Web Hosting Talk : Web Hosting Main Forums : Dedicated Server : The Hivelocity Nightmare - Service TERMINATED for SPAM

[Spluut]

A month ago I decided to use Hivelocity for my US VPS servers - they had great prices, quality hardware, great network, friendly staff, almost always online day or night and accepted my proposal for a first month discount.

I received my server and everything was to be expected, ran some stress tests and they surpassed my expectations. My account manager Lee had be real great and helpful for the whole process.

Before making this purchase, I stated exactly what the purpose of this machine was going to be used for to Lee and the General Manager Steve. I was to be hosting VPS for my web hosting services. I specifically asked about issues regarding SPAM complaints and they said all should be okay as long as I have a AUP in place. I also stated I am more than happy to delist any IPs as I have experience in this from working with web hosts in the past, and will be with you guys for years to come.

Almost a month later now Hivelocity sent me a report that an IP has been blacklisted on spamhaus.org for a blackhole exploit kit and that this IP has been null-routed. Within an hour of receiving this email, I had taken care of the client (suspended, then later terminated the VPS) and responded to the email received from Hivelocity's abuse department as well as an email to Steve directly. This client was not in operation for more than 48 hours.

A day later I get another complaint from a apparently well known "ROKSO spammer" that signs up with the name Ryan Gillies. I had been informed the IP was null-routed.
http://www.spamhaus.org/rokso/spamme...3/ryan-gillies

Within an hour of receiving this email, I had the client suspended (due for investigation by my server admin), a response was made and contact with Steve regarding the warnings I had received. This client was not in operation for more than 24 hours.

When my system admin became available, I had the VPS unsuspended (with the root pass changed) so that he could investigate what scripts were being ran as they seemed to have gotten passed certain functions/filters that help reduce and find spammers. I figured all was safe since the IP had been null routed. After the investigation, we find lots of information on this person and his methods of spamming.

A day later, Hivelocity sends in a termination notice and immediately has the server shut off. This notice concluded that the VPS machine was still sending spam days later. But wait, how can this be? They stated the IP was null routed. Apparently the IP had the null route removed--WITHOUT NOTIFICATION---and this was my fault entirely that constitutes immediate termination of my server.

I also made no contact with Hivelocity that stated to remove the null route on said IP. The VPS was also not even unsuspended for that long.

Through hours and hours of wasted time with almost every person at Hivelocity, no refunds will be made, none of my clients data is available to obtain by download, my service cannot be reactivated, and I have apparently been put on some sort of "blacklist" for my actions.

Here are some quotes from the team of Hivelocity. They are a mess indeed.

Hello,

You caused a listing, we allowed your server back on line on the basis the
infringing VPS would stay down and that you would resolve the issue. Your
server again caused a listing and by the same VPS. So there is no fault on our
behalf. We have gave you the benefit of the doubt and you did not hold up your
end of the bargain. You are right, most DCs may have handled the situation
differently. They would have terminated your server, then charged a huge clean
up fee with zero chance to get any of your data. We have offered you a way to
get your files. It is up to you if you want to get them.

I will pass your request for a refund to your account manager, however given
the situation it is not likely to be awarded.



--
Conal
Systems Management Specialist
conal@hivelocity.net

No actually, I have dealt with many datacenters, none of them handled this situation like you. It is not my fault you didn't wait for me to notify you to unnull the IP, it is also not my fault you did not get in contact with me in any way stating the IP had been restored. Oh, and you did terminate my server, you also did charge me a $500 fee, so you make some clueless statements Conal.

Hello,

How is your server causing a spam listing our fault? The whole reason you are
in this situation is because your server was sending out spam. There are
hundreds if not thousands of forum posts complaining about other Hosting
Companies regarding abuse as well. That is because people like yourself who
get their server's shut off for spam regardless if it was justified or not like
to make complaints. That is the nature of abuse issues. . We are more then
justified in this case and we are confident anyone who actually knew the full
extent of why your server was terminated would probably agree. Every time a
listing is created it costs us far more then $500 collectively.

