How abuse notifications work, and what happens if you don’t respond
Quick answer
When someone reports that a resource on your server is causing harm, Worldstream's Anti Abuse team checks that the reported resource is on its network, maps it to your account, and forwards the report to your designated abuse contact. You investigate, fix the cause, and reply within one business day. Replying to explain why the report is inaccurate counts as a response. Where abuse is verified and not resolved in time, Worldstream disables network connectivity to the resource within the deadline for that abuse type.
Worldstream runs unmanaged infrastructure. It does not have access to content on infrastructure it does not itself transmit, legally a "mere conduit" position under the EU e-Commerce Directive, so fixing what gets reported is your job as the customer. Worldstream's only technical lever is disabling network connectivity once abuse has been established. That is why an abuse notification asks you to act, rather than telling you what has already been done on your behalf.
Why you might receive one
Reports reach Worldstream through the abuse form on worldstream.com ↗, by email to abuse@worldstream.com, through automated monitoring, from other network operators, or from copyright holders. Reports can be submitted in English or Dutch. Most concern one of:
- Spam originating from your server or mail service
- Malware, or a compromised service scanning or attacking other systems
- A publicly exposed service being actively exploited
- Copyright or DMCA-style takedown requests for hosted content
A report has to clear a real evidence bar before it is actioned: reporter contact details, the type of abuse, a clear explanation of why the content is unlawful, verifiable evidence, log files with exact date and time, and the IP address and static URL involved. Hacking and scanning reports also need the source and destination port. A report that does not clear that bar is not passed on simply because someone asked.
The commitments behind this process
Worldstream is a member of the Dutch industry association DHPA, participates in Clean Networks, and has signed both the DHPA Code of Conduct and a Notice-and-Takedown (NTD) Code of Conduct. Those commitments set the obligations behind everything on this page:
- Reasonably accept all abuse reports, whether automated or written by an individual, and act once notified of abuse in its services.
- Take immediate measures where the nature of the abuse is known and letting it continue would cause serious harm to individuals. This is the basis for the tightest deadlines below.
- Reduce the effects of abuse on the rest of the internet, and stay informed through abuse feeds and Clean Networks.
- Verify customer identity through Know Your Customer checks before a service is delivered.
What happens when a report comes in
Worldstream checks the report, maps it, and forwards it
The Anti Abuse team checks that the reported IP address or domain is on Worldstream's network, maps it to your account, and forwards the report to your designated abuse contact by automated email. Worldstream does not adjudicate the substance of a complaint. Where a report gives Worldstream actual knowledge of illegal content, it acts to remove or disable access to that content.
You respond within one business day
You are expected to reply within 24 hours of the report being forwarded. In most cases that means explaining what you found and what you are doing about it. Contesting the report also counts, see If you think a report is wrong below.
You resolve the issue
Patch the vulnerability, remove the malicious content, or secure the compromised account. Fixing the cause is what closes the report, not the reply on its own.
Deadlines for verified abuse
The one business day above is the window for replying to a forwarded report. Separately, where abuse is verified, through Worldstream's own monitoring, through its Anti Abuse team, or through a confirmed report, Worldstream has an active obligation to act. Each abuse type carries a maximum time before the IP address is blocked. If the issue is not resolved inside that window, connectivity is disabled.
| Abuse type | Maximum time before the IP is blocked |
|---|---|
| CSAM | 15 minutes |
| Copyright (streaming of a live event) | 15 minutes |
| DoS, malware, phishing | 60 minutes (1 hour) |
| Bruteforce, port scan | 120 minutes (2 hours) |
| Spamming, DNSBL | 240 minutes (4 hours) |
| Copyright (streaming) | 12 hours, or immediately where required |
| Copyright | 24 hours |
CSAM and live-event copyright are not open to contesting first: These two carry the tightest deadline, 15 minutes, and they work the other way round from everything else on this page. Remove access immediately, then respond. Do not wait for a discussion about whether the report is well founded.
If you think a report is wrong
A report is not a verdict. Worldstream checks that the reported resource is on its network and maps it to your account, but it does not adjudicate the substance of the complaint, so some reports will be incomplete, poorly evidenced, or simply wrong. You do not have to action a report you believe is inaccurate, but you do have to respond to it.
Replying to the forwarded email to explain why the report is inaccurate, or why it lacks the evidence to act on, is itself a valid response and keeps you inside the 24 hour window. What matters is that you engage within the window, whether you are fixing the issue or contesting the report. The one exception is CSAM and live-event streaming copyright, where access has to be removed first.
If there is no response
Worldstream monitors abuse reports per customer. Where abuse is established, it disables network connectivity to the resource within the deadlines above. Under the Codes of Conduct, prolonged, substantial or repeated violations of the Acceptable Use Policy oblige Worldstream to suspend the service, place it in quarantine, or terminate the agreement.
Whenever service is restricted, Worldstream gives a clear statement of reasons. As an unmanaged hosting provider, you are responsible for what runs on your service, and an ignored abuse report is treated differently from one that is actively being worked on.
Legal orders and law enforcement
Where Worldstream receives a formal order from a competent authority about illegal content, it takes action, reports back to that authority on what it did, and provides information about individual customers on a valid legal demand, in line with applicable law. Where it becomes aware of information suggesting a criminal offence that threatens the life or safety of a person, it notifies the relevant authorities without delay and shares all the relevant information it has.
What to do next
Check which address on your account is your designated abuse contact, and make sure someone reads it every working day. Notifications go there by automated email, and the clock starts when they are sent, not when they are noticed. If you are not sure which address that is, open a support ticket in Portal and confirm it before a report arrives.