We apply different abuse report review techniques based on a 'risk scale' for the IP being reported in question, which are as follows:
High Risk IPs
Criteria for this risk level:
New customer registrations, i.e. within the past 14 days
How we handle reports at this risk level:
Upon receiving an abuse report, the VM will be throttled to 2mbps bandwidth
The VM owner will be emailed a copy of the report and must respond within 1 hour
If a response is not received within 1 hour, the VM will be temporarily paused until a response can be received
If a response isn't satisfactory, i.e. the VM owner refuses to take down illegal content hosted on the server, the customer's account shall be suspended and the customer will get 14 days to extract data from their suspended services
Medium Risk IPs (Most servers fall under this risk level)
Criteria for this risk level:
Customer account has existed for more than 14 days
AND
Customer has a verified payment method
How we handle reports at this risk level:
Upon receiving an abuse report, the VM will be throttled to 10mbps bandwidth ONLY IF the abuse report is related to malicious network traffic i.e. DoS attacks.
The VM owner will be emailed a copy of the report and must respond within 24 hour
If a response is not received within 24 hours, the VM will be temporarily paused until a response can be received
If a response isn't satisfactory, i.e. the VM owner refuses to take down illegal content hosted on the server, the customer's account shall be suspended and the customer will get 14 days to extract data from their suspended services
Low Risk IPs
Criteria for this risk level:
Customer has a history of false abuse reports
OR
Customer has written permission from wedotyou to operate a service which breaks our Terms of service, such as a VPN service
How we handle reports at this risk level:
Upon receiving an abuse report, the VM owner will be emailed a copy of the report and must respond within 48 hours
If a response is not received within 48 hour, the VM will be temporarily paused until a response can be received
If a response isn't satisfactory, i.e. the VM owner refuses to take down illegal content hosted on the server, the customer's account shall be suspended and the customer will get 14 days to extract data from their suspended services
What counts as an 'unsatisfactory' abuse response?
If you can prove that the contents of a report:
Is fictitious, irrelevant, or false
OR
The abuse reported doesn't break our ToS
Then this is satisfactory. If you do have content hosted which does break our ToS, then you must remove it and not intentionally host it again. In the event that you have many abuse reports from UGC (user generated content), you must take steps to ensure that less abuse reports will be received in the future, i.e. by increasing moderation of your platform.