Web Hosting Talk : Web Hosting Main Forums : Web Hosting : Rapidswitch - a scam?

[idevelop]

I just saw another thread here and wanted to alert people to a potential scam that rapidswitch have now started with me.

A quick summary:

I have been with rapidswitch for 3-4 years and have had my own dedicated server for all of that time and paid about 55 pounds a month for it..... So, quiet a few bucks they have had from me over the years and I would of classed myself as a good customer.

I cancelled Rapidswitch about 1 month ago and now they have said the server has been compromised and they will not let me download my websites that are still on the server. They did give me an option of paying 100 pound to retrieve the data.. Yesterday they were going to give me access and today they changed their minds.. Here is all of the chats between me and support...


start....

Your server IS-03838 has been suspended due to the abuse reports which have not been resolved. Network access to this server has been removed. We will unsuspend this server when all of the open abuse reports for this server have been resolved. Please resolve the abuse tickets, then reply to this ticket.

Please note that as this server has been disconnected from the network, you will need to request a KVM session through this ticket to make any changes to your server.

Regards,

RapidSwitch Abuse Team

04 Jul 06:20 Comment Brett Moffitt
Hi,
I actually did respond to this via email reply, but by the looks of things you did not receive it.
I have no idea what this abuse is as Im not a technical person at all. I showed it to my IT guy and he also has no idea either.
Can you please explain to me in layman terms what it all means. Im just a small business with 1 staff and we surely would not abuse anything.
I also need to retrieve my files from the server as 2 sites are owned by my clients.
Thanks in advance,
Regards
Brett

04 Jul 07:26 Comment Staff Kyle M
Hi Brett,

Having checked the abuse ticket, it looks as though it may be a port scan which has caused them to raise a report against your IP address, however I will need to confirm this with a senior member of staff first.

I'm afraid we cannot restore connectivity to your server, until the issue has been resolved.

I will update you again with regards to what the issue actually is, as soon as possible.

Regards,

Kyle
RapidSwitch
- Is your server backed up? Ask me about our backup offerings -
Please rate this response:


04 Jul 07:35 Comment Brett Moffitt
Ok Kyle thanks.. Ill wait for your reply. Its obviously urgent due to my sites being offline. Regards Brett

04 Jul 10:01 Comment Staff Kyle M
Brett,

I have spoken to a senior member of staff and from what we can see, there definitely appears to be some sort of Port scanning going on. You may wish to ask the complainant to provide more information in the abuse ticket and to confirm that this is what is happening (as it seems as though your server is scanning ports on their subnet range, however they haven't actually stated this).

If you're not aware of any activity either then it's likely that your server has been compromised. Do you have an anti-virus or anything similar currently installed?

Regards,

Kyle
RapidSwitch
Please rate this response:


04 Jul 12:35 Comment Brett Moffitt
Kyle, Well as I said, I have no clue Im not a techy. If the server has been compromised it has not come from me. I have no clue if I have an antivirus or not, my tech guy used to do all that stuff and he has returned home to his country, so Im not sure. Ok, well just ask them to send me a backup of the websites I have on the server and we can leave it at that I guess. regards Brett

04 Jul 13:37 Comment Staff Kyle M
Hi Brett,

I fully understand that and can appreciate that this may be a rather difficult situation for you, however we will not be able to restore network access to the server unless the issue is resolved.

We could attempt to resolve the issue for you, however it would be chargeable at our standard rate of £30.00 +VAT per half hour and I cannot guarantee that we would be able to do so.

With regards to the backups, is this something which is currently hosted on your server? Please note, that we do not store backups, unless the client uses our Managed Backup service.

If you could let us know how you wish to proceed with regards to getting this issue resolved, or what you want to happen, then we can let you know how we can go about it.

Regards,

Kyle
RapidSwitch
Please rate this response:


04 Jul 13:41 Comment Brett Moffitt
well Ive asked to be told what the actual problem is in laymans terms. Im not a techy, so I have no clue how to fix the situation. I also have thousands of $'s of websites on the sever, so what happens i lose them all? This is something you guys can do, Ive been a client of yours for over 3 years!!!!! So please ask them to recheck the server and tell me what is wrong... tell me how i go about fixing it and I will get it done.. thanks & regards Brett

04 Jul 14:22 Comment Staff Kyle M
Brett,

My apologies. In simpler terms, a port scanner is similar to a thief going through your neighborhood and checking every door and window on each house to see which ones are open and which ones are locked. Port scanning software, in its most basic state, simply sends out a request to connect to the target computer on each port sequentially and makes a note of which ports responded or seem open to more in-depth probing.

It basically looks for a way to gain entry to other servers.

If you're not aware of such software being installed onto your server, then it's possible that the server has become compromised, as I mentioned above. If it is a case of the server being compromised, then it will be very difficult to locate where the virus etc. without some form of anti-virus or equivalent software.

However, as you've already stated that you're not too familiar with the technical aspects, it may be difficult for you to go about installing anti-virus software, running it and removing and potential threats securely.

