Abuse handlingFour kinds of report. Four different answers.

A copyright notice, a machine sending attack traffic, a phishing page and material we refuse outright are four unrelated problems. Almost every host answers all four by suspending the customer, because it is the cheapest reflex available. Here is what happens instead.

network abuse1 hour

The response matrix

Read by a person · Evidence shown to you · No automated enforcement

Intake

What arrives, and what it triggers.

Acknowledgement times are the ones we actually work to, not aspirations. The column that matters is the last one: what has to be true before a customer loses their service.

Copyright / takedown noticeFiled, answered, and passed to you with fourteen days to respond or migrate. Nothing is removed without an order from a court with jurisdiction over the entity that hosts you. 1 business day Forwarded to you in full, complainant named Never on the notice alone

Network abuse (attack, spam, open service)Almost always a compromised machine rather than a decision. We stop the traffic hurting other people first and work out what happened with you second. 1 hour Traffic filtered at the border, you are contacted Only if it continues

Fraud or phishing reportReports of phishing are frequently wrong or automated. A human loads the page and checks the claim before a customer loses their service over it. 4 hours Verified by hand before anything happens On confirmation

The two prohibitionsChild sexual abuse material and material that finances, directs or incites terrorist violence. No notice period, no refund, no argument, and the only case in which we act without an order. Immediate Verified, terminated, preserved for the authority with jurisdiction Immediately, without notice

An ordinary complaint, hour by hour

This is the path a takedown notice or a content complaint takes. The two prohibited categories skip all of it and are dealt with immediately.

01

Hour 0

It arrives and it is read by a person

Every report reaches a human. Automated notices are read too — they are simply read with the knowledge that nobody wrote them.
02

Within 1 business day

You get it, in full, with the complainant named

Not a summary and not an anonymised extract. You cannot answer a claim you have not seen, and you cannot answer a claimant you cannot identify.
03

Days 1 – 14

You answer, or you move it

Fourteen days to reply, to take the content down yourself, or to migrate it somewhere else. We will help with the migration even when the complaint is nonsense.
04

Day 14 onward

Nothing happens unless a court says so

A complainant unhappy with your answer has the same remedy they always had: a court with jurisdiction over the entity that hosts you. Correspondence does not become an order by being repeated.
05

On an order

We comply, narrowly, and we tell you

To the letter of what the order requires and no further — the named material, not the account. You are told unless the order forbids it, and an order that forbids it is an event this canary reports.

Making a report that works

Reports arrive at the abuse contact published in the RIR record for the address range and in the WHOIS for the entity concerned — the places an operator looks first, and the places that are checkable without taking our word for anything.

Include the evidence: Logs with timestamps and a timezone A line of log with a UTC offset is worth more than a paragraph of description. Without a timestamp we cannot match a flow, and a report we cannot match is a report we cannot act on.
Name the address: The specific IP, not the range A report against a /24 reaches everybody on it, most of whom are not involved. We will not act against uninvolved customers on a range-wide accusation.
Say what you want: Stopped, or removed, are different requests Traffic that should stop is a conduct question and gets an answer in an hour. Material you want removed is a legal question and gets the process on the no-DMCA page.
Expect to be quoted: Your report is forwarded in full Including your name and address. The only exception is the two prohibited categories, where the report goes to the authority with jurisdiction rather than to the customer.
Automated senders: Read, at the same speed as everything else We do not filter machine-generated notices, and we do not treat volume as urgency. Ten thousand identical notices are one complaint sent ten thousand times.
Emergencies: Marked urgent, and meant Genuine risk to life is reviewed the hour it arrives, at any hour. The handling and the count are on the law-enforcement guide.

What this actually looks like, last quarter

Q2 2026, from the same record as the transparency report. Published because a process nobody can check is a promise, not a process.

1,186

Takedown notices received

Removed on a notice alone

Terminated under the AUP

Law-enforcement requests

How this works in practice.

My server was compromised and attacked someone. Am I terminated?

No. The outbound traffic is filtered at the border immediately so it stops hurting other people, and then you are told what we saw — flows, timestamps, destinations. Being compromised is not misconduct; it is the most common thing that happens to a machine on the internet. You get help cleaning it up at no charge.

Do you suspend first and investigate later?

Only for the two prohibited categories, where the material is verified by hand and the service ends the same hour. For everything else a suspension requires either sustained conduct after a conversation or an order from a court with jurisdiction. A complaint on its own has never been enough here and is not going to become enough.

How do I know the evidence is real?

Because you get it. Any conduct finding comes with the flow records, the timestamps and the destinations that produced it, and if you think we have read them wrong you say so and a person looks again. Enforcement based on evidence we will not show you is indistinguishable from enforcement based on nothing.

What about reports from automated blocklists?

They are read like anything else and they carry no automatic weight. A third-party list has no ability to take a service down here — a human has to look at traffic and decide, and the decision is one we have to be able to justify to the customer.

Can I ask for a report to be escalated?

Yes, and the honest answer is that escalation changes who reads it rather than what the answer is. If the material is lawful where it sits and no court has ruled, the answer after escalation is the same answer, given by somebody more senior.

What happens to my data if a service is terminated?

For a conduct termination you get the notice period in the consequences section and the ability to take your data with you, plus any unused balance back. For the two prohibited categories the material is preserved for the authority with jurisdiction and nothing is returned.