Nearoute Limited Acceptable Use Policy

Effective date: 2021.9.28
Last updated: 2026.10.3

This Acceptable Use Policy (AUP) governs the use of Nearoute Limited's (Nearoute, we, us, or our) data-centre, IDC, ISP, computing, hosting, equipment and network Services. It covers cloud and VPS services, dedicated or rented servers, Customer Equipment colocation, cabinets and rack space, power, cross-connects and remote hands, IP Transit, Internet bandwidth and private connectivity, IP address leasing, and activities undertaken through Nearoute in connection with permanent IP transfers.

It applies to Services contracted through nearoute.com, vps.nearoute.com, an accepted written Order, or another authorised Nearoute channel. It forms part of our General Terms of Service (TOS). Capitalised terms have the meanings given in the TOS. You must ensure that relevant users, visitors, contractors, resellers and downstream customers comply within the scope of your authority and the applicable Service.

Illegal and criminal activities are strictly prohibited. We may act immediately against an ongoing attack, serious unlawful activity, or a material threat to people, equipment or infrastructure. An ordinary abuse notice requires a substantive response within 24 hours of delivery.

This revision applies to existing agreements through their applicable amendment process. It does not create retrospective breaches or a continuing right to control unrelated resources after a completed permanent IP transfer.

1 Scope and relationship with other terms

1.1 This AUP covers relevant content, software, traffic, route announcements, infrastructure use, physical access, equipment installation, and instructions to Nearoute. It applies at an agreed customer, facility or network handover point according to the Service. Using an intermediary does not exempt an activity intentionally supported through our Services, but traffic passing through a wholesale network does not by itself prove that the customer knowingly authorised its contents.

1.2 This AUP supplements the acceptable use provisions in Sections 8 to 12 of the TOS and is to be read consistently with them. It does not alter the TOS rules on billing, refunds, consumer rights, data protection, or liability. Mandatory law takes priority. A product-specific restriction applies only if it was properly disclosed and incorporated into the relevant Order or validly introduced under the TOS.

1.3 Approval for a workload does not authorise illegality, infringement, unsafe installation or use outside its scope. Available functionality, provisioning or delayed enforcement is not endorsement. For a permanent IP transfer, this AUP governs conduct in the Nearoute transaction and any continuing Nearoute Service; it does not itself impose perpetual operational control after completed transfer and departure from our Services.

2 Legal compliance

2.1 You must not use or permit the use of the Services to commit, attempt, organise, promote, facilitate, conceal, or knowingly support unlawful or criminal activities. You must comply with laws and binding orders applicable to you, your activities, and the Services, including:

• the laws of the Hong Kong Special Administrative Region, including national laws lawfully applicable in Hong Kong;

• the laws of the People's Republic of China, including Mainland China laws where applicable to the customer, activity, users, or transaction;

• the laws of the country or territory where you reside, are established, or access or operate the Services;

• the laws applicable to the infrastructure location, the relevant data, and the persons or activities involved.

2.2 As a separate contractual condition, Nearoute also prohibits using the Services to carry out or knowingly support activities prohibited by the laws of Hong Kong or Mainland China, even where the customer or server is elsewhere. This is a condition of using Nearoute's infrastructure and does not assert that every Mainland China law applies territorially in Hong Kong or another jurisdiction. We will enforce it consistently with laws binding on us. If relevant legal requirements conflict, notify us and stop the affected use unless a lawful arrangement is available.

2.3 You must obtain the licences, authorisations and consents required for your own activities, including resale of regulated telecommunications or Internet services, permitted equipment installation, and use of IP Resources. Buying a circuit, cabinet, server or IP transfer does not grant a regulatory licence. Nearoute remains responsible for authorisations required for its own promised supply.

2.4 You must not evade sanctions, export controls, trade restrictions, or eligibility conditions that lawfully apply to a transaction. The separate service-availability provisions in the TOS continue to apply.

3 Prohibited conduct and content

3.1 Fraud and financial crime. Phishing, impersonation for deception, scams, fraudulent investment platforms, pyramid schemes, unlawful fundraising, payment fraud, theft of digital assets, money laundering, or knowingly hosting payment or communications infrastructure for criminal proceeds.

3.2 Illegal markets and unlicensed activities. Unlawful gambling, betting or lotteries; unlawful sale of drugs, weapons, counterfeit goods or controlled items; trafficking in stolen credentials, accounts or payment data; human trafficking; or regulated services operated without required authorisations.

