Acceptable use policy: what is not allowed

Activities that are prohibited on BLACKBOX servers, explained with examples, and what happens when the rules are broken.

The acceptable use policy is chapter 2 of the “Termeni și condiții” (Terms and conditions) page, titled “Utilizări interzise (Politica de utilizare acceptabilă)” (Prohibited uses: acceptable use policy). You can find it at blackbox.md/info/terms#utilizari-interzise, or through the “Termeni și condiții” link in the footer of blackbox.md pages. Below we explain it in plain language, with examples, together with chapter 3, “Răspunderea Clienților” (Customer liability). The other chapters are summarized in Terms and conditions in brief.

Available to: anyone; the page is public. The rules apply to every BLACKBOX customer and to everyone the customer gives access to the services.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

Note This is a summary. The Romanian text at blackbox.md/info/terms is the legally binding one; the Russian version is a translation provided for convenience. The examples in the table illustrate the rules and are not part of the Terms.

What is prohibited

The Terms list nine types of activity that are prohibited on BLACKBOX infrastructure. “Lista nu este exhaustivă” (The list is not exhaustive): BLACKBOX reserves the right to step in whenever a situation affects the integrity of the network or of other customers.

Clause	What is prohibited	Examples
2.1 Content that breaks the law	Transmitting, distributing or storing content that violates the laws of the Republic of Moldova or applicable international law: material protected by copyright, trademarks or trade secrets and used without authorization; obscene or defamatory content, or content that incites hatred; violations of export control rules.	Pirated movies, music or software offered for download; an online store selling counterfeit goods under someone else's brand; a website that incites hatred against a group of people.
2.2 Spam and unsolicited commercial mail	Unsolicited commercial messages, in any form, sent through BLACKBOX services. Spam sent through another provider to advertise resources hosted at BLACKBOX is also prohibited. Likewise, BLACKBOX mailboxes may not be used to receive messages that violate this policy.	Offers sent to addresses collected from other websites; a campaign sent from an external service with links to your website on a BLACKBOX server.
2.3 Unconfirmed email lists	Adding addresses to mailing lists without the recipient's explicit consent (double opt-in). Proof of consent must be kept for as long as the list exists. Buying or renting lists from third parties is prohibited.	Importing your customers into a newsletter when they never subscribed; a purchased “address database” used for a campaign.
2.4 Abusive software and services	Publishing, distributing or hosting programs, tools or services for spam, network attacks, exploiting vulnerabilities, bypassing authentication or other malicious activity.	Bulk spam software; “stress test” services sold for DDoS attacks; phishing kits; botnet control panels.
2.5 Unauthorized access	Attempts to access accounts, systems, networks or resources that don't belong to you, whether they belong to BLACKBOX, to other customers or to third parties.	Guessing the SSH passwords of other servers; using passwords stolen in a data breach; trying to get into another customer's account.
2.6 Avoiding payment	Any means, technical or otherwise, used to get the services without paying or to avoid payments that are due.	Paying with someone else's card without their consent; exploiting a bug on the website to get a server without paying for it.
2.7 Altering or destroying information	Accessing, altering, destroying or deleting the information or resources of other BLACKBOX users without authorization, or attempting to do so.	Changing pages on another customer's website; deleting someone else's files.
2.8 Denial of service (DoS / DDoS)	Taking part, willingly or through gross negligence, in activities that prevent services from being provided to other BLACKBOX customers, to BLACKBOX or to any other provider on the network.	A flood attack on a website; a server left without updates and with a weak password, taken over and added to a botnet; a service exposed to the internet (for example, an open recursive DNS server) used to amplify attacks.
2.9 Disrupting the network	Using the services in any way that disrupts, degrades or endangers the operation of the BLACKBOX network or of partner infrastructure.	Traffic sent with spoofed source IP addresses; using IP addresses that are not assigned to your server.

