Send~~ an ~~email~~ the applicable user, ~~using the~~ ''~~GigaTux~~ - ~~Abuse Report~~'' ~~template~~. ~~This can be found in~~ the ''~~Templates~~'' ~~folder of~~ the ~~info@gigatux.com webmail account~~.		# Work out which user this relates to. If you are given an URL, you can simply ping it to see whether it is a shared hosting service. If you are given an IP address you do not recognise, type it into WHMCS to see if it comes up with an active user, or look at DTC.
	# ~~Attempt to~~ follow this up after 48 hours if no response is received.		# Create a new ticket to the applicable user from the Abuse department. There are a number of templates that can be used, e.g. ''Immediate Suspension - Fraudulent Sites'' for phishing sites. Ensure the status of the ticket is ''Customer Reply Required'' so it can be followed up.
	~~# When you receive a response~~, ~~create a response in the [https://myservers~~.~~rapidswitch~~.~~com/ Rapidswitch Control Panel]~~, ~~with a response type of~~ ''~~Problem has been resolved~~''. ~~The text of this response should detail read~~		# Reply to the person submitted the original abuse complaint to say what you have done.
			# If a site suspension is not made, follow this up after 24 hours if no response is received.

			==Phishing sites==

			For phishing sites, e.g. fake PayPal login pages, you must immediately '''delete the phishing content''' and '''suspend their service''' as people will be getting scammed every minute and data centres can place a null route against the IP address. Do not allow resellers (for shared hosting services) to unsuspend the service.

	~~The customer~~ that ~~hosts this server partition has forwarded~~ the ~~following details relating~~ to ~~this report~~:		You must then inform the master owner of the site in question (e.g. reseller or even master reseller via WHMPHP) that a site was suspended and that the site should only be brought online if the user can promise to:

	~~(suitable contents of email or signup details)~~		# Change all passwords, cPanel hash values and MySQL passwords.
			# Update all software, plugins and themes being hosted on the site.
			# Check their home directory for any unrecognised/altered scripts.
			# Check for any unrecognised cron jobs.

Cocodude at 17:05, 29 November 2010

2010-11-29T17:05:21Z

← Older revision		Revision as of 17:05, 29 November 2010
Line 6:		Line 6:
	* Media associations (e.g. MPAA affiliates) report torrent uploads from the tor node at 78.129.201.189.		* Media associations (e.g. MPAA affiliates) report torrent uploads from the tor node at 78.129.201.189.

	~~The~~ main report can be seen in the [https://myservers.rapidswitch.com/ Rapidswitch Control Panel] under My Tickets -> Abuse:		These reports will need to be responded to by going to the appropriate control panel (e.g. [http://myservers.rapidswitch.com/ MyServers] for Rapidswitch abuse reports. You will need to respond against the appropriate ticket, which should be easy to find (under a 'Ticket' button hopefully).

			As an example, for tickets at Rapidswitch, the main report can be seen in the [https://myservers.rapidswitch.com/ Rapidswitch Control Panel] under My Tickets -> Abuse:

	[[Image:MyServers-Abuse.png]]		[[Image:MyServers-Abuse.png]]
Line 12:		Line 14:
	You will need to do the following determine the IP address that this abuse relates to. This will be at the top of the abuse message in the control panel.		You will need to do the following determine the IP address that this abuse relates to. This will be at the top of the abuse message in the control panel.

	==The IP address is 78.~~129~~.~~201~~.~~189~~==		==The IP address is 109.169.23.202==

			# This is a tor node that we run.
	# Create a very terse reply in the [https://myservers.rapidswitch.com/ Rapidswitch Control Panel], with a response type of 'Problem has been resolved'. This response can simply be 'tor' if you like.		# Create a very terse reply in the [https://myservers.rapidswitch.com/ Rapidswitch Control Panel], with a response type of 'Problem has been resolved'. This response can simply be 'tor' if you like.

Cocodude at 13:09, 28 April 2009

2009-04-28T13:09:22Z

← Older revision		Revision as of 13:09, 28 April 2009
Line 8:		Line 8:
	The main report can be seen in the [https://myservers.rapidswitch.com/ Rapidswitch Control Panel] under My Tickets -> Abuse:		The main report can be seen in the [https://myservers.rapidswitch.com/ Rapidswitch Control Panel] under My Tickets -> Abuse:

	~~(picture)~~		[[Image:MyServers-Abuse.png]]

	You will need to do the following determine the IP address that this abuse relates to. This will be at the top of the abuse message in the control panel.		You will need to do the following determine the IP address that this abuse relates to. This will be at the top of the abuse message in the control panel.