3.3 Sexual abuse and exploitation. Child sexual abuse or exploitation material, grooming, sexual trafficking, non-consensual intimate images, and synthetic depictions of such abuse or exploitation. Pornographic or obscene material is prohibited where its creation, possession, hosting, or distribution violates Section 2. The use of AI or fictional characters does not excuse prohibited material.

3.4 Violence and unlawful threats. Credible threats, incitement to violence, facilitation of terrorism, unlawful harassment, stalking, or conduct unlawfully endangering national security or public safety.

3.5 Privacy violations. Unlawful surveillance, interception, doxxing, identity theft, or collection, access, sale, disclosure, or cross-border transfer of personal data. You must not operate a service for distributing stolen databases or unlawfully obtained personal information.

3.6 Intellectual property infringement. Hosting, distributing, selling, or otherwise exploiting material without the rights or legal permission required for that use, including infringing software, media, databases, trade marks, trade secrets, or unlawful circumvention tools. A lawful exception or licence must cover the actual use.

3.7 Knowing facilitation. Renting access, selling relay capacity, or providing other resources while knowingly supporting prohibited conduct is itself prohibited. Marketing a service as “bulletproof”, “offshore”, or “anonymous” does not exempt it from law or abuse enforcement.

3.8 These restrictions apply regardless of whether the material or activity is created manually, generated by AI, or distributed automatically. They do not turn otherwise lawful security research, encryption, or ordinary administration into abuse merely because those activities involve technical tools.

4 Network and system security

4.1 You must not access or attempt to access a system, account, device, or dataset without the necessary authorisation. Prohibited conduct includes credential theft or stuffing, brute-force login attacks, unauthorised exploitation, session hijacking, and unlawful interception or alteration of communications.

4.2 You must not launch, coordinate, or provide infrastructure for denial-of-service or distributed denial-of-service attacks, reflection or amplification attacks, attack-for-hire services, or booter and stresser services.

4.3 You must not deploy malware for harmful purposes, ransomware, botnet command-and-control systems, malicious payload delivery, or software intended to steal credentials, compromise devices, or conceal an attack. Legitimate malware analysis must remain within an authorised, appropriately isolated environment and comply with Section 5.

4.4 Source-address spoofing, route hijacking, unauthorised packet capture, interference with virtualisation boundaries, attempts to access another customer's resources, and tampering with infrastructure security or metering are prohibited.

4.5 You must secure internet-facing services against foreseeable abuse. Examples include configuring authentication and access restrictions for mail relays, proxies, databases, management panels, recursive DNS services, and protocols capable of amplifying traffic. A service must not be left open in a way that materially enables attacks or unauthorised access.

4.6 You must not intentionally interfere with monitoring used for service reliability, billing, security, or legitimate abuse prevention. This does not prohibit ordinary encryption, privacy tools, or reasonable access controls for your own server.

5 Security research and testing

5.1 Testing is permitted only within the valid authorisation of the system owner and the agreed scope, time, targets, and methods. Permission to test one system does not authorise testing adjacent systems, other customers, or unrelated IP addresses.

5.2 Testing Nearoute infrastructure requires our prior written authorisation. Testing another customer's Service requires the relevant owner's written authorisation. Stress tests or other tests that could affect shared infrastructure also require our prior written approval, even if you control the intended target.

5.3 Do not perform unrestricted internet scanning, credential attacks, exploit delivery, or destructive testing from our network. An authorised vulnerability assessment must minimise disruption, limit collection of third-party data, and stop if it creates a material risk outside the authorised scope.

5.4 Report a suspected vulnerability in our Services through the contact details in Section 17. Provide enough information to investigate without publishing an exploit, accessing unrelated data, or sending live malicious attachments. Reporting a vulnerability does not itself authorise further testing or create an entitlement to payment.

6 Email and messaging

6.1 Unsolicited bulk messages, deceptive or fraudulent messages, unlawful marketing, and services that facilitate them are prohibited. This applies to email, SMS, messaging platforms, comments, and other communications. Collecting replies through our Services to spam sent elsewhere is also prohibited.

6.2 Legitimate mailing must use lawfully obtained recipient details and comply with applicable consent, sender identification, and opt-out requirements. Do not use purchased or unlawfully obtained mailing lists, forged headers, deceptive routing information, open mail relays, or another person's identity without permission.

6.3 Honour applicable unsubscribe requests and take reasonable steps to prevent compromised websites or scripts from generating spam. You may be asked to provide evidence that a mailing is authorised or that a compromised service has been secured.

