In case it is an attack, an attacker would get what he wants, as soon as domain would be switched off. Why should the TS help him?
You make a good point. But still, you're running a business. You may not be able to afford to chase after a problem caused by a single website on a shared server. Our terms of service for shared webhosting allow us to turn off services for a single site affecting the entire server, because otherwise we lose lots of clients instead of just one.
For clients with either dedicated servers or VPS instances we can fix the problem at an hourly rate because only the client is affected.
The one exception being if there's a DOS attack costing us lots of bandwidth we'd have to pay for ourselves; in that case we must turn off the client unless they pay upfront to keep them up while tracing the problem.
There needs to be a business case, or we're not around next month, either to earn a living, or to support our clients not having problems.
We turn off only the minimum. For example, yesterday we found a client's email password had been hijacked and someone was sending email through our server by means of password authenticated SMTP. We changed the client's email password and notified them of the problem. We didn't charge for the time it took to find and clean up the problem, because it likely wasn't the client's fault, but our TOS allows us to, and will if it repeats.
Jeff
