HF PanelAbuse desk
Collect abuse complaints from email, a public form and the API, link them to accounts, notify customers and suspend with one click.
The abuse desk collects complaints about your customers — spam, phishing, malware, copyright problems, attacks — in one inbox. Each complaint is read for the IP address, domain, web address and time it is about and linked to the hosting account they belong to. From there you notify the customer, answer the reporter, keep notes and suspend with one click.
Where: Server Admin › Security › Abuse desk
How complaints arrive
| Way | How it works |
|---|---|
Mail to abuse@yourdomain.com (the role address of the panel's own domain). Turn on Collect complaints sent to under Settings: a copy of every message is then delivered to the mailbox hf-abuse@yourdomain.com (it shows under Server mailboxes) and read here every 5 minutes. abuse@ keeps forwarding where it did. |
|
| Spam reports (ARF) | Feedback-loop reports from mailbox providers sent to the same address are read field by field: feedback type, source IP, original sender, arrival date, reported domain and web address, and the reported message itself. |
| Web form | The public Report abuse page at https://panel.yourdomain.com:8443/?r=abuse-report (no sign-in). At most 5 reports an hour from one address. Switch it off with Public report form. |
| API | Other systems send complaints with POST /v1/abuse — see Abuse desk and DNSSEC API. |
| By hand | Settings › Add a complaint by hand, for one that came by phone or letter. |
Messages in the intake mailbox are marked read once they are fetched; nothing is deleted. The same email is never added twice, and automatic replies are skipped.
How a complaint is linked
The panel looks, in this order, for:
- a domain of the server among the host names in the complaint (from web addresses, email addresses, a spam report's reported domain and original sender, and the text) — a subdomain counts for its domain;
- a dedicated IPv6 address among the IP addresses.
The complaint then shows the account and how it was linked (for example domain sarahbakes.co.uk). When nothing
matches, it says Not linked; type the username under Linked account and click Save.
Work on a complaint
Click a complaint to open it. The list has tabs for Open (new and waiting), New, Waiting for customer, Resolved and All, and a search over domain, IP, account and reporter.
| Action | What it does |
|---|---|
| Status | New, Waiting for customer or Resolved. |
| Notify the customer | Emails the account's contact address. Pick a template; {account} {domain} {url} {ip} {when} {id} {brand} are filled in. Sending sets the status to Waiting for customer. |
| Reply to the reporter | Emails the reporter, when they left an address. |
| Add a note | Only staff see notes. |
| One-click actions | Stop the account's outgoing email (its mailboxes and websites), Suspend the website (visitors see a page saying it is unavailable), Lock the mailbox (a new random password; the customer sets a new one to use it again), Suspend the account (until it is unsuspended under Accounts). |
Everything appears on the complaint's Timeline and in the Activity log.
Settings
- Collect complaints sent to — the email intake (needs email on the server).
- Public report form — the web form, with its address to copy.
- Resellers see and handle their own customers' complaints — resellers then get the Abuse desk in their menu, with the complaints of their own customers only, and can use the same actions on them.
- Customer notice templates — the texts of the notices: spam, phishing page, malware, copyright, attacks and a general notice. Empty both fields of a template to go back to the default.
Hooks
abuse.received, abuse.status_changed and abuse.action — see Event hooks.