Again I will forward your complaints to your account manger. But again, I
doubt there is any likely hood you will be refunded anything.


--
Conal
Systems Management Specialist
conal@hivelocity.net

Excuse me, it does not cost $500 to get delisted, infact it cost nothing.

Is there any fee for SBL removal?
No. There is never any charge or fee associated with removing any Spamhaus listing.

Any offer from anyone to remove any Spamhaus listing for you for a fee is a scam. Spamhaus has no affiliation with anyone offering any 'blocklist removal' service, nor can any third party influence or expedite removals from any Spamhaus database.

Removals of Spamhaus listings are governed by our removals policy only. The criteria for removal from the SBL are explained on the SBL Delisting Procedure page. All removals from the SBL or ROKSO are the sole decision of The Spamhaus Project.

While there are 'deliverability consultants' who can help improve your email sending practices to meet Spamhaus standards, it is important to know that none of them have any special privilege to influence, expedite or modify SBL or ROKSO listings.

Please wait for a site operator to respond.
You are now chatting with 'Vick'
Vick: Hello, welcome to Hivelocity's Impressive Support TM. How may I assist
you today?
Chris: vick i need all my files from the server you guys terminated -
199.119.100.142
Vick: When was your server terminated ?
Chris: over a day ago
Vick: You need to place the ticket fir this a d the admins will assist you
further on this
Chris: this is becoming more and more urgent with each passing minute, i need
my files now.
Chris: tickets have gotten me no where
Vick: Let me know the ticket ID
Chris: [#163190] **Files URGENT
Vick: ok please hold on as I check
Chris: thanks
Vick: Chris..Please add this content the ticket and the admins will check and
they will get this done as soon as possible for you
Chris: great! thanks vick.
Vick: you are welcome
Vick: It was a pleasure talking to you.
Vick: Thank you for chatting with Hivelocity Live Chat Support.

Hello,

You don't have to purchase the drives to obtain your data. You mentioned in
other tickets you were coming into town. By all means stop by the DC and we
shall have the server ready so copy your data off. Simply let us know 24 hours
before you come in.

We were already aware of your chat conversation and it was already logged as
all our chat transcripts are.

Again. without explicit instruction from your account manager, management, and
the abuse department to put your server online, it simply is not going to go
online. Jay (abuse manager) has made it very clear that your server is not go
back online. I believe I have mentioned this to you before, but if you would
like to appeal. please contact jay@hivelocity.net .

I really would like to help. We do sympathize but you really need to contact
your account manager and the abuse department to settle this. We can't make
this call in the tech department.


--
Conal
Systems Management Specialist
conal@hivelocity.net

Hello,

Please be advised that the server was terminated from the network as it was a
SPAM source which caused RBL listings and was hosting a ROKSO spammer. You were
given a chance to resolve by terminating the account but rather than doing so
you allowed the ROKSO to spam again and relist the IP.

With regards to your data, this is nothing personal but if you would like to
retrieve it you have only one option, and that would be to purchase the
harddrives and arrange shipping. Under no circumstance shall you be granted
access to the facility to copy your data. Typically when servers are terminated
the data is seized, especially when the system holds data for a ROKSO spammer.

Thank you!

-Jay
Sr. Systems Administrator
HiVelocity Engineering Dept.
http://www.hivelocity.net

Wow so they lied to me? Cool, not sure who to blame, Vick or Conal. But great, I'll be in Tampa soon so I can obtain my data that way? Oh wait, that was a lie too.

