What counts as abuse

Clause 9.2 of E2E’s Terms of Service sets out what counts as abuse. Knowing what the Terms of Service prohibit, and how to stop an attack, phishing, spam, or copyright infringement on a node, helps you answer a complaint in time. If the activity is still going on 24 hours after E2E’s email about a complaint, clause 9.2.3 lets E2E suspend your services. When you have a complaint to answer, follow Respond to an abuse complaint.

What the Terms of Service prohibit

The Terms of Service prohibit, among other things:

• Sending spam.
• Hosting or spreading malware.
• Infringing copyright or trademarks.
• Impersonating others.
• Attacking or exploiting any network, including through botnets or denial-of-service attacks.

They also count the following as abuse of service:

• Hosting DDoS attacks or attack scripts.
• Running open proxies, open mail relays, Tor exit nodes, or open recursive DNS resolvers.
• Crawling or monitoring other people’s systems without their permission.
• Interfering with E2E’s services.

Mining cryptocurrency, or running applications whose main purpose is mining, needs E2E’s written approval. When E2E finds mining without approval, the Terms of Service say you can expect E2E to close the account or remove the service.

You are responsible for what your own users and customers do on your services. When you learn of prohibited activity, stop it at once, and cut their access if you need to.

Abuse types in Abuse Logs

Every complaint in Abuse Logs has an Abuse Type, which is one of:

• Abuse Complaint
• Phishing Complaint
• Spam Complaint
• Copyright Complaint
• Online Streaming Complaint
• IP Blacklisted
• Malicious Complaint

To see what a complaint is about, read E2E’s report on it, which you download from Abuse Logs. See Download the report.

Stop an attack or clean up a compromised node

A node that sends attacks to other systems has usually been compromised: someone has gained access to it and runs their own processes on it, often through a leaked SSH password or key, an injected script on a website, or a vulnerable service. Malware on a node can attack other systems, mine cryptocurrency, send spam, or wait quietly as a back door for an attacker.

Start by finding out how far the compromise goes. List the running processes with ps. If suspicious processes run as root, treat the whole node as compromised: create a new node, move your data and services to it, and delete the old one. If E2E has blocked the old node, you can delete it once E2E removes the block.

To clean up a node that you keep:

1. Stop the suspicious processes, and remove the files they run from.

2. Turn off every service you do not use.

3. Block all outbound connections from the node until the malware is gone, or stop all services so that no attack can leave the node.

4. Look for suspicious files in your web root and for unexpected cron entries.

5. Look for recently changed files. For example, to list PHP files changed in the last seven days under the current directory:

   find . -name '*.ph*' -ctime -7

6. Look for file names with unusual extensions.

7. Scan the whole node with a malware scanner, such as the open-source maldet.

8. Read the logs of SSH, the web server, and every other service on the node to find out how the attacker got in, and close that way in.

To make the node harder to break into afterwards:

• Sign in with SSH keys, and turn off SSH password sign-in. See Manage SSH keys.
• Run a malware scanner, such as maldet, on a schedule.
• Protect public websites with a web application firewall, such as ModSecurity, or a service that provides one.
• Use a rootkit detector or a file integrity tool, such as Tripwire, to catch suspicious changes.
• Back up the node regularly.

Remove a phishing site

A phishing site imitates a trusted organisation, such as a bank, to trick people into giving away their passwords or other sensitive information. On a server, phishing pages are usually uploaded through a weakness in a website or another service.

To remove a phishing site and keep it from coming back:

1. Scan the node with antivirus and malware scanners first.
2. Look for suspicious files and folders, and remove the phishing pages.
3. Read the email sent to your webmaster and admin addresses for notices from organisations that monitor the web.
4. Check Security issues in Google Search Console for reports of deceptive content on your sites.
5. Secure the user account that hosted the pages: change its password, sign in to it with SSH keys, and update the node’s packages.

Stop spam from a node

Spam is unwanted email sent in bulk to people who did not ask for it. Besides the complaint itself, spam can stop your real email, such as order confirmations, from reaching your customers.

To stop it, find the source first. It is usually a mail server that relays mail for anyone, a compromised node, or an email account with a leaked password. Close the relay, change the leaked password, or clean up the node as described in Stop an attack or clean up a compromised node. Then help receiving servers trust your mail:

• Publish SPF and DKIM records for your domain, so that receiving servers can check that mail from your domain is yours. See Set up email records.
• Give your mail server’s public IP address a reverse DNS name with Add Reverse DNS. See Set up reverse DNS.
• Check whether your mail server’s IP address is on a known spam blocklist.
• Limit how many emails you send each minute.
• Keep a log of every email your applications send.
• Send only to people who asked for your email, send from an address that someone reads, and give every message a one-click unsubscribe link.
• Ask your recipients to add your From address to their address books.
• Watch your postmaster and abuse addresses, and read the bounces and replies you get.
• Once the spam has stopped, ask the postmaster at a large mail provider that blocks your mail to accept it again. Postmasters are more willing to help when your recipients asked for your email and can unsubscribe in one click.

Deal with a copyright complaint

A copyright complaint says that content on your node infringes someone’s copyright. That content can be a web page on your site, a song or film downloaded to the node, or software that is not licensed for your use.

To deal with a copyright complaint:

1. Read the complaint and check whether it is legitimate. If it is, remove the material.
2. Read your web server and SSH access logs to find out whether copyrighted material was downloaded to the node. Remove it, and stop it from being downloaded again.
3. Check the licence of every piece of software on the node, and make sure your use meets the vendor’s terms.

Whatever the complaint, once you have stopped the activity, tell E2E what you found and what you did by replying on the complaint’s Abuse ticket. See Reply on the Abuse ticket.