[Solved] Suspended: Josybrew (Cpanel Username)

[McCozza]

Hi,

 

My website is 'wacc.heliohost.org'. I can't see any reason why it would be suspended. Can you please re-instate me ASAP?

 

thanks,

 

Nick

 

p.s I think my website was running on Stevie.

[Byron]

This support request is being escalated to our root admin.

[McCozza]

Just to be clear my cpanel user name is 'josybrew' and my domain is 'wacc.heliohost.org'. The 'Watford Against Climate Change' site name is just a local Watford (UK) based grass-roots community entity. We just meet in a pub once a week to discuss our concerns about climate change.

 

thanks, Nick

[McCozza]

Hi,

 

I really need an answer on this. I've spent quite a lot of time getting this site up and running and now this. Please help.

 

thanks, Nick

[wolstech]

Krydos sometimes takes several days or even a week to respond to these posts. Please be patient.

[McCozza]

Hi,

 

This is nearly a week now. Can someone raise the priority on this. I at least want to be told the reason for Suspension. But I can't see any reason why it was done.

 

thanks, Nick

[wolstech]

The reason was because we received an abuse report from our provider for your account. We're obligated by our provider to suspend accounts that get reported. The report itself suggests that it's for sending spam...in some cases you can get unsuspended if you fix the source of the spam (often it comes from hacked software on your account, Joomla and WordPress and dubious themes/plugins for them are a leading cause for instance), but its up to Krydos to decide that.

 

Krydos has been known to disappear for long periods due to lack of time, and it's worth noting that everybody here is volunteer too. Back in November we had people who waited close to 2 weeks for him.

[McCozza]

Is the report related to cpanel activity on username 'josybrew' ? Or activity related to the associated site 'wacc.heliohost.org' ? Just before the site got suspended the only thing I changed was to add an email account via cpanel. And on the site 'wacc.heliohost.org' to add content moderation so users can't post profane/spam/inpappropiate contenet. I use the 'Mollom' module from Drupal to do that. I did test it by posting content that contained swear words and sure enough my site blocked the content. Maybe the report went to Mollom and then...?

 

thanks, Nick

[McCozza]

Can you please provide an update on this? It's now been 3 weeks suspended. I can't see how my site is doing anything wrong. It's just using Drupal core code and I have similar sites running for years on heliohost without any issues. I can't see how I can fix any problem if you don't allow me to login to my site and cpanel and see if I can spot anything. And I can't see how I can fix a problem if you don't give me specific details about the allegation.

 

Thanks, Nick

[McCozza]

Hi, I've just realised the 'settings.php' file on my site may still be writable. I think I forgot to make it read-only. So I'll need at least my cpanel 'josybrew' user to be re-enabled so I can put that right. Please help. Thanks, Nick

[Krydos]

Here is the report we received regarding your account:

We have received a complaint about your account. Please investigate and fix within
24 hours.

Hurricane Electric Abuse Department
support@he.net

From scomp@aol.net  Sat Dec 13 14:39:01 2014
Return-Path: <scomp@aol.net>
X-Original-To: report@abuse.he.net
Delivered-To: report@abuse.he.net
Received: from smr-m2.mx.aol.com (smr-m2.mx.aol.com [64.12.232.218])
       by abuse.he.net (Postfix) with ESMTPS id 1F1EB540302
       for <report@abuse.he.net>; Sat, 13 Dec 2014 14:39:01 -0800 (PST)
Received: from scmp-m004.mail.aol.com (scmp-m004.mail.aol.com [172.29.110.247])
       by smr-m2.mx.aol.com (AOL Mail Bouncer) with ESMTP id 7EE97380006C8
       for <report@abuse.he.net>; Sat, 13 Dec 2014 17:39:00 -0500 (EST)
Received: from scomp@aol.net by scmp-m004.mail.aol.com; Sat, 13 Dec 2014 17:38:55 EST
To: report@abuse.he.net
From: scomp@aol.net
Date: Sat, 13 Dec 2014 17:38:55 EST
Subject: Email Feedback Report for IP 65.19.143.2
MIME-Version: 1.0
Content-Type: multipart/report; report-type=feedback-report;
boundary="boundary-1138-29572-2659438-25559"
X-AOL-INRLY: stevie.heliohost.org [65.19.143.2] scmp-m004
X-Loop: scomp

