{"id":13043,"date":"2026-08-23T22:38:54","date_gmt":"2026-08-23T20:38:54","guid":{"rendered":"https:\/\/mybox.com\/help\/?post_type=manual_kb&#038;p=13043"},"modified":"2026-08-23T22:38:58","modified_gmt":"2026-08-23T20:38:58","slug":"hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal","status":"publish","type":"manual_kb","link":"https:\/\/mybox.com\/help\/en\/knowledgebase\/hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal\/","title":{"rendered":"Hosting Abuse Warning Response Checklist: Evidence, Containment, Fixes, and Appeal"},"content":{"rendered":"\n<div class=\"translation-block translation-block-merged\">\n<p class=\"wp-block-paragraph\">A hosting abuse warning or suspension notice requires a prompt, documented response. Preserve evidence first. Then contain the affected website or mailbox, secure access, investigate the cause, and record each repair. A clear remediation report gives mybox the information needed to review the incident and consider reinstatement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 ez-toc-wrap-left counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal\/#1_Record_the_warning_and_start_an_incident_timeline\" >1. Record the warning and start an incident timeline<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal\/#2_Preserve_evidence_before_removing_anything\" >2. Preserve evidence before removing anything<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal\/#3_Contain_the_affected_services\" >3. Contain the affected services<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal\/#4_Reset_credentials_and_review_access\" >4. Reset credentials and review access<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal\/#5_Investigate_the_cause_and_remove_persistence\" >5. Investigate the cause and remove persistence<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal\/#6_Document_proof_of_cleanup\" >6. Document proof of cleanup<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal\/#7_Prepare_a_safe_reinstatement_request\" >7. Prepare a safe reinstatement request<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/hosting-abuse-warning-response-checklist-evidence-containment-fixes-and-appeal\/#Quick_checklist\" >Quick checklist<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_Record_the_warning_and_start_an_incident_timeline\"><\/span>1. Record the warning and start an incident timeline<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Save the full abuse notification, including the affected service, stated reason, requested action, and any deadline. Do not delete the message after taking action. Create a simple timeline with the time you received the warning and the time of each investigation, containment, credential reset, cleanup, and test.<\/p>\n\n\n\n<\/div>\n\n<div id=\"mybox-2807735813\" class=\"mybox-content mybox-entity-placement\"><div class=\"early-access-banner-inpost\">\r\n  <div class=\"banner-left-inpost\">\r\n    <div class=\"icon-box-inpost\">\r\n      <img decoding=\"async\" src=\"https:\/\/mybox.com\/help\/wp-content\/uploads\/2026\/02\/square-info-icon.svg\" alt=\"Info\">\r\n    <\/div>\r\n    <div class=\"text-box-inpost\">\r\n      <span class=\"label-inpost\"><span class=\"translation-block translation-block-banner-text\">Early access<\/span><\/span>\r\n      <h4><span class=\"translation-block translation-block-banner-text\">Still need help?<\/span><\/h4>\r\n      <p><span class=\"translation-block translation-block-banner-text\">Contact our customer service team.<\/span><\/p>\r\n    <\/div>\r\n  <\/div>\r\n\r\n  <div class=\"banner-right-inpost\">\r\n    <a href=\"https:\/\/panel.mybox.com\/helpdesk2\/v\/list\/\" class=\"banner-button-inpost\"><span class=\"translation-block translation-block-banner-text\">Message us<\/span><\/a>\r\n  <\/div>\r\n<\/div><\/div>\n\n<div class=\"translation-block translation-block-merged\"><p class=\"wp-block-paragraph\">Note the symptoms that led to the warning. Common signs of a compromised website include unexpected redirects, browser security warnings, unusual files on the server, spam sent from the account, and alerts from search engines or security tools. These signs are described in <a href=\"https:\/\/mybox.com\/help\/knowledgebase\/how-to-investigate-and-clean-a-compromised-website-using-ssh\/\">mybox&#8217;s SSH investigation and cleanup article<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Preserve_evidence_before_removing_anything\"><\/span>2. Preserve evidence before removing anything<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Preserve the available logs, suspicious files, warning messages, and relevant account information before deleting or replacing files. Keep original copies in a separate location when possible. Record file names, paths, timestamps, and the reason each item appears suspicious.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Web server and mail logs can help identify script execution errors, incorrect server responses, PHP <code>mail()<\/code> problems, and failed or blocked email sending. They are also useful when checking whether the incident affected the website, mail service, or both. See <a href=\"https:\/\/mybox.com\/help\/knowledgebase\/web-server-and-mail-logs\/\">mybox&#8217;s article about web server and mail logs<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not rely only on screenshots. Keep the original notification and the relevant log extracts together with your timeline. This makes it easier to connect the provider&#8217;s warning with the actions taken.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"3_Contain_the_affected_services\"><\/span>3. Contain the affected services<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Identify whether the warning concerns the website, a mailbox, the hosting account, or more than one service. Limit activity from the affected service while you investigate. For example, separate the affected website or mailbox from unaffected services in your incident notes and avoid treating the entire account as clean until the review is complete.