Ask HN: Hetzner banned me with no explanation. What can I do?

I'm sorry you had such an adverse reply from so many here. Your post seemed pretty clear about how you were using your server, which is to say "not much that should have drawn any attention."

There have been a lot of similar reports about Hetzner competitors, so it seems one just has to maintain off-site backups and be prepared to randomly jump ship. There are lots of reports of this in the DigitalOcean sub-reddit.

As to the cause, I've gotten caught up in things like this before... no so much from cloud providers but from other e-commerce vendors and even on-line banks. I've had some luck writing paper letters, not going away without an answer on Twitter, and filing government complaints.

The general gist is that like like spam is a problem for email, other types of fraud are a problem for cloud providers and merchants. They're turning to some of the same kinds of tools that are used against spam... with the same mediocre results. I've taken a lot of time to get under their skin and get to the root cause. I've been successful about half the time, and the reasons are usually lackluster:

- You used a VPN when you signed up years ago - The bank the issued your credit card (the first 8 digits) matches a lot of other fraud events (this is particularly the case with gift cards, over the counter debit cards, and virtual cards... though I've had the same problem with major brick and mortar banks.) - You had account activity that doesn't match normal hours for your time zone. - I ran an ad blocker, which also messed up some CAPTCHA/JavaScript thing - I have "load images" disabled on my email client, so it looked like I wasn't opening mail from them. - Other fraud occurred from a similar IP address.

Often they use plugins from commercial anti-fraud companies, much like Facebook or Google ad plug-ins. These companies look at information from lots of places and try to identify patterns among accounts that later are reported as fraudulent. We use one of them where I work. It's about as effective as a spam filter, meaning it catches most but has both false positives and false negatives. You can tune it to be more or less aggressive.

Depending on where you are in the world, you may have more rights to dig into it than Americans do. Also, if you used a promo code, you might ping the advertiser and let them know as this hurts their brand as well.

I hope this helps.

I don't know anything about Hetzner, but there's something completely inhuman about the overall tone of that email even on top of the overall crappiness of the situation.

No lead time (not even a paltry 24 hours) to find an alternative service provider.

No mention or clarification that any data will be available for download in some fashion. Imagine relying on them for anything truly critical and being insta-banned. You can't operate a tech company on a server like that.

No apology for having to do this. Using the word "unfortunately" doesn't count. They're giving a human being a shitty day: the least they can do is playact at being a tad sympathetic.

No explanation of any wrongdoing or a reason for why this is needed. Even a simple "Due to legal requirements" or "excess resource usage" might help.

No way to contact anybody if there's any error or outstanding business issues.

A display of real arrogance by using the word "final" and "cannot be appealed" in the message.

Addressing themselves as the "Your Hetzner Online Team" rather than a specific individual. If a human made a decision, they should own responsibility for it. If a human didn't make that decision and it was some algorithm, there's no way it shouldn't be appealable.

There must be more to the story...

If true, I'd check all configured email addresses. They let you configure different addresses for support/bills etc. and will send warnings only to certain addresses.

Hetzner is usually good at revolving issues.

If you don't pay a bill, they eventually will block incoming traffic from the web. They are still reachable from inside hetzner network and they will unblock traffic as soon it's paid.

If the BSI finds Ports that shouldn't be open to the public, they will forward the mail to you and won't take actions.

If you disturb their network due to misconfiguration, they will block you, demand an explanation within 24 or 48 hours and unblock you, if they find it plausible.

If you call them with technical issues - in my experience - you typically want to prepare logs, traceroutes etc. because they will know enough to provide guidance on how to resolve it.

Contrary to most other clouds, Hetzner has a DE & EN support phone number: https://www.hetzner.com/support-center ↗

Did you call them? What did they tell you on the phone?

I've been with them since 2004 with currently 100+ servers and cloud instances among my companies. Yes, they employ one trigger-happy young sysadmin, who can be quite stubborn, too. But in all the years, they never took any action completely without reason. Like we might disagree about the weight of my mistake, but there always was one.

If I had to guess, you were working on Crypto or used torrents. They insta-ban for some protocols. Also, if you connect to too many unroutable IPs, they will create an "abuse" case and disconnect the offending IP from their network.

Was there anything going on in your code?

I'm not sure hetzners policies but for example if your code is utilizing certain ports and traffic types that they might have limits on?

The response from them is very flippant and robotic though. It may be an automated action but I'd be curious to hear your experience with the "human" you get in touch with.

Edit: as for the decision being final this is usually just to deter bad actors. I've had some issues with a compromised server when colocating who said the same. This was a pain to prove, they did overturn it but I imagine it had something to do with the higher fees being paid to them.