6.4 We may restrict outbound mail ports, sending volumes, or affected accounts where reasonably necessary to contain abuse. General product restrictions must be disclosed before purchase. A third-party blacklist entry is relevant evidence, but does not by itself conclusively establish intentional wrongdoing. You must cooperate in resolving a credible listing or complaint relating to your resources.

7 Fair use of computing and storage resources

7.1 Computing and storage limits apply to the capacity and management scope actually supplied. Virtual or shared infrastructure is not dedicated hardware unless agreed. A customer's own colocated server is not subject to a VPS CPU or I/O limit merely because it occupies our rack space; its agreed power, heat, safety, network and space restrictions still apply.

7.2 Do not deliberately monopolise shared resources, trigger runaway processes, create uncontrolled process forks or connection floods, or generate storage or I/O activity that materially impairs other customers or threatens infrastructure. We assess the actual resource allocation, service description, measurements, and impact rather than relying solely on a workload's name.

7.3 This AUP does not impose an undisclosed fixed CPU percentage, I/O limit, or maximum duration of sustained activity. Any such contractual threshold must be stated in the product information or validly introduced under the TOS. Normal use within expressly purchased dedicated capacity is not abuse merely because it is continuous or intensive.

7.4 If usage creates a substantiated problem without an urgent risk, we will explain the issue and provide a reasonable opportunity to adjust the workload, correct a fault, or move to a suitable plan. Additional capacity or an upgrade is chargeable only on an accepted basis; we will not impose an undisclosed retrospective fee.

7.5 If immediate protection is needed, we may temporarily limit resources, isolate a process or server, or suspend affected Services. The measure should address the actual risk and last no longer than reasonably necessary. A permanent material reduction of the purchased Service remains subject to the TOS and applicable remedies.

8 Traffic and connectivity

8.1 A port speed, committed bandwidth, data-transfer allowance and percentile-billed service are different products. Follow the measurement point, direction, period, aggregation, commitment and excess-use arrangement agreed in the Order and TOS Schedule D. No undisclosed lower fair-use limit replaces an advertised dedicated commitment, and no new percentile-billing method or charge arises solely from this AUP.

8.2 Do not use unauthorised IP addresses, evade traffic accounting, manipulate routes without permission, create packet or connection floods, or generate traffic for the purpose of degrading another service. Avoidable misconfiguration must be corrected when it creates a material network risk.

8.3 Where agreed limits are exceeded, the disclosed response may include throttling, suspension, or an accepted overage charge. We will investigate a reasonable challenge to usage measurements. No new overage price applies retrospectively.

8.4 Being the victim of a DDoS attack is not itself an AUP violation. We may nevertheless filter traffic, temporarily block traffic to an affected IP address, or isolate a Service to protect the network. DDoS protection is provided only to the extent stated in the Order; no protection is represented as unlimited.

8.5 IP reputation, third-party geolocation, external routing, and access from every country or network cannot be guaranteed merely by this AUP. Express commitments in the Order and Nearoute's responsibility for its own network remain unaffected.

9 Proxies VPNs mining and other workloads

9.1 VPNs, proxies, Tor relays or exit nodes, peer-to-peer applications, crypto-mining, automated data collection, and similar workloads must comply with the law, this AUP, and any disclosed product-specific restrictions. They are not automatically authorised by a server's technical capability, and this AUP does not impose a blanket prohibition on an otherwise compliant workload merely because it falls within one of those categories.

9.2 Public relay or hosting operators must take reasonable measures to prevent abuse, restrict access where appropriate, and respond to credible reports. They may not knowingly provide capacity for prohibited activity or misrepresent the service as exempt from investigation.

9.3 Automated data collection must respect applicable law, access authorisation, protected rights, and the privacy of individuals. It must not involve stolen credentials, unlawful access-control circumvention, or traffic that materially disrupts a target or our infrastructure.

9.4 High computational demand does not excuse exceeding purchased resources. Security testing and attack simulations remain subject to Section 5, irrespective of how they are described or sold.

10 Account integrity and responsibility for users

10.1 Provide accurate registration and billing information, protect credentials, and comply with the TOS rules on additional Accounts. Do not impersonate another customer, use unauthorised payment methods, exploit promotions through false identities, or bypass a restriction through replacement Accounts.

