I'm logging every complaint and what the host did about it — nine months, six providers

On the notification lag column, which nobody has commented on and which I think is the most useful one:

Six hours versus four days isn't a policy difference, it's an automation difference. The host with the six-hour lag has a pipeline that parses the complaint and fires a ticket. The host with the four-day lag has a person who reads a mailbox on Tuesdays.

That matters when it breaks at 3am. The automated one will suspend you at 3am. The Tuesday one cannot, structurally, whatever its policy page says.

That's the sentence people will still be quoting in two years and it took him four lines.

Second tranche. Cumulative, twenty weeks, 38 complaints.

Provider	Complaints	Nothing	Forwarded	Deadline	Suspended
A (Sweden)	7	7	0	0	0
B (NL offshore)	9	0	5	4	0
C (Iceland)	6	0	6	0	0
D (Seychelles)	5	5	0	0	0
E (US commercial)	8	0	2	3	3
F (Romania)	3	3	0	0	0

E has suspended me three times and I have restored three times by replying to the ticket. That is the control behaving as a control.

The thing I did not expect: C forwards everything, always, with no deadline and no threat, and has never once acted. Six for six. If you only read the policy page you would put C in the same bucket as B. If you only read this table you would put C in the same bucket as A, since the practical outcome is identical. Neither reading is right, and I do not yet know which one predicts the eventual bad day.

C is Iceland. They forward because law say forward. Then they do nothing because law not say do anything.

Is very Icelandic.

The forwarding is not a neutral act and I would stop treating it as one.

A host that forwards has, at that moment, associated a complaint with an account, a payment method and an email address, in a mailbox that exists. A host that does nothing has a complaint in a spam folder and no record connecting it to you.

You are measuring the outcome you care about — did the box stay up. The other outcome is what exists on their side afterwards, and it differs enormously between A and C even though your column says the same thing for both.

That is a better objection than anything I had planned to write in the conclusion, and it is not measurable with what I am collecting. Going in the log as a stated limitation rather than being quietly ignored.

so which one is A

Read post ten.

I've been following this since March without posting because I didn't have anything to add, and I still don't really, but I want to say why it's been useful to me.

I was about to buy the most expensive bulletproof plan I could find for a site that gets maybe four complaints a year, because every thread on this board made it sound like anything cheaper gets pulled in a week. This thread is the only thing that made me realise the question is what happens on the second notice, not the first. I've bought something in the middle instead and saved about two hundred a year.

Sorry if that's off-topic. Thank you for running it.

That's the correct takeaway and it's a better summary than the thread has managed itself.

Any complaint yet that wasn't a brand-protection form? The whole table is one complainant type.

Two. One hosting-abuse report in March, and one in August that was a genuine legal letter rather than a form, to provider B.

B forwarded it with a seven-day deadline and a note saying they would not act before the deadline expired. I responded, it went away. One data point, and I am not going to build anything on it.

That one data point is worth more than the other thirty-seven and you know it.

Nine months, 61 complaints, six providers. Names, conclusions, and the parts I got wrong.

The table

Provider	Complaints	Nothing	Forwarded	Deadline	Suspended	Median notify
PRQ (Sweden)	11	11	0	0	0	n/a
AbeloHost offshore (NL)	14	0	7	7	0	2 days
1984 (Iceland)	9	0	9	0	0	2 days
BPW (Seychelles)	8	8	0	0	0	n/a
ExtraVM (US)	13	0	3	5	5	4 hours
FlokiNET (Romania)	6	6	0	0	0	n/a

What held

Three providers did nothing about any complaint across nine months. Two forwarded everything and acted on nothing. One suspended repeatedly and restored on reply every time.

The second-notice effect was real for the Dutch offshore tier and the US host, and absent everywhere else. If your host is going to escalate, it escalates on the second notice for the same resource, not on the first.

Notification lag split into two populations with nothing in between: hours, or days. That is the automated-versus-mailbox split PipelineRat named in April, and it predicted more of the behaviour than the policy pages did.

What I got wrong

I expected price to correlate with outcome. It does not, at all, within this sample. The thirty-euro Swedish box and the six-euro Romanian box produced identical rows for nine months. Everything I paid above the cheap tier bought me nothing that shows up in this table.

That is not the same as saying it bought nothing, which brings me to the objection I could not answer.

The objection I could not answer

nullroute's, in June. I measured whether the box stayed up. I did not measure what each provider now holds about me, and forwarding a complaint is itself a record-keeping act. Two providers with an identical nothing-happened column may have completely different files on their customer. There is no way to measure that from outside and I am not going to pretend the table covers it.

What I would actually do

If your worst realistic case is a form email: buy on price and peering, and stop reading bulletproof marketing. Six of these are indistinguishable at that threat level.

If your worst realistic case involves a lawyer: the operating-history premium is not a story, and the only one of these with a genuine record of being leaned on and not folding is the Swedish one. I did not prove that in this table. Nine months of form emails cannot prove it. It is the thing you are buying, and the test does not arrive on a schedule.

If you cannot tell which case you are in, you are in the first one. People in the second one know.

Where this stops

I am not running it for another nine months. The boxes are being consolidated in December. If somebody wants to take the methodology and run it with different content, the format is in post one and I would read that thread.

Short version: at the low end you are all buying the same nothing at six different prices, and at the high end you are buying an insurance policy this experiment was structurally unable to test.

Nine months and the honest conclusion is that the thing you were testing for didn't happen. More people should be willing to publish that.