Some of you are VERY knowledgable when it comes to various elements, and was hoping that some of you are aware of various legal aspects of the hosting market. I could really use the help :P


A new client/e-friend of mine was recently contacted by Host A (I'm trying to leave this as anonymous as possible for obvious reasons) and was told that Host A was seeking legal advisory as well as contacting their local authorities due to the nature of the issue at hand as well as filing prosecution.

Yeah, as vague as that was, was how Host A's first e-mail to my friend looked.

Anyway, she e-mailed them asking for proof of what happened since they were quite vague.
She made the mistake of saying that she wouldn't be able to pay that much, but would be able to make minimum payments of possibly $10 a month or something. She then received a reply back saying that she owed $XXX.XX amount because of what happened and would be required to pay within 3 months.

Finally they sent her some factual reports of the incident and according to the PDFs that they sent, someone used one of Host A's servers to DDoS/brute force other servers, as well as trying to hack into someone's shopping cart on another server. The other issue was the server being used to send out spam (nigerian scam!).

My friend has a shared account with Host A. And according to this PDF report that was sent, the IP address doesn't even match what Host A created her account on. Whois also shows a different IP address then what is stated in the PDF complaint.

Host A has no policy that states that the client is liable for any damages and fees from resulting spam/hacking/server compromises. They have no AUP, and their Privacy Policy doesn't have any mention of this either.

Their TOS only states that they prohibit websites that engage in illegal activities, etc etc.

The other big problem I have right now is the fact that their TOS uses INC with their host name, but the rest of their website has LLC. I've been trying to look around for proof of this, but so far they exist in no busines database for the state they are apparently located in.

I told my friend to send in an e-mail letting them know that all future correspondence was to go through her legal adviser that she contacted after receiving the first threat of legal action, and also told them that she was revoking her previous statements of making payments, as she was not fullly made aware of the legal allegations and was just flustered with the e-mail.

Anyway, I then received an e-mail from the person that contacted her and he basically said that there was a change in the situation, and that they will be spending more time with the account in question. They also stated that they the investigation would take up to 3-6 weeks, and until then they were waiving the fees that were originally sent to her.

So right now I want to know exactly what legal right they have make her pay. The IP address that the Data Center provided to Host A doesn't even match her shared IP address. They didn't also provide a path to where the scripts were stored.

She can't log into her account because they've terminated her account, so she has no way of actually seeing something "tangible" in her personal domain account.

Any other advice?

It sounds like she ran into a crappy host, without knowing full details (like who the host is).

My advice would be to take the domain, throw it up on a new host, and be done with it. If the host continues to harass her, tell her to tell them to take it to court and she'll dispute the charge (it'll likely be out of the host's jurisdiction, so they won't follow up in all likelihood.)

Well, this isn't just some shared services only host. This is a host that's been in business since 2004 I guess, and they do offer shared-dedicated servers.

She can't take the domain anyway. They registered it, and will not release it to her. She doesn't even want to deal with it, and just basically let her hosting with them die. They terminated her account.

She's got a new account with me anyway, but that really wasn't the main concern..

But so far with having her refer them to me for future correspondence they've dropped the charges pending this so called investigation.

Anyway, the host in question is Frozen Midnight Hosting "LLC"

I'm guessing that this is some sort of spam/scare tactic that they use with clients. Namely because the IP address did not match up at all for her account, so no doubt Soft Layer is charging FMH fees for the damage that was caused to their servers (other soft layer servers were the target) and are trying to hit unsuspecting clients with the fees.

Fees that would pay for two courses at community college...

Sounds about right to me. I'm looking at this FMH site now...what a joke. This is exactly the kind of company that would try a stunt like this.

Doesn't surprise me that they dropped the charges...they'd have to supply burden of proof, and in 99% of cases there's nothing a customer would run that would have the security hole in question. Dirty pool, but nothing in it that's unusual, sadly.

It's shocking anyone would do anything like that to someone to be honest ok we all need to earn a living but taking money of people for a bad reason it's a crime it's a thugs game and it makes them as bad as someone who would use crime to get money.

Shocking makes you wonder how people like that can sleep at nigh doesn't it??

~Rick~

Hi. I found this post by googling and I seem to have a similar problem. I signed up with Frozen Midnight on June 5th 2007 and I recieved an email from Frozen Midnight yesterday and today stating that I owe $267.84 for damages/security. I am being accused of phishing (not sure what that is so I dont know how to do it). I have already paid upfront for a years hosting and I dont know why I am being charged this amount. Can they do that?
I dont remember seeing any thing stating that I would be charged for this kind of situation.
My website has been suspended but it was only a personal blog site with my photoshop icons, banners etc. So I dont know what it is I have done.
Are they trying it on?
Thanks,
Lisa

In addition, I keep emailing Frozen Midnight to ask what I have done and they will not respond. They just keep sending me the same invoice to all my emails which is getting rather annoying. Can anyone here suggest anything?
Thanks.

have you called their number? 1-888-219-2440

I don't see how they could force you to pay.