One of the better ways to proceed right now, would be for us to provide you access to your server under controlled conditions. You could then transfer any required data/websites etc. from your server to an off-site location (i.e. your PC). Once this has been done, we can re-install the server for you, so it would be as though it's never been used before and you would then be free to transfer all data you removed, back onto the server.

Obviously proceeding with that option would require an OS re-install, which is chargeable at a one-off fee of £30.00 +VAT.

Please understand, that we do value your business and I completely appreciate that you have been a customer for a considerable period of time, and we do want to help you as best as we can. However, from a realistic point of view, we cannot be certain where the issue with your server actually lies and it may take a considerable amount of time for us to locate and resolve the problem, which in turn, may end up costing you more in the long run, should we have to charge.

This is why I have suggested what I have above (you pulling off data, us re-installing), so that we can get you back up and running as quickly as possible.

I hope this has made things a bit clearer. If you're still unsure on anything, please let us know. If you could also, please let us know how you wish to proceed.

Regards,

Kyle
RapidSwitch
- Get your server firewall protected, ask me for more information -
Please rate this response:


04 Jul 14:36 Comment Brett Moffitt
Hi Kyle,
Ok I understand a little better. Thanks for the clarification, but I still have no clue who or what has done this. It definitely did not come from me, due to knowing nothing about that side of things and the only guy who had access is a dear friend, so that rules him out to. By the sounds of things, to use your words, we have been compromised", I guess.

FYI, I cancelled the server last month but I still paid for the time left, since I had to give 1 months notice. Please check my payments.. Due to illness I have had to stop my business and was winding things down, so I only need to grab the sites from the server and then you guys can scrub it clean and start fresh with someone else.

so as you stated " provide you access to your server under controlled conditions. You could then transfer any required data/websites etc. from your server to an off-site location (i.e. your PC)." = this would be the best way forward for me and thanks for your time in helping me Kyle, its much appreciated.

Kind Regards
Brett

P.S. Im in Thailand and its late here now, so please keep that in mind if I have only limited access times allocated.

04 Jul 15:58 Comment Staff Kyle M
Brett,

Unfortunately it can be one of those things that isn't necessarily anybody's fault, but for whatever reason, happens. I hope I didn't come across as meaning to blame anyone for it, as that certainly wasn't my intention!

I had overlooked that your server was due to be cancelled and I'm certainly sorry to about your illness, I hope things improve for you!

With regards to pulling the data off, do you have a rough idea as to how much is on there and how long it may take to transfer it from the server to your location? It can be done whenever it best suits you, we would just need to know roughly how long you require access for, as when we unsuspend the server, it will start scanning for ports again.

Regards,

Kyle
RapidSwitch
Please rate this response:


08:34 (3h ago) Comment Brett Moffitt
Hi Kyle,
You have been very helpful and I appreciate it. I certainly have not felt you blame me for it.
Im told its quite a lot of data that has to be downloaded, so I guess I need at least 8 hours on my Thai connection.
If its possible from Thai time 6pm to 2am, this would be the fastest for me.
Please let me know if this works.. tomorrow or Friday would be fine.
Thanks again for your help Kyle, my wife also thanks you for not getting me stressed, which affects my illness.
Kind Regards
Brett

09:53 (1h ago) Comment Staff Ben M
Hi Brett,

Unfortunately we cannot remove the suspension for 8 hours whilst you backup your data, as it was initially suspended for this abuse report that has currently not been solved.

We can offer you a 500GB external HDD for £100+VAT that we can attach to your server, and then provide you with a KVMoIP session so that you can connect to your server locally and pull any data you require onto the external drive.

You can then arrange to have this shipped to yourself.

Please confirm if this is something you would like to do.


Regards,

Ben
RapidSwitch

end...

So as you see, Kyle was nice and courteous and then Big Bad Ben came along and wanted a little bit of cash, to squeeze the last out of long term client. I just find it amazing that now Im cancelling the server due to illness I might add, is now they find me at fault somewhere and are making things hard. What happened to looking after a long term loyal client? It really make sick to be honest and I feel really bad for them for doing it.

Im now going to go ahead and instruct my lawyer, to try and get my data as I have over $70,000 of websites on the server and no backup (yes I was stupid!!).. What I have read online has not been good about this company and Im going to do my best to get whats mine...
Why wont I pay the 100 pound and retrieve it instead of going through the costly legal way... Because its the principle.

Thanks
Brett

[Jon-RackSRV]

I think you're being unfair branding this as a Scam as it doesn't appear to be.

A few blunt but factual points non-the-less:

1.) Assuming this is an unmanaged service (price seems to suggest that it is) you are responsible for your servers security and therefore it is actually your fault if your server gets hacked.
2.) If your clients data is so valuable then why have you not backed it up, surely you are providing them a disservice if its not?
3.) What has your illness got to do with anything? Whilst unfortunate its certainly not relevant?

[Sparrow-Sean]

I cancelled Rapidswitch about 1 month ago and now they have said the server has been compromised and they will not let me download my websites that are still on the server.

I am a little confused by this, you say you cancelled the service a month a go and now Rapidswitch are saying it has now been compromised so I am sort of thinking to what is actually happening there - the server was cancelled, or it wasn't?

