| Posted by chas5427, 01-29-2013, 05:17 AM | | have been with innohosting for over 5 years. mostly happy with them - enough so that i moved another server to them last year. service on level 1 has been good.
however, have had two instances of escalated tickets recently where i am getting no response. the first was finally resolved. the second is in process - client account hacked and was suspended for email abuse. can understand suspension, but i am trying to get them back online and have no whm/cpanel access. last response to the ticket from inno in this regard was 12 days ago. also sent request for help to comments/feedback without response. noticed another similar post here.
over the years they have been my "go to guys" but at the moment am very frustrated and disappointed with the lack of response.
|
| Posted by net, 01-29-2013, 05:26 AM | | Did you follow what they told you?
It seems that your client spammed ?
|
| Posted by krizag, 01-29-2013, 05:33 AM | | Have they got phone support? You may want to try that.
|
| Posted by rv_irl, 01-29-2013, 08:45 AM | | Hi,
Please can you PM me your ticket ID so that I can look into this?
|
| Posted by chas5427, 01-29-2013, 09:40 AM | | hi -
thanks for the response krizag/net. i actually know this client personally so i am particular they were not the ones spamming. phone support is level 1 and they are glad to make notes but can't usually resolve escalated issues. and level 1 has always been very good.
thank you for the response rameen. ticket: GAP-193-30522
appreciate the help!
chas
|
| Posted by rv_irl, 01-29-2013, 10:06 AM | | Thanks Chas,
I'll respond to the ticket directly and get this squared away for you.
|
| Posted by ScottSwezey, 01-29-2013, 10:58 AM | | Obviously I'm not related to your host and cannot speak specifically about this situation, but it is very common for an account to be compromised and used to send spam. The account owner isn't the one sending it, but it doesn't change the fact that spam is being sent, the servers email reputation being hurt, and so on.
|
| Posted by chas5427, 01-30-2013, 12:21 AM | | hi scott - thanks for your thoughts . . . i totally agree. weak passwords impact more than just the customer. have been hosting for 10+ years and i take my responsibility in this situation seriously, too. and with rameen's prompt response i hope to have this situation resolved quickly.
chas
|
| Posted by param2, 01-30-2013, 08:41 AM | | Yes, I have been a happy customer for several years but they have NOT responded to emergency server/billing issue for the last 12 hours. I am not sure why they are taking such a long time to respond.
|
| Posted by Tuguhost, 01-30-2013, 11:15 AM | | param2 maybe because their billing didn't work 24 hours, most of billing department in hosting industri didn't work 24 hour in a day
|
| Posted by rv_irl, 01-30-2013, 08:32 PM | | As mentioned correctly by gueadi, our sales/billing is standard working hours. Last year we further extended this to provide full sales/billing coverage over weekends and all national holidays (which not too many hosts do), but it isn't staffed 24hrs as sales/billing issues don't require a response in just a few minutes.
But if it is an urgent issue, our customers can ring us up or hop onto live chat and ask one of the tech support staff to escalate the ticket. Our toll free telephone support and live chat is available 24x7.
|
| Posted by param2, 02-01-2013, 02:38 AM | | The problem is not related to billing but it was a misleading message shown by innohosting webserver as it was a billing issue. Yesterday, I got a reply from the support but it was not very convincing. My server is not yet restored.
Still no reply from the tech. support to my last message sent around 14 hours ago!
|
| Posted by rv_irl, 02-01-2013, 09:45 AM | | It's not a misleading message, it's the standard default suspension page.
When you send spam - the account will be suspended.
We provided you with the logs of the spamming incident, unsuspended the account and asked you to fix it. You asked us to move that account to another server - We told you no, we won't move you to another server because that's just moving the problem to another server. You need to fix it.
You don't have a server, you have a reseller account. There is no "restore" going on. Your account was sending spam, we suspended it. We asked you to fix it, you didn't - so we suspended it again.