10.2 Make the relevant rules binding on people to whom you grant hosting, facility access or use of the Services, including staff, authorised visitors, contractors and downstream customers. Take reasonable preventive steps and act promptly on substantiated abuse within your control. Resale does not grant broader rights than your own Order. This is not an unconditional duty to inspect every downstream communication or take action beyond your lawful authority.

10.3 If an Account or server is compromised, promptly notify us, contain the issue, change affected credentials, and remedy the cause. We may take proportionate protective action even where the activity was not authorised by you. Responsibility for charges or losses remains subject to the TOS and applicable law; compromise does not automatically make you liable for Nearoute's own security failures.

11 Reports and copyright complaints

11.1 Send abuse reports to [email protected]. Include the relevant IP address, URL or resource identifier; dates, times and time zone; a description of the suspected violation; available supporting evidence; and a contact method. Explain any urgent ongoing risk.

11.2 For a rights complaint, identify the protected work or right, your ownership or authority to act, the specific allegedly infringing material and its location, and the factual basis for your complaint. Make reports accurately and in good faith. Do not submit a report to suppress material you know is authorised or lawful.

11.3 Use safe references or redacted evidence where possible. Do not attach executable malware, unnecessary sensitive personal data, or copies of child sexual abuse material. We may ask for further information through an appropriate channel.

11.4 We may request a response from the customer and, where justified, restrict the affected material or Service. Customers may provide a licence, evidence of authorisation, mistaken identification, or another relevant defence. Serious or repeated substantiated infringement may result in termination.

11.5 Where a particular statutory notice or counter-notice process applies, we will follow the requirements applicable to us. This AUP does not claim automatic DMCA safe-harbour status or designate an unregistered statutory agent.

12 Response deadlines and enforcement

12.1 For an ordinary abuse notice, respond substantively within 24 hours of delivery to your registered or designated operational contact and comply with the stated corrective deadline. Explain the action taken or provide evidence disputing the report. Keep operational and emergency contacts appropriate to the Service, including an out-of-hours contact where agreed or needed for an urgent incident. If delivery fails, we will use another available channel where practicable. An automated acknowledgement is insufficient.

12.2 We may act immediately without advance notice to stop an ongoing attack, serious unlawful activity, imminent security threat, material harm to others, or to comply with a binding legal requirement. The ordinary response period is not permission to continue harmful activity.

12.3 Proportionate measures may include requesting correction, filtering traffic, withdrawing an affected route or LOA, limiting a resource, isolating equipment, disabling an affected circuit, restricting site access, disconnecting unsafe power, or suspending or terminating a Service. Where possible, limit the measure to the resources creating the problem and explain restoration requirements. Neither a power disconnection nor an AUP allegation gives us automatic title to Customer Equipment or a unilateral right to reverse a completed permanent IP transfer.

12.4 We will communicate the reason and reasonable restoration requirements when lawful and practicable. Restoration may require evidence that the cause has been removed, credentials secured, vulnerable software corrected, or the prohibited activity ended. We will assess that evidence reasonably.

12.5 An allegation alone is not conclusive proof of a violation. We may act on credible evidence and a reasonable risk assessment without waiting for a criminal conviction. You may request a review through support or the contact details below; we will consider relevant evidence and correct a mistaken restriction. Necessary protective restrictions may remain during the review.

12.6 Billing, refunds, cancellation, and liability remain governed by the TOS and mandatory law. We do not impose an undisclosed automatic abuse fine or claim a right to punitive forfeiture. Recoverable costs must have a lawful basis and be supported by evidence.

13 Data protection and cooperation with authorities

13.1 Investigation of abuse is subject to the Privacy Policy and Section 13 of the TOS. We may use proportionate operational logs, reports, and technical checks, but this AUP does not authorise unrestricted access to private communications or blanket disclosure of Customer Data.

13.2 We will cooperate with competent law enforcement agencies and other authorities where a valid, binding legal requirement applies. Where disclosure is permitted but not compulsory, we will disclose relevant information only after the assessment required by the TOS and Privacy Policy, including verification of authority and sufficient objective grounds for a lawful, necessary, and proportionate disclosure.

13.3 A private complaint or overseas request does not automatically give the requester a right to customer information. Notice to the customer may be delayed or withheld where legally prohibited, where it would prejudice a legitimate investigation, or where a material risk of harm or destruction of evidence exists.