[Jon-RackSRV]

Originally Posted by Sparrow-Sean

I am a little confused by this, you say you cancelled the service a month a go and now Rapidswitch are saying it has now been compromised so I am sort of thinking to what is actually happening there - the server was cancelled, or it wasn't?

He handed in his 30 days notice so the server hasn't yet been cancelled.

[idevelop]

Thanks Jon, I appreciate your honest opinion.

my illness is relevant because I have had to stop my business and thats why I had to cancel the server in the first place.
I was not aware the sites were not backed up and always thought my webmaster would of done that. I hadnt checked because I have been in and out of hospital and I just thought it would of been so.

Im a person who is not technical and I guess I should know a lot more than I do.

I just find that now since I cancelled the sever, they now find this fault and want me to pay for an extra to rectify it.

I cancelled about 3 weeks ago I guess now and had to give a months notice and planned to take the sites from the server and then was told it was compromised. The timing seems to be a little off in my opinion.

BTW, I didnt brand them as a scam in the heading, its a question for feedback and you sure have made yourself clear. thanks

[frill]

I suggest you get your data out and in your posession before any legal action.

[idevelop]

BTW.. I have never been told how to fix the problem or have any clue if there really is a problem. Remember Im just going on what they have told me..
Then yesterday they were allowing me to download my data and today I can have it if I pay twice the retail price for a 500g harddrive to be able to retrieve it...

[StarWebHosting]

Whatever has caused the suspension of your server is irrelevant. You had cancelled your server so if you had a suitable backup of your sites etc. you could just move to another provider if this was your intention.

I think this post backs up a lot of what you read on WHT. Always keep a backup of your web sites.

The data / websites are the lifeblood of your business without it you do not exist. I would ask one big question – if your sites are worth around $70,000 why do you not have several backups?

[idevelop]

Originally Posted by StarWebHosting

Whatever has caused the suspension of your server is irrelevant. You had cancelled your server so if you had a suitable backup of your sites etc. you could just move to another provider if this was your intention.

I think this post backs up a lot of what you read on WHT. Always keep a backup of your web sites.

The data / websites are the lifeblood of your business without it you do not exist. I would ask one big question – if your sites are worth around $70,000 why do you not have several backups?

As I said in a previous post. I thought we had backups but had taken my eye off the ball you could say.. Its my mistake for not backing up and I take full responsibility.

[StarWebHosting]

The quickest way to get your websites back would be to pay the £100. I would pay the money get your web sites back and learn from this.

[idevelop]

Now I have cooled down I think you are right "StarWebHosting".
Ive sent them a link to this thread and hope they find a solution that befits the situation. We all get worked up when we think we are being ripped off and I think if they were in my shoes they would think the same thing.. Its the timing that stinks.

[idevelop]

My reply:

I think you realise Im not happy with this option you provided Ben and the way you changed what Kyle had agreed to was just another thing that has angered me in this whole saga of the "corrupted" server.. Ill never know if its factual and to say the timing is perfect for an outgoing client would be an understatement. Even you must agree that it doesnt sound very good that this is now found after I cancelled with you.. It leaves a bad taste in my mouth, but I have to think of my clients sites and the hard work we put in.
How do we proceed with payment., send me the exact price including VAT and postage to Thailand.
You have won, feel proud!

[StarWebHosting]

I personally don’t know what is achieved by this course of action. If a customer wants to leave and move to another provider then why make this more difficult?!? I would see the best course of action by the hosting provider is helping the customer resolve the issues or moving the web sites away. The web sites / data is not the property of the hosting provider and surely while this dispute goes on it is using up a valuable server that could be sold to somebody else?

Why not try to learn for this with some kind of assessment / feedback by the customer so the hosting provider can learn from any mistakes made. I always believe in improving the service I offer to customers and if this can be improved in any way by receiving constructive criticism then all the better.

[idevelop]

If Im big enough to complain, Im big enough to post their response and wear some egg on my face:

Hi Brett,

I think you may be getting confused. We did not raise the abuse ticket against you. This has been raised by a third party. You can see this if you log into your control panel in MyServers and select My Tickets and click Abuse. Your server was suspended because the abuse ticket had not been replied to, so the complainant didn't know what action, if any had been taken.

Please understand that we are not trying to prevent you from retreiving your data, however because your server has been compromised we cannot allow access to it over the network as it would still perform the port scanning whilst you backed your data up. The safest way and only way really to get you data would be to do as my colleague suggested. To purchase and attach an external drive. That way you copy your data and keep the drive, and then the server could be reinstalled and the data restored.

You say in your reply that we could have prevented the compromise of the server, but you need to understand the service you purchased was a self managed service. We are only responsible for the hardware and connectivity of the server. The security of the server and backups are the responsibility or client.

Regards,

Norman
RapidSwitch

end..

I was never aware of this and I apologise for the mixup and take back what I have previously posted. I can say I was wrong by the looks of it and I stand corrected.

[BlazingSwitch]

I have had a number of servers with RS and while they have their problems from time to time, they are a solid company. I have never experienced the network issues others have claimed in similar threads and they have always delivered for me.

In short, while you may be having some grief. They are not a "scam" company.