Hello,

I understand that you may have acted quickly (even though unknown to us).
However, if you suspended the VPS then it would be a concern as to why the same
client still sending mail from your server. Here was the message from spamhaus
today:

**************************************************************
-----Original Message-----
From: The Spamhaus Project - SBL Removals [mailtobl-removals@spamhaus.org]
Sent: Friday, April 27, 2012 8:42 AM
To: Sr. Systems Administrator
Subject: Re: SBL137195 199.119.100.238/32 SR03

Hello Jay,

Wednesday, April 25, 2012, 5:48:27 PM, you wrote:

> The IP was null routed pending removal of the VPS account hosting the
rokso.
>
> Please remove SBL137195 199.119.100.238/32 SR03 and confirm.

Spam is still being sent from this VPS by the same customer, so the SBL record
has been reactivated. Can you look into this?

Thanks.

--
Best regards,

Rob Schultz
The Spamhaus Project - SBL Removals
**************************************************************

Based on this and the lack of response from you the server has been terminated
from the network due to hosting a ROKSO spammer that was still actively sending
SPAM.

Thank you!

-Jay
Sr. Systems Administrator
HiVelocity Engineering Dept.
http://www.hivelocity.net

Simply terminating an account without investigation does not help prevent future spammers.. The IP was null routed and no contact was given that it was restored.. but yet at Hivelocity this is my fault.

Chris,

We are not able to put the server back online without risking serious repercussion to our network. The situation is unfortunate and spammers are bad eggs that ruin a lot of things. Our only option is to ship you the drive. We cannot put the server back online. We will not be refunding you but we will not be charging you for next month or any other future service. I am sorry for the situation but you were hosting a professional spammer, as you put it, and they have screwed us both.


Regards,
Steve Eschweiler
General Manager
steve@hivelocity.net
888 869 4678 ext 224

Chris,

The fact of the matter is we don't know you from Adam and we have made assurances that your server will no longer send spam. Should we turn you back on to get your data and you abuse our network we will never get our IPs delisted again because we will lied to the folks that delisted us already. Do you understand?


Steve Eschweiler
General Manager
steve@hivelocity.net
888 869 4678 ext 224

So apparently they lied to them once already since they got the IP delisted before hearing from me to verify and before telling me that the IP was removed from null route. Interesting.

I feel conned and embarrassed for putting my faith/trust into Hivelocity, I even had a few people ask me what datacenter I use before making a purchase, and when I told them Hivelocity they had to turn my services down because apparently Hivelocity has a horrible reputation for handling abuse cases--and now I believe it. The abuse team is a joke, I have never been treated so unfair and poorly by a datacenter such as Hivelocity.

[Host Ultra]

How is this Hivelocity's fault.
You unsuspended the VPS that continued to send spam.

The technical details of how spammer managed to bypass you changing the root password is not hivelocity's problem.
Yes its unfortunate, but its your own doing.

You replied to them that you had suspended the vps, so of course they are going to remove the block.

[W1H-Lee]

Originally Posted by Host Ultra

The technical details of how spammer managed to bypass you changing the root password is not hivelocity's problem.
Yes its unfortunate, but its your own doing.

Log into the VPS control panel and change the root password back

[Spluut]

Originally Posted by Host Ultra

How is this Hivelocity's fault.
You unsuspended the VPS that continued to send spam.

The technical details of how spammer managed to bypass you changing the root password is not hivelocity's problem.
Yes its unfortunate, but its your own doing.

You replied to them that you had suspended the vps, so of course they are going to remove the block.

The spammer did not bypass anything, they had a script that automatically starts, which is what my server admin was investigating on how it works and how it bypasses some filters we had to help detect spammers. Terminating a VPS without investigating how you can help prevent this is just lazy.

They null routed the IP without notification of re-enable, they also claimed to not have gotten any of my emails, because they claimed I had to create a ticket and that the abuse email was not monitored. (reviewing the email, they did state this and I admit to missing that part but they forgave this issue - though most hosts I have used have emails pipped and is a very common practice)

So Hivelocity without hearing from me (according to them) reactivated those IPs.

Hello,

I understand that you may have acted quickly (even though unknown to us).

Thank you!