Client Response Posted on: 31 January 2013 01:40 PM
Staff Response Posted on: 31 January 2013 01:43 PM
It wasn't 14hrs - we responded to you within 3 minutes.
|
| Posted by GreenValueHostGM, 02-01-2013, 10:00 AM | | Considering that your suspension was due to the fact that you were asked to stop sending spam and you ignored their request, you really can't complain about it.
Stop trying to slander InnoHosting, they did nothing wrong & they're very well respected web hosts.
|
| Posted by param2, 02-01-2013, 10:14 AM | | I didn't spam - period. I asked for a proof of any script (with email headers) to check if there was any hack attempt or malware. I asked for SMTP log but nothing was sent.
You were not even providing me a backup of files and database to investigate. You said you would send these files yesterday and no response yet. Do not say you responded within 3 minutes.
I am damn sure I didn't spam and you know that.
|
| Posted by param2, 02-01-2013, 10:19 AM | | Innohosting knows I did not spam. I suspected if there was any comprise or attack. However, the fact Innohosting is not co-operating for investigation - is making me think otherwise.
I have been using Innohosting for years because they were good. The way they were responding to support requests during the last couple of months is frustrating.
|
| Posted by rv_irl, 02-01-2013, 10:23 AM | | You did spam. We do not randomly pick an account out of a hat and decide to suspend the account.
You didn't ask for the smtp log otherwise it would have been provided to you. It was already in the ticket notes.
But we took it a step further and did the investigation you should have done. We provided you with the exact files and directories where the spam was sent out from, but you didn't even look into that.
I am checking your abuse ticket, and I see no such thing:
Here was your last response:
You sent us the above after we provided you the exact locations of where the spam was coming from and also gave you the opportunity to fix it.
And our last response - (3 minutes later) to you was:
And you haven't replied to it since.
|
| Posted by param2, 02-01-2013, 10:30 AM | | I replied several times to abuse@ account as given below
On Thu, Jan 31, 2013 at 7:33 PM, wrote:
Please let me know where I can get the files and database. I will move it to another server of my own.
On Thu, Jan 31, 2013 at 8:19 PM:
I am almost particular these urls will send fixed emails when an user tries to register. They are built on drupal - it's a stable platform and don't suffer from silly vulnerabilities.
I am disappointed that you are not able to provide a valid reason and smtp logs to justify the account suspension.
|
| Posted by param2, 02-01-2013, 10:39 AM | | RAMEEN:
I always use SMTP from particular X.X.*.* and if the SMTP log said something else, you could have simply blocked all other IPs.
If this could have been done yesterday, it would have solved our problem right way. However, I got very little co-operation.
|
| Posted by rv_irl, 02-01-2013, 10:50 AM | | You can visit support.innohosting.com, login and check for yourself our replies and your replies.
We provided you with:
1. The exact source of the spamming
2. The exact scripts responsible for the spamming
3. 24 hours to resolve the problem
Is that not a valid reason? Is showing you the spamming scripts on your account not enough for you to know those are being used to send spam? We provided you with 24hrs to resolve the issue, you didn't. If you think somehow the mail queue log is going to provide more insight, then sure - I've already added it to the ticket for you to look at.
It doesn't work that way. These are scripts, within your account, that we have pointed out - sending spam. Those scripts got there because you set your folders to have global read/write privileges - i.e. any body was able to upload whatever content they wanted because of the folder permissions you were using - the tech did explain this to you.
The scripts are sending out the spam - the IP is going to show as the server IP. This wasn't someone setting up Outlook and sending spam through their own computer. Because of the folder permissions you had set on your account, it allows anyone to upload content such as spamming scripts to send spam from the server under your account. We did explain this to you in detail in your ticket. Your IP address or anyones IP address has no impact or makes any difference.
|
| Posted by param2, 02-01-2013, 11:02 AM | | Unfortunately, I still have not got any sample email will full headers.
I removed the folder with 777 permissions.
I am using Drupal and the script path you forwarded just contains the drupal path.
