Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


DigitalOcean locked my account immediately after paying - Page 2
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

DigitalOcean locked my account immediately after paying

2

Comments

  • deankdeank Member, Troll

    Well, I'd say 99.666% instead of 99.999%.

    But yeh.

  • zamekzamek Member
    edited July 2020

    And 99% of all statistics are made up on the spot. :wink:

    I know I said I was done, but I'll just add this. Everybody here had their reason for creating an account, and I know I don't have any cred yet. But I didn't think my post would be that contentious - best case scenario I could get my ticket straightened out behind the scenes, since I wasn't left with any other option. It seemed like it should be a straightforward error to correct on their part.

    Only DO themselves know the full story (or their side of it, rather).

    OK, moving on. :smile:

  • @jar said:

    @zamek said: (real) customers might also want to know what kind of support they're dealing with then

    Real customers should be thrilled that they don't invite back people who perform outbound DDOS attacks, send spam, and things of that nature just because they throw a fit in public.

    Do other providers including those here at LET invite abusers back?

  • @deank said:
    I will be frank. I don't care what you say.

    The host in question is a legitimate company who have to deal with shit load of shady people.

    If they reject you, I will believe that there is a valid reason for that.
    Like @JarLard says, the matter is closed in his eyes as well as mine.

    Are you defending the host or trying to troll OP or both?

  • deankdeank Member, Troll
    edited July 2020

    Both because I trust neither.

    And I don't trust you, either. I mean, how the hell can I? You are THE KILLER!

    Thanked by 1TheKiller
  • LeviLevi Member

    @deank said:
    Both because I trust neither.

    And I don't trust you, either. I mean, how the hell can I? You are THE KILLER!

    Probably he just kills insects with newspapper.

  • zamekzamek Member
    edited July 2020

    @TheKiller said:

    @jar said:

    @zamek said: (real) customers might also want to know what kind of support they're dealing with then

    Real customers should be thrilled that they don't invite back people who perform outbound DDOS attacks, send spam, and things of that nature just because they throw a fit in public.

    Do other providers including those here at LET invite abusers back?

    Just for the record, the conversation got a bit off track, and those examples have nothing to do with me. I wrote all that I know in the first post. But it's always good to know that DO takes being a good netizen seriously. (And I could see how writing "long story short" leaves some room for doubt - a turn of phrase, but more like "short story shorter".)

  • @LTniger said:

    @deank said:
    Both because I trust neither.

    And I don't trust you, either. I mean, how the hell can I? You are THE KILLER!

    Probably he just kills insects with newspapper.

    @LTniger said:

    @deank said:
    Both because I trust neither.

    And I don't trust you, either. I mean, how the hell can I? You are THE KILLER!

    Probably he just kills insects with newspapper.

    Mosquitoes to be exact.

  • If there's a takeaway, signup now for your preferred forums even if you're lurking 100%.

    Members are more likely to take you up on good faith if you have a history of presence.

  • perennateperennate Member, Host Rep
    edited July 2020

    I don't think you intended to abuse their service, but unless they pulled some sketchy shit like subtracting Paypal fee from the refund amount, I don't think there's any concerning behavior here. They refunded you in full, and they didn't delete any of your data, in fact you hardly wasted any time since they closed your account right after paying.

    Compared to other stories on social media that get companies to overturn their decisions, yours doesn't attract much sympathy because you didn't suffer any loss. And companies can choose who to do business with.

    Unlike the larger cloud providers (like AWS), DigitalOcean offers nothing unique, e.g. Vultr basically sells the same product (unless you needed cheap managed Kubernetes). So just use the offerings from an alternative who is not unwelcoming like DO was to you.

    If your intention in making this post was to get DO to change their mind, then that was silly because this is a tiny forum and nobody cares about it, certainly not DO.

    Thanked by 2vimalware DP
  • In my experience, DO will only lock an account immediately when the IP reputation is bad or the account/card used has done a chargeback or PP dispute. For example Signifyd verification on their billing system triggers the internal fraud detection.

  • jarjar Patron Provider, Top Host, Veteran
    edited July 2020

    @TheKiller said:

    @jar said:

    @zamek said: (real) customers might also want to know what kind of support they're dealing with then

    Real customers should be thrilled that they don't invite back people who perform outbound DDOS attacks, send spam, and things of that nature just because they throw a fit in public.

    Do other providers including those here at LET invite abusers back?

