REPORT
What To Include
Abuse category, affected domain/IP, timestamps, log evidence, and legal basis where relevant.
ABUSE
Abuse Reporting Policy
This policy explains how security abuse, illegal content, and rights violations should be reported and how Zmirf responds.
Last updated: March 18, 2026
RESPONSE
Triage And Action
Critical abuse is prioritized for immediate triage and temporary containment if needed.
LEGAL
Evidence Preservation
Logs and supporting records may be retained and disclosed where legally required.
1. Reportable Abuse
- Phishing, malware distribution, credential theft, and command-and-control activity.
- DDoS attacks, botnet operations, unauthorized penetration attempts, and exploit traffic.
- Copyright/IP infringement notices and unlawful content complaints with sufficient evidence.
2. Resolution Workflow
- Receipt and initial validation of evidence.
- Temporary containment where active harm is confirmed.
- Customer notification and remediation window where applicable.
- Final action: restore, restrict, suspend, or terminate based on findings.
How to submit effective abuse reports
High-quality abuse reports speed up triage and reduce harm for all affected parties. Include technical evidence, timestamps, affected resources, and a clear summary of observed behavior. Reports that contain precise data can be validated and acted on much faster.
When incidents involve phishing, malware, or account compromise, immediate containment may be required before full investigation concludes. Reporting teams should preserve relevant logs and avoid modifying evidence sources so response workflows remain reliable and auditable.
- Provide source IP, domain, path, and event timestamps.
- Attach screenshots or log excerpts where possible.
- State whether abuse is active, historical, or recurring.
- Include a contact channel for follow-up clarification.
FAQ
Abuse reporting FAQ
What should an abuse report include?
Include affected domain or IP, timestamps, evidence, and a brief technical summary of the incident.
Can emergency actions happen before full investigation?
Yes. Active high-risk incidents may require immediate containment first.
This can include temporary restrictions while evidence is validated. After triage, final outcomes are determined through documented review and can include restore, restrict, suspend, or terminate decisions.
How can companies prepare evidence before reporting abuse?
Collect source logs, request traces, and clear timestamps before submitting the report.
When possible, include affected endpoints, screenshots, and impact summary. Structured evidence shortens triage time and helps response teams determine the right containment and remediation path faster.