13.4 We may lawfully preserve relevant evidence. This does not promise continued hosting or recoverability. The 72-hour deletion rule applies to Retail Cloud virtual servers suspended for non-payment, not automatically to customer-owned equipment, physical server rental, cabinets, network services, or completed IP transfers. Equipment handling follows TOS Schedules B and C; temporary and permanent IP rights follow Schedule E. Lawful preservation may require limited records to remain after service exit.

14 Facility access equipment and electrical safety

14.1 Use only your authorised space and resources and comply with lawful, disclosed site rules. Do not enter restricted areas, tailgate, share access credentials, photograph other customers' equipment without authority, or interfere with surveillance, alarms, fire protection or access controls. Visitors and contractors must follow the appropriate identity, escort and work-authorisation process.

14.2 Do not overload a rack, floor, circuit or power distribution unit; bypass electrical protection; obstruct airflow or emergency exits; or introduce unauthorised cabling, radio transmitters, hazardous materials, batteries or special cooling systems. Do not treat A and B feeds as permission to exceed the agreed failover load. Obtain approval for installations affecting shared systems and disclose material special requirements before delivery.

14.3 Work on shared infrastructure, power distribution, cross-connects or another customer's equipment requires the appropriate authorisation. Use agreed installation and change procedures. Notify us promptly of a physical or electrical hazard; we may take immediate proportionate action to protect people and equipment without awaiting an ordinary abuse deadline.

14.4 Remote-hands requests must come from an authorised person and identify the equipment and task accurately. Do not use a work request to gain access to another party's equipment, copy data without authority, bypass a security restriction, or obtain an unauthorised reboot, wipe, route change or equipment collection.

14.5 Keep equipment inventories and access lists current, remove waste appropriately, and arrange lawful equipment collection at service exit. A dispute over fees does not authorise either party to remove someone else's property, and the applicable property and exit provisions remain those in TOS Schedule C.

15 Routing and IP resource integrity

15.1 Advertise only prefixes and ASNs you are authorised to use, within the agreed transit or peering scope. Provide authentic LOAs or other authority where required. Do not originate another party's address space, use a forged origin, leak routes, manipulate agreed filters, or deliberately invalidate route authorisations. Maintain relevant IRR, RPKI, reverse-DNS and abuse-contact records within your control.

15.2 Avoid switching loops, broadcast or multicast storms, unauthorised bridging, source-address spoofing and connection floods. Cooperate with reasonable prefix filtering, maximum-prefix limits, anti-spoofing and emergency route withdrawal. Material permanent capacity or routing restrictions remain subject to the Order; an emergency measure is not an indefinite reduction of a purchased Service without an appropriate contractual basis.

15.3 For IP leasing, stay within the authorised prefixes, term, routing and subleasing permissions. Do not represent a lease as a permanent sale, submit an unauthorised registry transfer, or continue using or announcing resources after the entitlement and agreed transition period end.

15.4 For a permanent transfer, supply accurate ownership, authority, registry and recipient information and comply with the actual RIR or NIR process. Forged documents, hijacked registry credentials, concealment of a material rights dispute, or evasion of an applicable transfer restriction is prohibited. Payment, an LOA or a BGP announcement alone does not establish a completed permanent transfer.

15.5 A registry complaint or third-party blacklist entry must be assessed on the evidence. We may protect our own network or lease rights within the agreement, but this AUP does not grant us the registry's powers or permit us to reclaim a permanently transferred resource because an unrelated Nearoute Service ends.

16 Changes to this AUP

16.1 Changes are subject to the notice, acceptance, and cancellation protections in Section 23 of the TOS. We will normally give at least 30 days' advance notice of a material adverse change to an existing paid Service, unless a shorter period is required by law or reasonably necessary to address an urgent security or abuse risk.

16.2 Revised restrictions will not retrospectively turn a previously permitted activity into a past breach. We may still take lawful protective action against an existing threat or unlawful use. Mandatory consumer rights and accrued remedies remain unaffected.

17 Contact

Service provider: Nearoute Limited
Registered office: RM 22, 2/F, FU TAO BUILDING, NO. 98 ARGYLE STREET, MONGKOK, HONG KONG
Corporate website: nearoute.com
Retail cloud portal: vps.nearoute.com
Abuse, security and rights reports: [email protected]
Customer support and reviews: the support ticket function in your customer area or the operational contacts specified in your Order
Public contact form: Contact Nearoute

Legal notices may be submitted through the public contact form or sent to the registered office, subject to any mandatory rules for formal service. This English version is the contractual version unless we expressly designate another version as contractual; mandatory language protections remain unaffected.