    Probably, whether or not they realize it. The tools I had to connect the dots between accounts at DO would not have compared to maxmind, fraudrecord, or human instinct from any of the smaller providers here. The abusers at DO could make a hundred new accounts per hour and try to ruin the cloud from all of them. Some accounts they’d use immediately, others they would age for months to throw off the scent. Guaranteed no one here would’ve connected them if they were dealing with the same volume of daily signups without adopting methods that aren’t standard among providers here. For a good few weeks it was my python script stopping a spam operation, resulting in thousands of terminated accounts. All of them with unique residential IPs (Mirai put to better use maybe?) and seemingly legitimate identities with no easily apparent connection. Nothing about being a low end provider prepared me for that experience.

    From a business perspective, better to have false positives and lose some business than risk letting through those ones I was dealing with. They were so persistent and active they could’ve taken down an entire provider for good if left to their own devices, even one of that size. Some days the majority of tickets, tweets, and community posts were unknowingly all complaints about these abuse rings. CPU steal, blacklisted IPs, packet loss, etc. To most it would look like a hundred different disconnected issues. I suspect a few providers here face similar attacks but have no idea and therefore everyone just says they’re oversold, etc. The providers probably feel backed into a corner and feel like they’ve miscalculated their business plan.

    This was a much longer answer than I thought I was giving.

    Thanked by 2TheKiller scooke
  • @jar said:

    @TheKiller said:

    @jar said:

    @zamek said: (real) customers might also want to know what kind of support they're dealing with then

    Real customers should be thrilled that they don't invite back people who perform outbound DDOS attacks, send spam, and things of that nature just because they throw a fit in public.

    Do other providers including those here at LET invite abusers back?

    Probably, whether or not they realize it. The tools I had to connect the dots between accounts at DO would not have compared to maxmind, fraudrecord, or human instinct from any of the smaller providers here. The abusers at DO could make a hundred new accounts per hour and try to ruin the cloud from all of them. Some accounts they’d use immediately, others they would age for months to throw off the scent. Guaranteed no one here would’ve connected them if they were dealing with the same volume of daily signups without adopting methods that aren’t standard among providers here. For a good few weeks it was my python script stopping a spam operation, resulting in thousands of terminated accounts. All of them with unique residential IPs (Mirai put to better use maybe?) and seemingly legitimate identities with no easily apparent connection. Nothing about being a low end provider prepared me for that experience.

    From a business perspective, better to have false positives and lose some business than risk letting through those ones I was dealing with. They were so persistent and active they could’ve taken down an entire provider for good if left to their own devices, even one of that size. Some days the majority of tickets, tweets, and community posts were unknowingly all complaints about these abuse rings. CPU steal, blacklisted IPs, packet loss, etc. To most it would look like a hundred different disconnected issues. I suspect a few providers here face similar attacks but have no idea and therefore everyone just says they’re oversold, etc. The providers probably feel backed into a corner and feel like they’ve miscalculated their business plan.

    This was a much longer answer than I thought I was giving.

    Interesting. So what exactly connected them?

  • jarjar Patron Provider, Top Host, Veteran
    edited July 2020

    @Hoptrics said: Interesting. So what exactly connected them?

    I'd figure out the algorithms they were using to generate droplet names and I'd add them into my script to search the database and spit out the accounts in a Slack channel for review. Then I'd figure out their Gmail account creation algorithm and compare against signups around the same time. The ones that matched the email account style but hadn't made droplets yet, I'd flag them and keep watch. Then they'd change their droplet naming scheme and start using one of those accounts, which fed me a new naming algorithm, which then led me to a new email account naming algorithm.

    Sometimes they'd use the same startup script ("user data") across multiple accounts and that also led me to more of them.

    Ex. Droplets might be named “commonfirstname” + 4 digits and Gmail accounts might be “firstname.lastname” + 2 digits. That was one of the trends.

    They’d use the largest droplets they could make too, so when you combined the common characteristics with the creation of the max number of 64GB instances (cue customer complaints about capacity), you knew it was too much to be coincidence. That also meant you could find them by calculating a certain run rate and reviewing accounts that recently matched it. Don’t think I ever had a false positive with those ones.

    Nothing shared here I consider private, I openly shared with customers who were concerned about the trends at the time. My methods likely won’t catch bad actors today. As often as I’d learn their ways, they’d change them.

    Of course none of that specifically related to this post, more often people who made posts like this used a stolen credit card in the past, abused promotions, or sold accounts (with promos or to people we wouldn’t let sign up). None of that being an accusation against the OP either, just a glimpse of what it was like.

    Thanked by 3Pwner dcc scooke
  • @zamek said:
    Sorry if there's supposed to be a support megathread for DO somewhere, but I'm not sure where else to turn to besides Twitter and the like. I got a refund, but that's not my issue.

