3 ms·

this will happen at any responsible web host. If you are hosting phishing sites, expect to get taken down. This trickles up. if you run a hosting company,

by lsc 16y ago

this will happen at any responsible web host. If you are hosting phishing sites, expect to get taken down. This trickles up. if you run a hosting company, and you get enough complaints that you don't deal with, then yeah, you will get shut down or asked to leave. That said, I think especially for higher-priced services, a phone call would be nice. (Note: I don't call my customers, though this is a policy I've considered implementing.) I'd be interested in what other people think about other notification systems.

oomkiller 16y ago
I don't think the issue is that he was hosting an active phishing site. The main issue here is the amount of time he was given to fix the problem was too small. You think Rackspace's upstreams would shut the pipes down if there were a bunch of phishing sites that set up shop? Doubtful. Usually they only get involved when there is a MASSIVE DDoS.
- lsc 16y ago
  Well, from my experience in industry, big providers of bandwidth do apply pressure (up to and including the threat of disconnect) to large hosting companies in an effort to get them to clean up their act, even when it comes to things like spamming and phishing that are less outright destructive to the network than DDoS activity. You are right that a million dollar customer will get a lot more slack than a twenty dollar user... but, uh, to me that should be expected. Dealing with abuse is very expensive. Some places I've worked that has been the majority of support costs.
ntoshev 16y ago
What do you think about granularity of filtering: do not take all your customers' servers down, just filter the offending pages/services at network level until they sort it out.
- lsc 16y ago
  again it's a matter of cost. If you only have one IP, and say, many domains on that one IP, only one of which is a phishing site, it is a /whole lot/ of work for me (who really can only mess with things at the network level) to selectively take out one domain or one url. I mean, it can be done, but the equipment and expertise required to pull it off would drive up my costs. Now, if I was a 'fully managed' provider that had a login on all my customer boxes, in that case, assuming the problem was a customer of a customer phishing rather than a compromised server, it would be fairly easy to log in and fix it. But that's not how I'm set up.
chopsueyar 16y ago
What if you are not hosting phishing site, but a single person alleges you do host a phishing site? Should that distinction make a difference?
- lsc 16y ago
  yes. these sorts of things need to be examined... this is a lot of why running an abuse desk is so difficult, because you /will/ get bogus claims. Most claims are fairly obviously legitimate. A few are obviously bogus, and a few really are questionable. It takes skill to know the difference, and mistakes are obviously quite bad for your reputation.

by lsc 16y ago

oomkiller 16y ago

I don't think the issue is that he was hosting an active phishing site. The main issue here is the amount of time he was given to fix the problem was too small. You think Rackspace's upstreams would shut the pipes down if there were a bunch of phishing sites that set up shop? Doubtful. Usually they only get involved when there is a MASSIVE DDoS.

lsc 16y ago
Well, from my experience in industry, big providers of bandwidth do apply pressure (up to and including the threat of disconnect) to large hosting companies in an effort to get them to clean up their act, even when it comes to things like spamming and phishing that are less outright destructive to the network than DDoS activity. You are right that a million dollar customer will get a lot more slack than a twenty dollar user... but, uh, to me that should be expected. Dealing with abuse is very expensive. Some places I've worked that has been the majority of support costs.

ntoshev 16y ago

What do you think about granularity of filtering: do not take all your customers' servers down, just filter the offending pages/services at network level until they sort it out.

lsc 16y ago
again it's a matter of cost. If you only have one IP, and say, many domains on that one IP, only one of which is a phishing site, it is a /whole lot/ of work for me (who really can only mess with things at the network level) to selectively take out one domain or one url. I mean, it can be done, but the equipment and expertise required to pull it off would drive up my costs. Now, if I was a 'fully managed' provider that had a login on all my customer boxes, in that case, assuming the problem was a customer of a customer phishing rather than a compromised server, it would be fairly easy to log in and fix it. But that's not how I'm set up.

chopsueyar 16y ago

What if you are not hosting phishing site, but a single person alleges you do host a phishing site? Should that distinction make a difference?

lsc 16y ago
yes. these sorts of things need to be examined... this is a lot of why running an abuse desk is so difficult, because you /will/ get bogus claims. Most claims are fairly obviously legitimate. A few are obviously bogus, and a few really are questionable. It takes skill to know the difference, and mistakes are obviously quite bad for your reputation.