Maybe, this spam is generated due to large number of fake registration attempts at my drupal website. However, without looking at a sample email that was being sent, I don't think a fix is possible. I don't find any co-operation for this.
|
| Posted by rv_irl, 02-01-2013, 11:07 AM | | I've posted the information you asked on your ticket, if you login at support.innohosting.com you can see those responses.
For your security, I don't want to post the ticket ID here, so please email me on rameen[at]innohosting.com and I'll send you the ticket ID and another copy of the email I sent you.
|
| Posted by param2, 02-01-2013, 01:11 PM | | QUICK UPDATE for other forum users:
I got the exim log extract from innohosting that showed some email messages generated due to fake sign ups in drupal based website.
However, not sure how these emails would be classified as spam. I asked Rameen to show where this server was blacklisted(was it spamcop, etc). I checked this ip using mxtoolbox but it was NOT at all blacklisted.
I am still waiting for a reply form Rameen and will update this forum after I get it.
I am going to dig deep further and will share the outcome to all forum users after that. As of now, I hope it was just due to some mis-configured spam detection somewhere.
|
| Posted by rv_irl, 02-01-2013, 01:55 PM | | You checked using the wrong tool.
Enter your server IP here:
http://mxtoolbox.com/blacklists.aspx
Spam is spam, regardless of how you view it or how it was sent. There is no "mis-configured spam detection". If you have a script that is sending out mail to people that didn't request that mail, it is spam. It doesn't matter if it was a sign up form that was compromised or you send it manually.
That's all fine and good. However you're not posting anything factual and a lot of it stems from you not understanding what we're trying to tell you. You said we took 14hrs to respond to a ticket when we responded within 3 minutes. You mentioned that we put up a billing page, but we didn't, we suspended the account.
In your tickets, we have been posting lengthy replies to try and explain to you the situation. We've spent an awful lot of time on this, more than we should be, yet here and in your tickets you're quite determined to somehow find a fault with someone else other than yourself. We didn't send any spam. Your account did. This has nothing to do with the configuration of anything on our end or anything to do something we have done. This is due to your actions/inactions that are causing this but rather than following our advice, listening to what we're trying to show you, you're spending more time posting inaccurate statements and trying to shift blame.
We're not here to play games - if you want the situation resolved, you're going to have to accept what has happened and follow the advice the technicians have spent so much time in providing you and resolve it.
|
| Posted by param2, 02-02-2013, 04:13 AM | | Here are some simple issues that puzzle me :
1) Why is that you are not sending me the backup and quicken investigation?? I am still waiting for days.
2) Why is that you don't have an alert system to notify users and you suspend accounts without notice? All other hosting companies have notification system to alert users and that help us from misuse of accounts.
|
| Posted by rv_irl, 02-02-2013, 07:26 AM | | The above is a good example of what I said before:
You continue to try and find blame with someone else. But the main point remains - why did you let this happen in the first place? There isn't anybody else to blame here. This is something your account was doing. Your account sent spam - we suspended it.
You continue to bounce around on different topics trying to find an issue with something and I've lost count how many different things you keep bringing up - trying to find a fault somewhere else instead of just realising and accepting that your account was the issue here. Notifications is something we do as courtesy, it's not something we advertise. Abuse issues are a breach of contract. It's given a low priority - our priority is to tickets where customers are not spamming and have not breached their contract.
|
| Posted by target, 02-02-2013, 08:37 AM | | param2 Why don't you try to read what Rameen is saying ... if your account is compromised it's only normal you have to fix it first before comming online again. It's not an 'Innohosting' thing, you would have the same reaction from any other hoster. So calm down, look into your scripting, find the error and fix it or let someone else fix it, inform Innohosting and your account will be online.
I don't know if they just suspended you and you had to find out yourself OR suspended you and send you the reason for suspending right away. I know if it's the first it does feel annoying.
