Abuse Reports

Abuse Policies

There are a few rules of thumb which should be followed when handling abuse complaints. These are:

• We have a duty to handle abuse complaints, but the law makes it a good idea to know as little as possible about what is being hosted there.
• Do not actively search for illegal content.
• If you get a link to a specific page hosting content, do not click it.
• If you suspend a user's account, they cannot fix the issue because they cannot get access to their site. Thus, always try and give a warning first.
• Please offer users 24 hours to handle abuse complaints. Only if it's obvious that the user themselves is actively abusing the service (e.g. they are clearly a spammer) or there is a phishing site active should you lower the time limit. Anything else, please give 24 hours.

Abuse Reports

You get an email detailing information of an abuse report sent that needs to be responded within 24 hours.

These are usually generated for the following reasons:

• A few of our customers send out mass mailings to people who have double opted in to receive them. The abuse reports often are raised because some of these user accounts are turned into automatic triggers of abuse reports.
• Media associations (e.g. MPAA affiliates) report torrent uploads from the tor node at 109.169.23.202.
• A service has been hacked and hackers have put up pages of their own, e.g. phishing pages.

These reports will need to be responded to by following whatever instructions are in the email message. Ideally, these would be sent to [email protected] so you can respond against the ticket in WHMCS.

The IP address is 109.169.23.202

1. This is a tor node that we run.
2. Create a very terse reply to the user. This response can simply be 'tor' if you like.

The IP address is anything else

1. Work out which user this relates to. If you are given an URL, you can simply ping it to see whether it is a shared hosting service. If you are given an IP address you do not recognise, type it into WHMCS to see if it comes up with an active user, or look at DTC.
2. Create a new ticket to the applicable user from the Abuse department. There are a number of templates that can be used, e.g. Immediate Suspension - Fraudulent Sites for phishing sites. Ensure the status of the ticket is Customer Reply Required so it can be followed up.
3. Set the status of the original abuse report to Answered.
4. Add a note to the customer's ticket detailing the ticket number of the abuse report. Also, do the opposite, so add a note to the abuse report listing the customer ticket.
5. Reply to the person submitted the original abuse complaint to say what you have done.
6. If a site suspension is not made, follow this up after 24 hours if no response is received.

Phishing sites

For phishing sites, e.g. fake PayPal login pages, you must immediately delete the phishing content and suspend their service as people will be getting scammed every minute and data centres can place a null route against the IP address. Do not allow resellers (for shared hosting services) to unsuspend the service.

You must then inform the master owner of the site in question (e.g. reseller or even master reseller via WHMPHP) that a site was suspended and that the site should only be brought online if the user can promise to:

1. Change all passwords, cPanel hash values and MySQL passwords.
2. Update all software, plugins and themes being hosted on the site.
3. Check their home directory for any unrecognised/altered scripts.
4. Check for any unrecognised cron jobs.

SpamCop Reports

Spamcop reports are usually a bit useless unfortunately, so not something to act on that regularly unless you really think something's up.

Sample email for client if they want more information:

Hi Timothy.

I agree that the SpamCop complaints are rather terse. Unfortunately, this is all the information they give as they don't want to give away the recipient's details wherever possible.

I believe that SpamCop complaints are all human-originated. However, if we don't receive that many complaints, we can safely ignore them.

Can you confirm that where users sign up themselves, that there is a *double opt in* process, i.e. users need to click on a link sent to their email address in order to confirm the subscription? If not, can you please implement this as it's best practice for email newsletters.

Kind regards,

Marc GigaTux Support