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Containment should reduce further abuse while preserving evidence. Record what was isolated, when it was isolated, and what remained available. If the warning concerns spam, preserve mail-related evidence before clearing messages or changing mail settings. If it concerns website activity, preserve suspicious files and web server logs before cleanup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"4_Reset_credentials_and_review_access\"><\/span>4. Reset credentials and review access<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Reset the credentials connected to the affected service. Include website, hosting, mailbox, and other relevant account credentials in the review. Record which credentials were changed and when.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A password reset is an important response, but it is not a complete cleanup. Known credentials may be reused, while malicious files, backdoors, unauthorized users, or other changes inside the website may remain. This causal distinction is covered in <a href=\"https:\/\/mybox.com\/help\/knowledgebase\/why-changing-passwords-is-not-enough-after-a-hack\/\">mybox&#8217;s article about why changing passwords is not enough after a hack<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"5_Investigate_the_cause_and_remove_persistence\"><\/span>5. Investigate the cause and remove persistence<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Compare the current website and service state with the expected state. Review unusual files, unexpected redirects, unauthorized users, and changes that could allow the activity to continue. For a website, SSH access can support investigation and cleanup when SSH is available. The relevant procedure is described in <a href=\"https:\/\/mybox.com\/help\/knowledgebase\/how-to-investigate-and-clean-a-compromised-website-using-ssh\/\">mybox&#8217;s SSH investigation and cleanup article<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not treat the first suspicious file as the complete cause. Check whether other files, backdoors, users, or website changes remain. For mailbox abuse, review the mail evidence and sending-related errors in the available mail logs. For website abuse, compare the reported activity with web server logs and the files found during the review.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"6_Document_proof_of_cleanup\"><\/span>6. Document proof of cleanup<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keep a remediation record that answers these points:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Which service was affected.<\/li>\n\n\n\n<li>What symptoms or warning were observed.<\/li>\n\n\n\n<li>Which files, users, messages, or settings were reviewed.<\/li>\n\n\n\n<li>Which suspicious items or unauthorized changes were removed.<\/li>\n\n\n\n<li>Which credentials were reset.<\/li>\n\n\n\n<li>When containment and cleanup took place.<\/li>\n\n\n\n<li>What checks were completed after cleanup.<\/li>\n\n\n\n<li>Whether website redirects, browser warnings, unusual files, spam, or service errors remained after the work.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Attach relevant evidence, such as the provider warning, log extracts, file paths, and before-and-after notes. Keep the record factual and separate confirmed findings from actions that are still in progress.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"7_Prepare_a_safe_reinstatement_request\"><\/span>7. Prepare a safe reinstatement request<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Send the host a concise response that identifies the affected service and refers to the original warning. Include the incident timeline, the evidence preserved, the containment steps, the credential resets, the suspected root cause, and the cleanup completed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">State what you checked after remediation and include the evidence that supports those checks. If part of the review is still in progress, say which part and what action is underway. Ask the host to review the remediation and advise whether the service can be reinstated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Keep the request focused on the reported abuse. Do not send unrelated account information or credentials in the appeal. Continue preserving the incident record and respond to any follow-up from mybox with the relevant evidence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Quick_checklist\"><\/span>Quick checklist<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Save the abuse warning and record its requirements.<\/li>\n\n\n\n<li>Start a timeline.<\/li>\n\n\n\n<li>Preserve website, mail, and server evidence before deletion.<\/li>\n\n\n\n<li>Identify every affected service.<\/li>\n\n\n\n<li>Contain the affected website or mailbox.<\/li>\n\n\n\n<li>Reset relevant credentials.<\/li>\n\n\n\n<li>Review files, logs, users, and service changes.<\/li>\n\n\n\n<li>Remove malicious files, backdoors, unauthorized users, and other confirmed changes.<\/li>\n\n\n\n<li>Test and document the post-cleanup state.<\/li>\n\n\n\n<li>Send mybox a factual reinstatement request with the remediation evidence.<\/li>\n<\/ul>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"template":"","format":"standard","manualknowledgebasecat":[42],"manual_kb_tag":[],"class_list":["post-13043","manual_kb","type-manual_kb","status-publish","format-standard","hentry","manualknowledgebasecat-miscellaneous"],"_links":{"self":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/13043","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb"}],"about":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/types\/manual_kb"}],"author":[{"embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":1,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/13043\/revisions"}],"predecessor-version":[{"id":13056,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/13043\/revisions\/13056"}],"wp:attachment":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/media?parent=13043"}],"wp:term":[{"taxonomy":"manualknowledgebasecat","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manualknowledgebasecat?post=13043"},{"taxonomy":"manual_kb_tag","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb_tag?post=13043"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}