@IH-Rameen Rameen, about the not responding. I had the same thing happening with me a few days back. Tought you didn't respond to my ticket and when i logged in i noticed you did respond. But i didn't recieive it in my mailbox as usual ?
|
| Posted by param2, 02-02-2013, 11:01 AM | | target Innohosting is not sending me the backup. How can I fix(if needed) without even access to the backup?
They just suspended the account and I had to find out.
I still feel it may not be correct to say that my account was comprised. It looks more like spammers finding a loophole to attack innohosting servers running drupal. Please note that I have done drupal installations for hundreds of clients in various hosting companies. I have seen this type of spam attacks but they have not suspended accounts for this reason. I guess these hosting companies are clever enough to filter incoming fake registrations based on some rules for the whole server. In fact, most of the attack would have come from IPs that are comprised.
In summary, if the backup of my account is provided, I can set it up in another server of mine and show it to the world how this has happened. And probably share the solution to other forum users. I still believe the solution can be applied for the entire server rather than on account basis.
|
| Posted by target, 02-02-2013, 11:13 AM | | Can't you login to your account with FTP? Just ask them to unsuspend your account so you can investegate the problem. It's better to work with someone in stead of against someone
I'm sure they'll provide you with a backup if you ask them, i don't see any reason why they shouldn't?
|
| Posted by param2, 02-02-2013, 11:31 AM | | target They told they would provide me the backup or some form of access nearly two days ago. I became suspicious because they seem to be delaying that.
Frankly speaking, I have handled much more complicated server issues for several clients over the last 17 years. I have always got good co-operation with hosting companies and never felt like taking the issue into public forum.
|
| Posted by IH-Chris, 02-02-2013, 03:07 PM | | Wow, and so it comes here
If you recall in your ticket I was first to offer you a backup at (EST)
31 January 2013 08:43 AM
01 February 2013 11:57 AM you requested for the backup
01 February 2013 12:33 PM replied and mentioned I will have the backup generated shortly
01 February 2013 12:44 PM it was noticed the account was your reseller account and asked if any of your other accounts were private so I could move the backup there
01 February 2013 10:03 PM you said none of the accounts were active and to just send the backup
This is such a simple task with mostly just finger pointing causing further delay. There was no 2 day delay and your ticket is an abuse issue in our abuse department. Please respond to your ticket with the information of where exactly you want the backup sent to so we can be on our way.
|
| Posted by Stuart_c, 02-02-2013, 04:27 PM | | no offense mate but it dont sound like u know much tbh. The host is trying to help out but ur not listening and keep blaming ur host for things u should be doing. if u know so much then why is ur drupal program being spammed??!!! Seriously though if u were one of my customers i would have booted u from the server. u come here moaning about ur host and saying bad things about them and then u expect them to help u as well .
|
| Posted by param2, 02-04-2013, 04:11 AM | | Please note that I almost decided to move out of them a few days ago since the quality of support was not good enough and today, migration is nearing completion. They sent me the backup atlast.
Again, I have a reason to believe that my account was not at all comprised. I will share my observation once my investigation is complete.
|
| Posted by rv_irl, 02-04-2013, 09:51 AM | | Param, you're still not posting the truth here. You didn't decide to leave at all. We cancelled your contract and told you to go find another web host. There is nothing wrong with our quality of support, we've posted our response times, and you're free to post your screenshots of your tickets to show the response times as well.
|
| Posted by target, 02-04-2013, 10:30 AM | | IH-Rameen Rameen, about the not responding. I had the same thing happening with me a few days back. Tought you didn't respond to my ticket and when i logged in i noticed you did respond. But i didn't recieive it in my mailbox as usual ?
|
| Posted by rv_irl, 02-04-2013, 10:41 AM | | That's odd. When we send a response a copy of it goes to a central mailbox at the same time and upon checking that mailbox, I can see email notifications are being sent. I'll have a closer look at your account to see where your ticket notification emails are going.
|
|
 Add to Favourites
 Print this Article
|