I can only email them because they are an american company and as I am from the UK, it would cost a fortune. Ive had hosting several times in the past and never come across anything like this. Its like they have waited until I cannot get a refund (30 day thing) and sprung this on me. Very bad service imo.
Thanks anyway.

Originally Posted by Psychonetic

Hi. I found this post by googling and I seem to have a similar problem. I signed up with Frozen Midnight on June 5th 2007 and I recieved an email from Frozen Midnight yesterday and today stating that I owe $267.84 for damages/security. I am being accused of phishing (not sure what that is so I dont know how to do it). I have already paid upfront for a years hosting and I dont know why I am being charged this amount. Can they do that?
I dont remember seeing any thing stating that I would be charged for this kind of situation.
My website has been suspended but it was only a personal blog site with my photoshop icons, banners etc. So I dont know what it is I have done.
Are they trying it on?
Thanks,
Lisa

Hey Lisa,

I'm still helping my friend resolve this, so if you could shoot me an e-mail to j.miskowicz _at_ holdfire _dot_ net I would really appreciate this. A few of us are trying to get more information to find out if other people have been falsely accused along with being threaten with legal action/fees.

In my opinion, they are scamming you both.

First, a DDOS is a Distributed Deny Of Service.
How could 1 server, and their server even, make a ddos on another of their server ?
Simply put, if this is true, they have got the server compromised, and it's their liability.
You are not responsible for the hoster server security, they are.
Point.

Second, for Lisa, phishing is trying to lure someone to give access credential by creating a fake site that look like the original.
I often receive fake Paypal email, asking me to confirm my login informations.
When people simply click on the link in the email, they are taken on a page that looks like paypal, but isn't.
So, when they try to login, they basically give the scammer the login for their paypal account.

Once again, if they got their server compromised, anyone could have put such pages on it.
You are not responsible for it.

hack into someone's shopping cart

I'd be eager to know how they noticed it....
How could they monitor what tried to do someone in real time (because if they tried to phish a shopping session, they must have seen it. This don't leaves traces in log files.) ?

Those are total bullsh*t, and if I where you, I'd do nothing but sends them attorney / legal counceling (As I'm a french speaker, I'm not sure about the English exact term), and I'll threaten them to drag them to a court if they don't comply to a couple of simple things:
1) Release back the content of the site. Legally speaking, it's Intellectual property tied to you.
2) Release any hold they have put on the domain name. You buyed it, and even if it's through them, you still own it. Here, In my country (Switzerland), even if you don't have fully payed for something, you own it, and the vendor have no right to hold it against payment.
3) If all there are hosting payed in advance, I'd try to get it back.

It may seem hard, or harsh, but last time I had a situation like this, 3 polite emails brought no response, but 1 from an lawyer (Or almost, a friend of mine doing a stage at this time ) made them comply in less than 5 hours.
It may be worth a try.

Plus, attitude like that really make me *****y.
I simply have to do something about it.

Tripy, if you're refering to me with "you both" don't worry about me. I already knew this was a huge scam once I saw that their information didn't properly correlate with the server my friend was actually hosted on.

Once again, if they got their server compromised, anyone could have put such pages on it. You are not responsible for it.

Unfortunately a user can in fact be responsible for damages incurred from a hack/etc. This is especially the case if the hosting company has a tight knight Terms of Service/AUP policy set in place.

This would also mean that they would not responsible for the termination of your account if you agreed to it when you purchased hosting from them. FMH specifically states that the site can be terminated upon breaking the TOS, and that backups are not their issue should anything happen. Once it's lost, it's lost.

Either way, if this is a scam or not, I still want Lisa to contact me. Like I said, some friends of mine are trying to put a huge thing together to get people to realize that they should not go with FMH and to leave them ASAP unless they want to fall victim to scandals.

You're right...

I didn't thought of that.
But in that case, they could bring anything up.
Virtually any php script might have vulnerabilies, and they even can be brought because of an not up to date php installation.
So this could still be debated.

Good luck in helping your friend get her site back.
And so to Lisa.

Wow. I cannot believe what I am reading.

This sure does sound "phishy" alright. I bet FMH got into some trouble and they
are trying to get a handful of customers to help them out of it. Little do they know, this won't work! This is the web and we are all connected so to speak.

I am sure more "victims" in this scam will be coming forward soon and I can't wait to see how this turns out.