Security
Reporting Abuse
If something hosted on Kapsule is being used to send spam, host a phishing page, distribute malware, infringe copyright, or break the law, report it to abuse@kapsulehost.com.
You do not need an account to report abuse. Anyone can email that address, and every report is read.
Where to Send What
| What you are reporting | Where |
|---|---|
| Spam, phishing, malware, illegal content, denial of service, copyright | abuse@kapsulehost.com |
| A security vulnerability in Kapsule's own systems | security@kapsulehost.com |
| A problem with your own account or your own site | Open a support ticket |
Sending a report to the wrong address slows it down, so it is worth a moment to pick correctly. The abuse address is for misuse of the platform by somebody using it. The security address is for a flaw in the platform itself.
The published list of what can be reported to the abuse address covers:
- Spam or unsolicited bulk email originating from our IP ranges.
- Phishing pages or credential-harvesting sites hosted on our platform.
- Malware distribution, botnet command and control, or other malicious content.
- Child sexual abuse material, which is reported immediately to the New Zealand Department of Internal Affairs.
- Copyright infringement under the DMCA or the New Zealand Copyright Act 1994.
- Illegal content under New Zealand or international law.
- Denial of service attacks launched from our network.
- Any other violation of the acceptable use policy.
What to Include
A report that can be acted on immediately contains evidence. A report that says only that a site is bad cannot be acted on at all.
Include:
- The exact URL or IP address. A full URL to the offending page, not just a domain name.
- What is wrong with it, in one or two sentences.
- When you observed it, with a timezone.
- Supporting evidence. For spam, the complete message including all headers, not just the visible body. Headers are what prove where a message actually came from. For a web page, a screenshot and the URL. For an attack, log lines with timestamps and source addresses.
- Your contact details, so you can be asked follow-up questions.
For spam reports, forwarding the message inline usually strips the headers that matter. Use your mail client's forward-as-attachment option, or copy the full source, so the original headers survive.
The published commitment is a response to all reports within 24 hours on business days.
Copyright and DMCA Notices
Copyright complaints also go to abuse@kapsulehost.com, marked "Copyright" in the subject line.
A takedown notice has to contain specific elements to be valid, and an incomplete notice cannot be acted on. The required elements are set out in full in the legal terms on the Kapsule website, and in outline they are: your signature, identification of the work, identification of the material to be removed and where it is, your contact details, a statement of good faith belief, and a statement of accuracy made under penalty of perjury.
If material of yours has been removed and you believe that was wrong, a counter-notice goes to the same address and has its own required elements, including consent to New Zealand jurisdiction.
A takedown notice is a legal document. Filing one about material you do not own, or that you know is being used lawfully, has consequences. If you are unsure, take advice before sending it.
Reporting a Vulnerability
Send a description of the issue and the steps to reproduce it to security@kapsulehost.com. The published commitment is responsible disclosure and acknowledgement of receipt within 2 business days.
Please do not test against other customers' sites or data. A finding demonstrated against your own account is just as useful and does not put anyone else at risk.
Reporting From Inside the Panel
If you are a customer and the issue involves your own account, the support ticket form handles it.
- Go to Support in the panel.
- Start a ticket and choose the Security service type, described as "A security concern or abuse report".
- The form asks what the nature of the issue is, choosing between a compromise, malware, abuse, and a vulnerability.
- Describe what you observed and whether it is still happening.
Use this route when your own site has been compromised, when you are receiving attacks, or when you need something on your account investigated. Use the abuse address when the problem is somebody else's content on the platform.
If You Are the One Being Reported
A report against your account does not automatically suspend anything. A person reviews it first.
If your site was compromised and is being used to attack others, that is treated as an incident to fix rather than as bad faith on your part, provided you act. Clean the site: see What to Do If Your Site Is Hacked and Scanning For and Removing Malware.
If a service or the account is suspended as a result, it does not lift automatically. A person has to review and clear it once the underlying problem is resolved. See Why Your Account Was Suspended.
The fastest path back is always to show what you found, what you removed, and what you changed so it cannot happen again.
Reporting Abuse of Your Own Brand
If someone is impersonating you, hosting a fake version of your site, or sending mail claiming to be from your domain, that is abuse and worth reporting even though it is your brand rather than your hosting being misused.
Send the URLs to abuse@kapsulehost.com if the content is hosted on Kapsule. If it is hosted elsewhere, the same report needs to go to whoever hosts it. See Phishing and Impersonation for how to identify a genuine Kapsule message, and for what to do if you or your customers have been phished.
What Happens Next
Reports are triaged by a person. Depending on the finding, the outcome may be a request to the customer to remove the content, removal of the specific material, suspension of a single service, or suspension or termination of the account.
You will not usually be told the detail of what was done, because that concerns another customer's account. You will be told whether the report was actioned.
Troubleshooting
I have not had a reply. Check your own spam folder. Reports are responded to within 24 hours on business days, so allow for weekends and New Zealand public holidays.
The content is still up. Some outcomes require a customer notice period, and some material is lawful even where it is unwelcome. If it is unchanged after a reasonable period, reply on the same thread with fresh evidence.
I am not sure it is hosted with you. Say so and include the URL and IP address. If it is not ours, you will be told so you can report it to the right provider.
I want to report anonymously. You can, but you cannot then be asked for the evidence that would let the report be acted on. Reports with contact details are far more effective.
This is an emergency involving risk to life. Contact the New Zealand Police directly. An abuse mailbox is not an emergency service.