Acceptable Use Policy

This Acceptable Use Policy (“AUP”) sets out what you may and may not do with PowerDedi servers, IP addresses and network. It is part of our Terms of Service. “PowerDedi”, “we” and “us” mean the operator of PowerDedi identified on your invoices; “you” means the customer.

1. Purpose and scope

This policy protects our network, our customers and the rest of the internet from abuse, and keeps our IP ranges usable for everyone. It applies to every PowerDedi service and to everyone who uses it: you, your staff, and your own customers and end users.

You are responsible for all activity on your servers and IP addresses, whoever carries it out — including the users of services you resell and intruders on a server that was not secured. If you are unsure whether something is allowed, ask us in a support ticket before you start.

2. Prohibited activities

The following are not allowed on or from PowerDedi services, whether you carry them out yourself or let others do so.

2.1 Email abuse

• Sending spam or other unsolicited bulk email, directly or through third-party services.
• Mailing purchased, rented or harvested address lists.
• Forging headers or sender identities, or spreading mail over many IP addresses or domains to evade filters (“snowshoeing”).
• Hosting websites or services advertised through spam.

2.2 Network abuse

• Attacking other networks or systems, including denial-of-service (DDoS) attacks, packet floods, brute-force and credential-stuffing attacks, and the exploitation of vulnerabilities.
• Scanning networks or systems for open ports or vulnerabilities without the owner’s authorization, except as allowed in sections 3.4 and 3.5.
• Sending traffic with forged source addresses (IP spoofing), or intercepting traffic that is not addressed to you.
• Leaving services open to abuse by anyone on the internet: open DNS resolvers, open proxies, open mail relays, and UDP services that can amplify attacks, such as NTP, memcached, SSDP or SNMP. Running these services is fine when access is limited to you and your users.

2.3 Malicious software

• Creating, hosting or distributing malware, including viruses, ransomware, spyware, information stealers and crypto wallet drainers.
• Operating botnets or command-and-control (C2) servers.
• Hosting phishing kits, phishing pages or any form that collects credentials or payment data under false pretenses.

2.4 Fraud and deception

• Scams and fraud of any kind, including fake shops, fake investment or giveaway schemes, and Ponzi or pyramid schemes.
• Impersonating companies, banks, authorities or individuals to mislead people.
• Trading in stolen payment card data, account credentials or personal data.

2.5 Illegal and harmful content

• Child sexual abuse material (CSAM). Zero tolerance. Any material that sexually exploits minors, including drawn or AI-generated depictions, leads to immediate suspension, termination of the service and a report to the competent authorities, directly or through hotlines such as the NCMEC CyberTipline or the national hotline of the country concerned.
• Content or activity that is illegal in the country where your server is located. For example, a server in Frankfurt must comply with German law.
• Content that infringes copyright, trademarks or other intellectual property rights (see section 5.2).
• Harassment, stalking, doxxing (publishing someone’s personal information to expose them to harm), sharing intimate images without consent, and credible threats of violence.

2.6 Resource abuse

• Cryptocurrency mining on GPUs (see section 3.3).
• Traffic that harms our network or other customers, such as attacks and packet floods. Volume alone is never abuse: every server has its own unmetered 10 Gbps port that you can run hard around the clock.
• Circumventing a restriction we have applied, for example by moving the same activity to other IP addresses after a null route.

3. Activities allowed with conditions

The following activities are allowed only under the conditions below. Breaking a condition is a violation of this policy.

3.1 VPN services

You may run VPN services for yourself or for your customers. You handle abuse coming from your users: you must be able to stop it, for example by blocking abusive traffic or accounts, and you must answer our abuse notices within the deadlines in section 5. Abuse coming out of your VPN is treated as abuse from your server.

3.2 Tor relays

• Non-exit relays (guard and middle relays, and bridges) are allowed.
• Exit relays require our prior written approval, which you can request in a support ticket, and must use a reduced exit policy. You handle all complaints about traffic leaving your exit relay and must answer our notices like any other abuse report.

3.3 Cryptocurrency mining

Mining with the CPU is allowed on any server. Mining with GPUs is not permitted on our GPU servers. Running blockchain nodes is not mining and is allowed.

3.4 Security research and penetration testing

You may test only systems that you own or are authorized to test. On request, you must show proof of that authorization, such as a signed agreement covering the targets and dates. Without it, the activity is treated as an attack under section 2.2.

