I just got an abuse alert from my colocatoin center.

This server hosts VPS clients, and one of the VPS clients has been possible abusing the VPS.

I'm unsure as to whether I should immediately report to authorities since this is a serious matter, or whether I should suspend and wait for him to respond?

Thanks.

What did the client get reported for?

Well, he's basically ordered multiple IPs, and suspectingly he now uses those IPs for mass spamming. And lots of reports coming in.

I'd suspend him and wait for him to respond.

yup, suspend the account, advise the customer to email or call you justifying his useage.

Allow 5-7 for a response to ensure the person is not on holiday or something then terminate the account.

I've suspended him.

My host is giving me 24 hours to do this, but if he's suspended they can't shut down my server right?

Ensure you have a look in his folders and there are no files such as mp3, porn, etc.. If there is remove them. Then advise your host that you have suspended the account and are awaiting a response from your customer and that you are waiting x days for a reponse, at which point you remove the account if no satisfactory reason is given for the useage.

I've suspended him.

My host is giving me 24 hours to do this, but if he's suspended they can't shut down my server right?


Communication is key. Make sure that you've told your colo provider that you've suspended the account, and start communication with the customer. It should be evident after investigation whether or not they were intentionally spamming, or if they had some malicious scripts uploaded.

You need to hurry and suspend the VPS in question or your dedicated server provider will take your whole server offline.

I Agree if you don't suspend him quickly they will put your server offline and maybe charge you some fees

He has already suspended him as indicated in an earlier post, the provider will not put the server offline as long as he has complied and is keeping them updated.

I love clients like that... What does your TOS say about this type of Abuse?

Hehe this host isn't very nice with abuse. I've updated them 10+ times and I'm only getting a notice of how much time I have left within those 24 hours to respond.

Well, I have 2 hours left and the client hasn't responded. Whatever I tell the DC? They tell me so far it's nonsense :S

Our TOS says that we give them 24 hours to get info to us, so hopefully they get something to me soon :)

Thanks

I recommend changing datacenters after you get this resolved. I had a similar issues with LayeredTech and have had none with SoftLayer. The communication is much better.

If there is remove them.


Uhhh...no. Don't destroy evidence.

--Tina

Jay ! update us wid the story