Abuse Reports

You get an email detailing information of an abuse report sent that needs to be responded within 24 hours.

These are usually generated for the following reasons:

• A few of our customers send out mass mailings to people who have double opted in to receive them. The abuse reports often are raised because some of these user accounts are turned into automatic triggers of abuse reports.
• Media associations (e.g. MPAA affiliates) report torrent uploads from the tor node at 109.169.23.202.
• A service has been hacked and hackers have put up pages of their own, e.g. phishing pages.

These reports will need to be responded to by following whatever instructions are in the email message. Ideally, these would be sent to [email protected] so you can respond against the ticket in WHMCS.

The IP address is 109.169.23.202

1. This is a tor node that we run.
2. Create a very terse reply to the user. This response can simply be 'tor' if you like.

The IP address is anything else

1. Work out which user this relates to. If you are given an URL, you can simply ping it to see whether it is a shared hosting service. If you are given an IP address you do not recognise, type it into WHMCS to see if it comes up with an active user, or look at DTC.
2. Create a new ticket to the applicable user from the Abuse department. There are a number of templates that can be used, e.g. Immediate Suspension - Fraudulent Sites for phishing sites. Ensure the status of the ticket is Customer Reply Required so it can be followed up.
3. Reply to the person submitted the original abuse complaint to say what you have done.
4. If a site suspension is not made, follow this up after 24 hours if no response is received.

Phishing sites

For phishing sites, e.g. fake PayPal login pages, you must immediately delete the phishing content and suspend their service as people will be getting scammed every minute and data centres can place a null route against the IP address. Do not allow resellers (for shared hosting services) to unsuspend the service.

You must then inform the master owner of the site in question (e.g. reseller or even master reseller via WHMPHP) that a site was suspended and that the site should only be brought online if the user can promise to:

1. Change all passwords, cPanel hash values and MySQL passwords.
2. Update all software, plugins and themes being hosted on the site.
3. Check their home directory for any unrecognised/altered scripts.
4. Check for any unrecognised cron jobs.