--boundary-1138-29572-2659438-25559
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

This is an email abuse report for an email message with the message-id of
E1XzvHW-0003hq-TD@stevie.heliohost.org received from IP address 65.19.143.2 on Sat,
13 Dec 2014 17:35:11 -0500 (EST)

For information, please review the top portion of the following page:
http://postmaster.aol.com/Postmaster.FeedbackLoop.php

For information about AOL E-mail guidelines, please see
http://postmaster.aol.com/Postmaster.Guidelines.php

If you would like to cancel or change the configuration for your FBL please use the
tool located at: 
http://postmaster.aol.com/SupportRequest.FBL.php


--boundary-1138-29572-2659438-25559
Content-Disposition: inline
Content-Type: message/feedback-report

Feedback-Type: abuse
User-Agent: AOL SComp
Version: 0.1
Received-Date: Sat, 13 Dec 2014 17:35:11 -0500 (EST)
Source-IP: 65.19.143.2
Reported-Domain: stevie.heliohost.org
Redacted-Address: redacted
Redacted-Address: redacted@


--boundary-1138-29572-2659438-25559
Content-Type: message/rfc822
Content-Disposition: inline

Return-Path: <nick@wacc.heliohost.org>
Received: from stevie.heliohost.org (stevie.heliohost.org [65.19.143.2])
       (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
       (No client certificate requested)
       by mtaig-mad06.mx.aol.com (Internet Inbound) with ESMTPS id 26984700000A6
       for <redacted@aol.com>; Sat, 13 Dec 2014 17:35:11 -0500 (EST)
Received: from redacted by stevie.heliohost.org with local (Exim 4.80)
       (envelope-from <nick@wacc.heliohost.org>)
       id 1XzvHW-0003hq-TD
       for redacted@aol.com; Sat, 13 Dec 2014 14:35:01 -0800
To: redacted@aol.com
Subject: deleteMe has created an account at wacc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed; delsp=yes
Content-Transfer-Encoding: 8Bit
X-Mailer: Drupal
From: nick@wacc.heliohost.org
Message-Id: <E1XzvHW-0003hq-TD@stevie.heliohost.org>
Date: Sat, 13 Dec 2014 14:34:57 -0800
X-AntiAbuse: This header was added to track abuse, please include it with any abuse
report
X-AntiAbuse: Primary Hostname - stevie.heliohost.org
X-AntiAbuse: Original Domain - aol.com
X-AntiAbuse: Originator/Caller UID/GID - [40256 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - wacc.heliohost.org
X-Get-Message-Sender-Via: stevie.heliohost.org: authenticated_id: redacted/from_h
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/redacted/public_html/index.php 
X-Source-Dir: wacc.heliohost.org:/public_html
x-aol-global-disposition: G
Authentication-Results: mx.aol.com;
       spf=none (aol.com: the domain wacc.heliohost.org appears to have no SPF Record.)
smtp.mailfrom=wacc.heliohost.org;
x-aol-sid: 3039ac1addc6548cbf1e1ede
X-AOL-IP: 65.19.143.2
X-AOL-SPF: domain : wacc.heliohost.org SPF : none

You need to activate her! Follow this link,

http://wacc.heliohost.org/admin/people

, and unblock.

--boundary-1138-29572-2659438-25559--

I can understand why it got reported as spam. "activate her" sounds like a phrase that would be used in a spam email. As a word of warning, I would be really careful sending emails to anyone that actually still uses @aol.com address because either AOL is really crazy about spam or their users report everything they receive as spam. Either way we get a lot of reports from them.

 

Your account has been unsuspended. Please be more careful to not send emails that could be confused for spam.