Acceptable Use Policy

1. Purpose and scope

This Acceptable Use Policy (“AUP”) protects our network, our customers and everyone else on the internet. It applies to all DediJet services and to everyone who uses them: you as our customer, and your team, users and customers. It is part of our Terms of Service.

You are responsible for all activity on your servers and IP addresses, including activity by your users and customers. If a server is compromised, you must stop the harmful activity and fix the cause, even if you did not start it. If you provide services to others, your own terms must prohibit at least what this AUP prohibits.

2. Prohibited activities and content

You may not use DediJet services, or let them be used, for any of the following. The examples are not exhaustive.

2.1 Spam

• Sending unsolicited bulk email, or email to purchased, rented or harvested address lists.
• SEO spam, such as automated comment or forum posting, link farms and pages generated only to manipulate search engines.
• Hosting websites or services promoted by spam, wherever that spam is sent from.

2.2 Phishing and fraud

• Phishing: imitating a bank, brand, service or person to obtain credentials, payment details or personal data, including hosting phishing kits.
• Fraud, such as fake shops, investment or cryptocurrency scams, carding, and selling stolen data or accounts.

2.3 Malware, attacks and unauthorized access

• Distributing malware or ransomware, or operating command-and-control (C2) servers for botnets or malware.
• Launching denial-of-service (DDoS) attacks, or operating or selling “stresser” or “booter” services, even when presented as testing tools.
• Scanning, probing, brute-forcing or credential-stuffing third-party systems without their owner’s permission.
• Attempting to access any system, account or data without authorization, including our infrastructure and other customers’ servers.
• Sending traffic with forged source IP addresses (IP spoofing), or using IP addresses that are not assigned to you.
• Mining cryptocurrency on other people’s devices without their consent (cryptojacking).

2.4 Illegal and infringing content

• Child sexual abuse material, in any form (section 3).
• Terrorist or violent extremist content, including content that incites, glorifies or recruits for violence, or that gives instructions for attacks.
• Any other content or activity that is illegal where the server is located or where you are, such as threats, harassment or the illegal sale of goods.
• Infringing copyright, trademarks or other intellectual property rights, for example by distributing pirated software, media or streams.

2.5 Network and hardware integrity

• Leaving services open to the whole internet that can be abused for spam or amplification attacks, such as open mail relays, open DNS resolvers, NTP servers that answer monitoring queries, and open memcached, SSDP, CLDAP or SNMP services.
• Reselling your bandwidth as IP transit, for example by routing or announcing other networks’ traffic or selling raw connectivity. Hosting websites, game servers or virtual machines for your customers is allowed.
• Overclocking, raising voltages or power limits above the manufacturer’s defaults, or modifying firmware (BIOS/UEFI, IPMI/BMC, drives, network cards or GPUs).
• Disrupting our network or other customers, for example with ARP or MAC spoofing or a rogue DHCP server.

3. Zero tolerance for child sexual abuse material

We have zero tolerance for child sexual abuse material (CSAM), whether real, drawn or computer-generated. When we find CSAM or are notified of it, we terminate the services concerned immediately, without notice and without refund, preserve the related data as the law requires, and report it to the National Center for Missing & Exploited Children (NCMEC), the Internet Watch Foundation (IWF) or the competent authorities.

If you come across such material, do not download it and do not send it to us. Send us only its location (URL or IP address) through our abuse form, and report it to the police or a national hotline.

4. What is allowed

Within the law and the rest of this AUP, the following uses are explicitly allowed:

• Cryptocurrency mining. It is your hardware for the month, so you may mine on your own servers, without overclocking (section 2.5).
• Tor relays. Middle relays, guard relays and bridges are welcome.
• Tor exit nodes, on three conditions: tell us by ticket before you start; use a reduced exit policy that, at a minimum, blocks outgoing email (port 25); and handle abuse complaints about your exit yourself, within the 24-hour response time (section 7). We recommend a reverse DNS name and a web page that identify the server as a Tor exit.
• VPNs and proxies for your own lawful use and that of your organization, with your own abuse handling. Open proxies that anyone can use without authentication are not allowed, and offering VPN or proxy access to the public needs our prior agreement.
• Security testing of systems you own, or that you have the owner’s written permission to test. Keep that permission and show it to us if we ask.

