How should hosts handle abuse reports involving resellers?

[NiceNIC Team]

Abuse reports can be complicated when a service is managed through a reseller.

The issue might be hosting, email, DNS, domain abuse, or website content.

What workflow works best for hosting providers? Contact the reseller first when they can fix it, but act directly when the issue is clear, serious, or ignored?

 

[VanessaChuuy]

1. Verify the abuse report is real and from a legitimate source.
2. Identify which reseller owns the involved IP/account.
3. Forward the report to that reseller with a clear deadline to respond or fix it.

 

[NiceNIC Team]

Thanks, Vanessa. I like the deadline part. If there is no clear time limit, the report just keeps moving between the host, reseller and customer while the problem stays there.

 

[NelaKola]

Best answer

I think that if the reseller is active and has control over the account, giving them the first chance to handle it makes sense. But the host still needs visibility and clear escalation rules, because some abuse cases can damage the whole network reputation. The biggest issue I’ve seen is when everyone assumes someone else is responsible and nothing actually gets resolved. A defined process helps avoid that.

 

[NiceNIC Team]

NiceNIC Team

Thanks NelaKola, I agree.

That clear owner for the case makes a big difference. Otherwise it is too easy for everyone to think the next person is handling it.

 

[Harry P]

Harry P

The biggest issue I’ve seen is when everyone assumes someone else is responsible and nothing actually gets resolved.

That gets solved faster if you sort abuse by response time rather than by who owns the account. Phishing pages and active malware come down first and get explained afterwards, because every hour they stay up is another hour your IP range collects reputation damage you will spend weeks undoing. Spam complaints, DMCA and content disputes can take the slower route through the reseller with a deadline attached.

The other thing worth checking is where the abuse contact for your IP block actually points in the RIR record. If it points at you, you are the one the upstream and the blocklists chase no matter how the account was sold downstream. Reseller-first is a courtesy you extend, not a shield you hide behind.

 

[NiceNIC Team]

NiceNIC Team

Thanks Harry, this is a helpful way to look at it!

If the report points back to the host, people outside will not really care that the account came through a reseller. I also agree phishing or malware needs faster action, while spam, DMCA, or content disputes can usually give the reseller some time to handle it. We are also doing like this.

 

[Harry P]

Harry P

If the report points back to the host, people outside will not really care that the account came through a reseller.

The case that will test the process is the one where the reseller goes quiet, or where the reseller is the problem. Suspending their whole account solves it in one click and takes thirty innocent customers down with it, so you want per-domain and per-account suspension working in your panel before the day you need it.

The other thing worth setting up early is a timestamped log of every report and what was done about it. Delisting from a blocklist is quick when you can show the report arrived at 09:14 and the account was off at 09:31, and it turns into weeks of arguing when all you can say is that you handled it. That same log settles any reseller dispute about whether they got a fair window. Worth writing the escalation terms into the reseller AUP as well, so acting directly on their customer is something they signed rather than something they discover.