-Jay
Sr. Systems Administrator
HiVelocity Engineering Dept.
http://www.hivelocity.net

[Testtube302]

This is a very difficult situation to be in for both parties the customer and the provider. I can see the customers point of view as well as HV. I believe they should make the data available to you via a online medium. Or a option to purchase the drive Which looks like is a option.

Upstream providers are getting more and more difficult to deal with regarding spam. And its easier to get rid of a customer who is bringing in tons of trash clients onto the network.

I do feel personally that HV should work a bit closer to the customer and be a bit more reasonable. but obviously they see you as a loss and they are going to focus support/customer service on customers that will be generating them money and not ones that are going to lose them money. Not saying this is the case or this is right but just a guess.

[Spluut]

Originally Posted by Testtube302

This is a very difficult situation to be in for both parties the customer and the provider. I can see the customers point of view as well as HV. I believe they should make the data available to you via a online medium. Or a option to purchase the drive Which looks like is a option.

Upstream providers are getting more and more difficult to deal with regarding spam. And its easier to get rid of a customer who is bringing in tons of trash clients onto the network.

I do feel personally that HV should work a bit closer to the customer and be a bit more reasonable. but obviously they see you as a loss and they are going to focus support/customer service on customers that will be generating them money and not ones that are going to lose them money. Not saying this is the case or this is right but just a guess.

There was no complaint against any upstream providers, this was simply a blacklisting.

As for business, well they would have gained a lot more business from me had they handled this situation better. Spam is always a problem and it was dealt with in a way that would help detect the methods this guy used to spam. He wasn't even active for 24 hours before being shut down.

[Testtube302]

I can understand how frustrating it is. We recently had a couple clients sign up for service and began spamming. We moved forward with the maxmind plugin and moved to manual verifications. Unfortunately we found that this was a necessity especially if you are targeting the budget market. Anytime i see these types of issues they catch my eye because it hits close to home.

[stefand]

It would be interesting to hear what hivelocity have to say on the matter.


Seem to keeping quiet about the abuse threads.

[StealthyHosting]

I had the client suspended (due for investigation by my server admin), a response was made and contact with Steve regarding the warnings I had received.

What did this response/contact with Steve say? If it said you terminated the VPS sending spam I would assume they would un-null the IP. Why would you not attempt to ping out of the box to confirm it was nullrouted while investigating this? or disable network services on the VPS.

[Spluut]

Originally Posted by StealthyHosting

What did this response/contact with Steve say? If it said you terminated the VPS sending spam I would assume they would un-null the IP. Why would you not attempt to ping out of the box to confirm it was nullrouted while investigating this? or disable network services on the VPS.

He never responded to me until today, needless to say he simply repeated what had already been said to me by the abuse department.

I did not state the VPS was terminated, just questioning the actions and warnings.

The box was pinged and at the time was null routed.

[semoweb]

They have representatives on this forum, I am sure they will look into your ticket and shed some light.

[Wintereise]

....lol, priceless.

[webhostmaniac]

Well Jay is their Sr. Sys admin and he is a true guy and got me fixed up many times back in '06 and I know that he makes good choices. It is extremely difficult to have ips remove from all black lists and by allowing the spam to be sent out you are affecting their ips and network. It's the hosts responsibility to handle spam issues not the datacenters.

[dthigpen]

Why would you turn the VPS back on? Why didn't your admin just mount the file system and investigate the init scripts and server daemon configurations to see what was going on? What he did was extremely irresponsible and in no way falls under due diligence.

I can definitely see HV's side on this one.

[Spluut]

Originally Posted by dthigpen

Why would you turn the VPS back on? Why didn't your admin just mount the file system and investigate the init scripts and server daemon configurations to see what was going on? What he did was extremely irresponsible and in no way falls under due diligence.

I can definitely see HV's side on this one.

The IP was null routed and it was only for a short time. Somewhere between this time the IP had apparently been restored without notification.