5. Sending email

Outgoing port 25 is open on every server, so you can run your own mail server. In return, you must follow standard email practice:

• Set a reverse DNS (PTR) record on each sending IP address that resolves to your mail server’s hostname, and make that hostname resolve back to the same address.
• Publish SPF, DKIM and DMARC records for every domain you send from.
• Send bulk or marketing email only to recipients who have opted in, and keep proof of their consent. Include a working unsubscribe link in every bulk message and honor unsubscribe requests promptly.
• Remove addresses that bounce permanently, and act on complaints, including those from mailbox providers’ feedback loops.
• Comply with the anti-spam laws that apply to you and to your recipients.

We monitor outgoing email traffic for signs of abuse, such as unusual volumes of SMTP connections, blocklist listings and complaints. If we detect spam, we may block port 25 on the server until the cause is fixed.

6. Keeping your server secure

A compromised server harms others. You must:

• keep the operating system and all software up to date with security patches;
• use strong authentication, such as SSH keys or strong, unique passwords, and never leave default credentials in place;
• expose only the services you need, and protect them with a firewall;
• act immediately when a server is compromised: isolate it, remove the cause (in most cases by reinstalling from a clean image), change all credentials and fix the vulnerability before putting it back online.

If a compromised server attacks or harms others, we handle it like any other abuse: we may block its traffic or suspend it until it is clean. Where it is safe to do so, the IPMI/KVM console remains available so that you can repair it.

7. How we enforce this policy

7.1 Complaints and your 24-hour response

When we receive an abuse complaint about one of your IP addresses, we review it and, if it appears valid, forward it to you by email or ticket. You must respond within 24 hours: fix the problem and tell us what you did, or explain why the complaint is unfounded.

7.2 Escalation

Depending on the severity of the violation and on your response, we take the following steps, in this order:

1. a warning, with the complaint and a deadline;
2. a block of the ports or IP addresses involved;
3. suspension of the server;
4. termination of the services concerned and, in serious or repeated cases, of your account.

We move through these steps faster if you do not respond, if the problem continues or if it happens again.

7.3 Immediate action

In severe cases, we act without prior warning: CSAM, phishing, malware and command-and-control servers, active attacks on third parties, threats to our network or other customers, and orders from competent authorities. We tell you what we did and why as soon as we can, unless the law forbids it.

7.4 Fees and refunds

Fees remain due while a service is suspended because of a violation. If we terminate a service for an AUP violation, the fees already paid for it are not refunded. The refundable part of your account balance remains refundable under section 7.2 of our Terms of Service, after deduction of any amounts you owe us.

7.5 If you think we got it wrong

Reply to our message or open a ticket with the details. A member of our team will review the decision and, if we made a mistake, restore the service without delay.

8. Reporting abuse

To report abuse coming from a DediJet IP address, use our abuse form or email abuse@dedijet.com, and include:

• the IP addresses or URLs concerned;
• the date and time of the activity, with the time zone;
• the type of abuse and your evidence, such as log extracts, full email headers or the address of a phishing page.

We review reports 24/7 and acknowledge them within 24 hours. Urgent cases, such as CSAM, phishing, malware and active attacks, are handled first. Do not send live malware as an attachment and, for CSAM, send only the location of the material (section 3).

9. Law enforcement

Law enforcement agencies and other authorities can contact us through the same channels: our abuse form or abuse@dedijet.com. We check that each request is valid and respond in line with the law and our Privacy Policy, disclosing only the minimum data required. Because we collect very little, we usually hold little more about a customer than an email address, service and payment records, and support tickets.

10. Changes to this policy

We may update this AUP as the law and abuse patterns change. Material changes are announced by email at least 30 days before they take effect, as described in our Terms of Service; changes required by law may take effect sooner.