Hosting charges $1,100

[Johnn]

I have a friend have a VPS hosting. Normal monthly charge is about $49.95.

Somehow the server got hacked and there was some IRC scripts running and jack the bandwidth to 2 TByte in 3 days.

The hosting sent a bill for $1,100 for the over usage bandwidth.
Are they allowed to do that. What about security and why they let it happened in the first place.

Your thoughts! Should he pay $1,100?

John

 

[katherine]

How the server was hacked ? If your friend installed a vulnerable script he's ultimately responsible.
It is best to choose a host that can cap your bandwith to 200% of your allowance for example. 2 Tb that hurts :worried:

 

[Johnn]

He said the technician said some type of IRC scripts was installed because of out of date scripts.
My question is should they stop the server when it hit the max bandwidth? What happened if he is on vacation for 2 weeks? He is not a domainer so he is not online all the time.

 

[theinvestor]

I've heard of this happen and ultimately he is responsible...but usually the host may cut him a deal. Either by reducing the cost, or completely writing it off. He can't really avoid paying it though.

 

[Johnn]

So if he went on vacation for a month. He would pay a $30,000 invoice?
What if he is 16 or 17 - how the heck can he paid?

This does not make any sense.

 

[katherine]

That's a tricky situation.
If the outdated scripts are part of the original VPS setup the host is largely responsible imo. Still it's up to you to install updates as they are released.
Otherwise a VPS is like a dedicated server - your are supposed to have the necessary skills to administer the machine.

The arrangements may differ from one host to another when it comes to overconsumption of bandwidth (he should have had it capped for security). Time to scrub the fine print.
Not looking good though.

 

[Eraser]

IMO, he should NOT pay extra as he didn't purchased extra bandwidth.

 

[theinvestor]

This is very similar to internet service...if i download movies all day and go over my limit...i have to pay. Hosting is no different.

 

[FuseFX]

Which VPS company are you talking about?

 

[GAMEFINEST]

Yep, his stuck with the bill, unless he comes up with a real good excuse.

 

[Keyboard Cowboy]

He should pay as it is not the hosting company's fault that his out-of-date scripts are easy to break (this being a very plausible cause if he is not tech savvy, as you insinuate).

When our servers are about to go over, we receive automated emails that they might go over the allotted bandwidth for the month. If they go over, they are not capped. We just pay a higher fee for each GB, which in my opinion is fair.

 

[DomainMagnate]

Might need to check the tos of that company, they usually have something on that

 

[CyrusL]

It doesn't matter what we think, it matters what the service agreement that he agreed to says.

 

[acronym007]

I don't care what the TOS says, I would not pay. They have a responsibility also, to warn the client or customer. My credit card company calls me when they see charges that appear as fraud. If fraud is then proven I only have to pay $50. Fraud detection is everyone's responsibility, the hosting company should cap the minimum to say $50-100 of some amount for hacked accounts. It should not be limitless, that is like saying they have no responsiblity for hardening the server which is not a legitimate defense IMHO. They could abuse this and you are left defenseless because they own the data to prove your innocence or guilt.

And to answer your question Johnn, yes, they could just as easy suspend the account temporarily until the client is warned of this activity, not charging him/her excessively. They have the power, why did they not exercise it?

 

[mr-x]

What if he is 16 or 17 - how the heck can he paid?

You can bet the TOS has a clause for this, and the responsibility will rest with the website / server owner. There is always room to negotiate. I certainly wouldn't pay it without trying to reach a comprimise.

In the US, a minor ( < 18 ) can't enter into a binding contract so he certainly has leverage to negotiate a settlement. This of course means he probably lied about being an adult when he purchased the VPS.

 

[Theo]

Ah, the beauty of "unlimited bandwidth".

Since it's a dedicated/VPS that he's in control of, he should have installed mod_bandwidth for Apache, that limits traffic to a set number.

Unfortunately, the provider is covered in their TOS about how billing occurs.

 

[dotcomgiant]

well, a vps is something like having a dedicated box . so these kind of responsibility is always with the client . As per the payment is concerned, i am sure the provider is ok with its TOS and all . Though the client can discuss for a negotiation . and also as the billing is for extra bandwidth, the provider is also locked in the deal with its upstream provider so very little chances are there for nagotiation. btw, no harm in trying to have a deal on final payable amount .

 

[silverdom]

one should avoid these so-called "hosting companies".

It is so wrong from many points of view ...
Limit the freaking b/w jeez and infrom the customer.
It's a 100% scam even it looks like not.

 

[tldrental]

Guys,
Who should pay for the bandwidth? Remember the hosting companies upstream provider will not cut them a brake or discount and someone has to pay for it.

Most hosting companies will cut you brake. I have been hosting dedicated servers and do colocation for about 6+ years now. I have had some hinky things happen the Data Center made a deal like paying for the overage at there wholesale cost.

I dont sell VPS, it's more trouble than it's worth so my knowledgebase is week.

But in a dedicated server enviroment you would absolutley be responcible if you did not have a managed server agreement.

My common sense though tells me that since it is VPS, it is esentialy a managed service and the data center needs to take some sort of ownership for this happening.

I would try this tact and see if they are willing to work with you.

Rich

..... in addition, John if your friend needs more ammunition or angles to take for disputing this with the DC or hosting company please let me know via PM, it would be easier discussed over the phone though.

 

[DomainsInc]

Could be worse. I had a much unexpected bandwidth bill back in 1999 for $10,000. Boy did that suck.