    The site apparently wouldn't take my prepaid CC

    The word "apparently" leads me to believe these are the missing details. Either there was immediate feedback the payment wasn't accepted (and no "apparently"), or there was delayed payment confirmation after some unspecified time with some ambiguous notification?

  • zamekzamek Member
    edited July 2020

    Not that virtual, being bank issued, made of plastic, and having all the other credit card features and goodness that I cared about. But yes, silly me though for thinking I could use it when I've never had a problem elsewhere until now. Not every potential customer is so world-wise. ;)

    @TimboJones said:

    @zamek said:
    Sorry if there's supposed to be a support megathread for DO somewhere, but I'm not sure where else to turn to besides Twitter and the like. I got a refund, but that's not my issue.

    The site apparently wouldn't take my prepaid CC

    The word "apparently" leads me to believe these are the missing details. Either there was immediate feedback the payment wasn't accepted (and no "apparently"), or there was delayed payment confirmation after some unspecified time with some ambiguous notification?

    Or DO's site kept giving me some unmemorably generic error message when trying to submit the details, so I wasn't sure if it was some issue on their side, the bank's side, or somewhere in between.

    Anyway, searching around more I'm definitely not the first this has happened to in somewhat recent times.

    But I did read that they might check your PayPal email on the transaction against your DO account's email address, and nuke you if they don't match. Perhaps that was it. I've had a PayPal account for ages, but it has a slightly different email address for technical reasons (nothing conspiracy theory worthy). I've never thought about that as being a potential issue, but then again I try to avoid using PayPal as much as possible.

    It also has a linked CC that I'd hope even grumpy cat above would approve of, and I've never filed a PayPal dispute or any CC chargeback in my life. So go figure.

    Thanked by 1DA_Mark
  • @zamek It's tough for merchants too.. The moment anything seems weird, they decide it's not worth it. Can't really blame them though. Whenever I've made an exception, I've regretted it 95% of the time. It's certainly nothing personal against you. Business is business, personal is personal. In hindsight, I would have to say that losing 5 legitimate sales is a good price to pay for avoiding 95 sketchy ones. But of course, it's a bad feeling to be shunned when you have done nothing wrong. I guess you can blame the other 95% for that.

    Thanked by 1zamek
  • Adam1Adam1 Member
    edited July 2020

    @LTniger said: 75% of time if well known provider thinks that you are a fraud - it is true.

    what nonsense. 0% of the time a well known provider thinks I am fraud it is true... I know why I always get flagged for "fraud" and 0% of the time it is true.The Hosting industry is the only one I have this issue with. It's ridiculous that just because my location does not match my billing location, that it should be marked as "fraud".

    I use my cards/paypal all over the world for years now, for all kinds of things and I cannot remember the last time I had a problem, except for shitty maxmind.

    inb4 do/dont use a VPN, I dont, I use residential IP in the country I am in.

  • @zamek said:
    But I did read that they might check your PayPal email on the transaction against your DO account's email address, and nuke you if they don't match. Perhaps that was it. I've had a PayPal account for ages, but it has a slightly different email address for technical reasons (nothing conspiracy theory worthy). I've never thought about that as being a potential issue, but then again I try to avoid using PayPal as much as possible.

    So you found the problem :) Of course they could have been clear and tell you this in the error message so you can sign up again with the same email. They think they are preventing fraud by not sharing reasons but if you can find the reasons online then obviously fraudsters are well aware of this check and would never be hit with it... total nonsense "security through obscurity" which is becoming the norm of the day as machine learning models are starting to make decisions instead of (and not together with) humans.

  • seed4useed4u Member

    That’s rarely the problem, mine doesn’t match and never had problems with any of the big providers and have accounts on them all.

    @elwebmaster said:

    @zamek said:
    But I did read that they might check your PayPal email on the transaction against your DO account's email address, and nuke you if they don't match. Perhaps that was it. I've had a PayPal account for ages, but it has a slightly different email address for technical reasons (nothing conspiracy theory worthy). I've never thought about that as being a potential issue, but then again I try to avoid using PayPal as much as possible.

    So you found the problem :) Of course they could have been clear and tell you this in the error message so you can sign up again with the same email. They think they are preventing fraud by not sharing reasons but if you can find the reasons online then obviously fraudsters are well aware of this check and would never be hit with it... total nonsense "security through obscurity" which is becoming the norm of the day as machine learning models are starting to make decisions instead of (and not together with) humans.