What happens when the rules are broken

Chapter 3, “Răspunderea Clienților” (Customer liability), provides the following:

Question	What the Terms say
How a violation is detected	Through an external report, automated monitoring or an internal audit.
What BLACKBOX can do	Suspend or stop providing the services, in whole or in part, with or without prior notice, depending on how serious the situation is. Where prior notice does not put other customers at risk, BLACKBOX tries to give it. Under chapter 10, BLACKBOX can also terminate the contract for a breach of the Terms.
Who is responsible	You, fully: for your own activity and for that of everyone you give access to (employees, contractors, visitors to your hosted resources, etc.). By accepting the services, you confirm that they will also comply with the Terms.
Passwords and keys	You are the one who protects your passwords, SSH keys, API tokens and second authentication factor. BLACKBOX is not liable for third parties' use of your accounts unless there is a proven breach of BLACKBOX systems.

A hacked server can break the rules in your name

A compromised server (a weak password, an outdated CMS or plugins, a database exposed to the internet) can send spam or attack other systems without you knowing. As far as the network is concerned, the traffic comes from your server, and clause 2.8 prohibits taking part in attacks, including through gross negligence.

How to reduce the risk:

Secure the server as soon as you receive it: Securing a new server: checklist.
Watch for signs that the server has been hacked: the CPU kept busy by unknown processes, unexplained outgoing traffic, an email queue that keeps growing.

If BLACKBOX contacts you about a report concerning your server, or you notice yourself that the server is sending spam or attacking other systems:

If it is happening right now, stop the server: in the app.blackbox.md panel, open “Infrastructure” → “My Servers”, click “Stop” on the server card and confirm “Stop SERVER_NAME?”. Cards marked “Managed” don't show the buttons; write to us directly.
Write to us as soon as possible at support@blackbox.md with the server's IP address, the order number, when you noticed the problem and what you have already done.
Clean up the server and close the way the attacker got in: Your server was hacked or is under attack: what to do.

Security Never send passwords, private keys or tokens in emails or support tickets.

Good practices for sending email

If your server sends email (newsletters, notifications from your website, your own mail server), follow the rules below. They help you comply with clauses 2.2 and 2.3 and reduce the risk of your messages ending up in spam.

DNS record (TXT)	Name	Example value	What it does
SPF	`DOMAIN`	`v=spf1 ip4:SERVER_IP ~all`	Lists the servers that are allowed to send email on behalf of the domain. A domain has only one SPF record; if you also send through an external service, add to it the `include:` that the service gives you.
DKIM	`SELECTOR._domainkey.DOMAIN`	`v=DKIM1; k=rsa; p=PUBLIC_KEY`	Signs every message. The key is generated by your mail software or by the service you send through.
DMARC	`_dmarc.DOMAIN`	`v=DMARC1; p=none; rua=mailto:EMAIL_ADDRESS`	Tells receiving servers what to do with messages that pass neither SPF nor DKIM, and where to send reports. Start with `p=none`, then switch to `quarantine` or `reject` once the reports show that your legitimate messages pass the check.

You add these records at your domain's DNS provider. If you have connected Cloudflare or GoDaddy, you can also add them from the “DNS” page of the panel: Managing DNS records from the panel. Reverse DNS (PTR) for the IP address can't be set up from the panel; if you need it for a mail server, write to us.

For mailing lists:

Use double opt-in: an address joins the list only after the person confirms the subscription through the link they receive by email.
Keep proof of consent (for example, the date and time of the confirmation) for as long as the list exists.
Put an unsubscribe link in every message, and promptly remove anyone who unsubscribes.
Don't buy or rent address lists.

Frequently asked questions

Is the list of prohibited activities complete? No. The Terms say “Lista nu este exhaustivă” (The list is not exhaustive), and BLACKBOX can step in whenever a situation affects the integrity of the network or of other customers. If you're not sure, ask us first at support@blackbox.md.

Can I send a newsletter from my BLACKBOX server? Yes, if the recipients subscribed through double opt-in, you keep proof of their consent and you don't use bought or rented lists. Messages sent to people who didn't ask for them are spam and are prohibited.

Will I be notified before a suspension? It depends on how serious the situation is. The Terms allow suspension with or without prior notice; where notice doesn't put other customers at risk, BLACKBOX tries to give it.

Who is responsible if an employee or contractor breaks the rules? You are. The customer is responsible for everyone they give access to the services.

How do I report spam or an attack coming from a BLACKBOX server? Write to support@blackbox.md and include the IP address, the date and time (with the time zone) and the evidence, for example the full headers of the spam message or excerpts from the logs.