A spam or phishing report lands in your abuse inbox and the clock starts. You need to act fast enough to protect your IP reputation, but carefully enough that you do not suspend a legitimate customer on a false positive. Without a written runbook, every report becomes a judgement call made under pressure, and consistency suffers.
What should you do first when you receive a spam or phishing report?
Your first action is to capture evidence before you touch anything. Reports arrive as emails, automated alerts or tickets, and they can be lost or altered. Save the original source.
- Save the full email headers and body as a .eml file. Include the sender, the subject and the timestamp.
- If the report comes from a third party (e.g., a spam trap operator), save the raw message they sent.
- Take a screenshot of the reported URL and the page content. If the page is a phishing kit, capture the HTML source.
- Note the customer's account ID, primary domain and the hosting plan.
Open a dedicated abuse ticket and attach these files. Do not rely on memory or chat logs. If the report came through a web form, copy the submission into the ticket.
How do you verify a phishing or spam report before acting?
You must confirm that the reported content actually exists on your customer's site and is not a false positive. Check the URL directly and compare it to the evidence you captured. Look for signs of compromise: unexpected files, modified timestamps, or unfamiliar code in the document root.
If the report is about outgoing spam, check your mail logs for the sending account. A sudden spike in outbound volume or a high number of bounced messages is a red flag. But do not assume guilt: a compromised account can send spam without the customer's knowledge.
Document your findings in the ticket. State whether you consider the report confirmed, suspected or unfounded. This record matters if the customer appeals.
What should a customer notification about a spam or phishing report say?
Notify the customer as soon as you have a confirmed or suspected issue. The message should be factual, clear and give a deadline. Avoid accusatory language; the customer may be a victim of compromise.
Here is a template you can adapt:
Subject: Action required: abuse report for [domain]
Dear [customer name],
We have received a report that [domain] is hosting [phishing content / sending spam]. We have verified that [describe what you found].
Please take the following steps within [X hours]:
- Review your site for compromised files or unauthorised access.
- Change all passwords associated with your hosting account and any CMS admin areas.
- Remove any malicious content and secure the site.
If you need help, reply to this ticket. If we do not hear from you or the issue is not resolved by [deadline], we may suspend the site to protect our network.
Regards,
[Your name]
When should you suspend a customer's site for spam or phishing?
Set clear thresholds so that suspensions are consistent. For phishing, act quickly: if the page is live and collecting credentials, suspend immediately after capturing evidence. Phishing causes direct harm and can get your IPs blacklisted.
For spam, the threshold depends on severity. If the customer's account is sending high-volume spam or has been reported multiple times, suspend after a short grace period (e.g., 4 hours). For a first-time, low-volume report, give 24 hours to resolve.
Always document the reason for suspension in the ticket. If you suspend, replace the site with a notice explaining why and how to contact you. This reduces confusion and shows you are responsive.
How do you handle an appeal against a suspension?
Appeals happen, especially when a site was compromised without the customer's knowledge. Treat every appeal as a chance to get it right. Review the original evidence and any new information the customer provides.
If the customer can show they have cleaned the site and secured it, reinstate the account. If the appeal is about a false positive, verify again. Consider asking for a written statement that they will monitor the site.
Keep a record of the appeal outcome. If you use a billing platform like Teculiar, you can flag the service as never auto-suspend to prevent automated actions while an appeal is pending. Teculiar's platform also lets you manage support tickets and customer communication in one place, which helps keep the audit trail intact.
What to do next
- Write your abuse runbook today, using the steps above as a starting point.
- Create a dedicated abuse@ email address and a ticket queue for reports.
- Train your support staff on evidence capture and the suspension thresholds.
- Review your logs and backups to ensure you can investigate quickly.
Start by listing every system that holds customer data and can be used to send email.