3.5 Internet-wide scanning

Mass scanning is allowed only for legitimate research, and only if:

• you notify us before you start, in a support ticket, with the purpose, the source IP addresses and the schedule;
• your scanner identifies itself, through its reverse DNS and a web page on the scanning IP address that explains the project;
• you offer an opt-out and honor opt-out requests promptly.

4. Network and IP address rules

• Use only your own IP addresses. Configure only the IPv4 and IPv6 addresses assigned to your server. Using any other address, even an unused one in the same range, disrupts other customers.
• Keep reverse DNS accurate. Reverse DNS records, which you manage yourself, must describe your own service and must not impersonate anyone.
• Keep your IP reputation clean. If one of your addresses is blocklisted because of your activity, fix the cause and request delisting. Additional addresses are assigned for real needs, not to evade blocklists, and larger blocks need a written justification under RIR policy.
• Follow email best practices. If you send email, publish SPF, DKIM and DMARC records for your sending domains, mail only recipients who opted in, include a working unsubscribe link in bulk messages and honor unsubscribe requests promptly.

5. How we handle abuse reports

We do not access the contents of your server unless you ask us to or we are legally compelled to. We act on reports sent through our abuse form, on reports from other networks, blocklist operators and authorities, and on what we observe on our network.

5.1 Notices and deadlines

When a report is credible, we forward it to you, and you must:

• respond and stop the abuse within 24 hours;
• for infringement notices, respond within 48 hours, either by removing or disabling the material or by sending a counter-notice (section 5.2).

Your reply should explain what caused the problem and what you did about it. If you need more time to investigate, stop the activity first and tell us within the deadline. If you do not respond, or the problem continues, we move to the next step in section 6.

5.2 Infringement notices and counter-notices

We forward valid infringement notices: those that identify the protected work, the exact location of the material (for example a URL) and the rights holder or its authorized representative. If you believe a notice is wrong, for example because you hold a license or the use is lawful, you can send a counter-notice within the same 48 hours explaining why; we may pass it on to the sender of the notice. Repeated or unresolved infringement leads to the measures in section 6.

5.3 Immediate action

We may null-route IP addresses or suspend a server immediately, without prior notice, when it is used for an active attack, when it hosts or distributes CSAM, when it is compromised and actively harming others (section 7), or when any other activity harms our network or third parties. We then inform you, unless the law or an authority prevents it.

6. Enforcement

We choose the measure according to the severity of the violation, its impact and your history. The usual steps are:

1. Notice: we forward the report or describe the problem, with a deadline (section 5.1).
2. Restriction or null route: we block the affected traffic, ports or IP addresses.
3. Suspension: we suspend the server or the account.
4. Termination: for serious or repeated violations, we terminate the service without refund (see our Refund Policy).

We may skip steps when a violation is serious or needs immediate action (section 5.3). Once you have fixed the problem, tell us: we lift a restriction or suspension after confirming the fix, unless the violation leads to termination. Null routes and suspensions under this policy do not count as downtime under our Service Level Agreement.

We cooperate with law enforcement when we receive a valid order from a competent authority, and we inform you of such a request when the law allows it.

7. Compromised servers

A server that has been hacked, for example to send spam, join a botnet or attack others, is handled like any other source of abuse, even if you did not intend it. You remain responsible for its traffic.

• We may isolate the server by null-routing its IP addresses or restricting its traffic. The IPMI / KVM console normally remains available so that you can investigate.
• You must clean the server or, preferably, reinstall it from a clean image, then replace all passwords and SSH keys and update the software that was exploited (see securing your server).
• Tell us what you found and what you changed; we lift the isolation once the abuse has stopped.

8. Reporting abuse

To report abuse coming from a PowerDedi IP address, use our abuse form. Include the IP address, the date and time with the time zone, and evidence such as logs, the full headers of spam messages or the URLs of phishing or infringing content.

Never send us child sexual abuse material, even as evidence. Report it to the NCMEC CyberTipline or to a national hotline listed by INHOPE, and send us only the URL or IP address through the abuse form.

9. Changes to this policy

We may update this policy, for example to address new forms of abuse or changes in the law. The current version is always published on this page with its effective date, and it applies to your use of our services from that date.