  • a2razora2razor Member
    edited July 2020

    Honestly, tripping anti-fraud systems is pretty easy far as having two addresses you live at, and or being abroad at the time you sign up for service. Had this happen when attending E3 and having to sign up with another provider / move a server on the fly {from a hotel}. Also had it happen plenty for stupid reasons, e.g. being accidentally logged into VPN's.

    -- As the OP hints that it should be, it's easy to clear up almost always.

    In the future when opening talks, immediately offer to provide proof (documentation) of who you are, or anything else that the provider would request / propose. That is, rather than asking why your order was declined -- only ask what you can do to resolve the suspicion.

    Don't bother asking "the why", noone will ever discuss such details / usually shuts down any chance you have of recovering and doing business. {you get one shot at this, so you want to be to the point}

    Thanked by 1zamek
  • LeeLee Veteran
    edited July 2020

    @Adam1 said: It's ridiculous that just because my location does not match my billing location, that it should be marked as "fraud".

    Is it believable that in a greater majority of instances it turns out to be true that when the client location does not match the billing location there is a fraud element? Yes. So when you, a complete unknown to a provider fits inside that box you will be treated like the majority by that provider. Only ridiculous to you.

    Thanked by 1skorous
  • zamekzamek Member
    edited July 2020

    @a2razor said:
    In the future when opening talks, immediately offer to provide proof (documentation) of who you are, or anything else that the provider would request / propose. That is, rather than asking why your order was declined -- only ask what you can do to resolve the suspicion.

    Don't bother asking "the why", noone will ever discuss such details / usually shuts down any chance you have of recovering and doing business. {you get one shot at this, so you want to be to the point}

    I did originally send them a ticket asking if there was something I needed to verify once my account was locked. But checking now in their Support Center, that ticket was closed as a duplicate of my first one inquiring about CC payment. Maybe that's where it started to go off track.

    But with their latest response, I couldn't help but question the technical "why" of it all, though.

  • VPSforVPNVPSforVPN Member
    edited July 2020

    @raindog308 said:
    And who ever calls Microsoft about a Windows problem...

    I don't need to call Microsoft, they call me whenever I get a virus and help me fix my computer.

  • SplitIceSplitIce Member, Host Rep

    I've been marked as fraud a few times due to the IPv6 HE tunnel I use (no native). Rare though.

    Most hosting businesses still doing IPv4 for their client panel :)

  • @zamek said:
    Not that virtual, being bank issued, made of plastic, and having all the other credit card features and goodness that I cared about. But yes, silly me though for thinking I could use it when I've never had a problem elsewhere until now. Not every potential customer is so world-wise. ;)

    @TimboJones said:

    @zamek said:
    Sorry if there's supposed to be a support megathread for DO somewhere, but I'm not sure where else to turn to besides Twitter and the like. I got a refund, but that's not my issue.

    The site apparently wouldn't take my prepaid CC

    The word "apparently" leads me to believe these are the missing details. Either there was immediate feedback the payment wasn't accepted (and no "apparently"), or there was delayed payment confirmation after some unspecified time with some ambiguous notification?

    Or DO's site kept giving me some unmemorably generic error message when trying to submit the details, so I wasn't sure if it was some issue on their side, the bank's side, or somewhere in between.

    That's either convenient or incompetence on your part. How this isn't at the forefront of your brain is mind boggling. Next time, fucking screenshot the error and save us all the bother. Can't help you if you fail to help yourself.

  • zamekzamek Member

    @TimboJones said:
    [...]
    That's either convenient or incompetence on your part. How this isn't at the forefront of your brain is mind boggling. Next time, fucking screenshot the error and save us all the bother. Can't help you if you fail to help yourself.

    Here it is as I wrote it down in my ticket to them: "We encountered an error processing your card. Please try again."

    I don't think it makes any difference though, given DO's follow-up about not accepting prepaid cards. It's just the usual type of error message that tells you little of value, and in this case even leads you on.

    Thanked by 1TimboJones
  • scookescooke Member

    I've had a few ocassions where the case of my name on my card had to match my name signing up. Just using one capital letter at the start of my name rather than all capitals has had some online purchases not go through. At least, I think this is what happened because when it failed the first time, it worked the second when I capitalized everything.

  • NyrNyr Community Contributor, Veteran

    This thread is making DigitalOcean look like they are tough on abuse, but they really are not. Of course they will suspend spammers/DDoS fast, but that's only because those have serious consequences for their infrastructure.

    Other abuse takes an entire week or even more to be dealt with.

Sign In or Register to comment.