Twenty-five of 569 LowEndBox offers came from providers who later deadpooled. The graveyard writeup calls that a 4.4% bad-offer rate, from a 2023 count of two years of offers, and 2.8% once DediPath is taken out of the same count. A year paid at checkout is the balance sitting with the host when the shutdown letter arrives. The company age, the ASN on the test IP, the two nameserver addresses, the payment buttons, and the last public post are all visible before that checkout.
Read the domain's creation date
whois on lowendbox.com prints two creation lines, 2008-02-01T05:39:38Z and 2008-02-01T00:39:38Z, the same calendar day five hours apart, and the registrar is GoDaddy. The organization field reads Domains By Proxy, LLC. That is a privacy service, so the publisher's name is on the terms page, and from there it is a Companies House, KvK, or Handelsregister search. lowendbox.com is the worked example because the reply is public and old. The same command goes on the host's domain.
whois lowendbox.comThe summer-host post treats a domain registered days before the offer, next to a homepage that claims a decade of data-center experience, as the first hallmark. A copied terms page sometimes still contains the other company's name. Search the terms for a second company's name.
A letter to Lewis's customers came from Velox Media Inc., which described itself as a newly established corporation. It said management of the resources had moved on 21 December 2025, the existing agreement stayed with Lewis, and accounts were set to expire on 15 January 2026 unless renewed at $4 a month. A creation date in whois, set beside the word "established" in a letter or on a homepage, is this check.
See which ASN announces the IP
The test IP in the offer is the one to query, before you buy. This reply is for 1.1.1.0/24, Cloudflare and APNIC's public resolver prefix, so the fields are a real route object and a known network.
whois -h whois.radb.net \
-- '-T route 1.1.1.0/24'Read origin and rpki-ov-state. On this prefix the origin is AS13335 and the RPKI state is valid, and the reply carries more than one descr. Stop on the origin, and read every descr. A host that names an ASN on the sales page should match that origin. An origin that belongs to the upstream, while the page says the network is theirs, is the rented-everything pattern the summer thread names: the hardware bill and the address bill are someone else's, and they come due on the upstream's calendar.
PeeringDB is the other public page for that ASN. A network with a record there has a name, a set of facilities, and a contact. A prefix with a route object and a valid RPKI state is a different object from a homepage that says "our global backbone."
Resolve both nameservers
dig NS on lowendbox.com returns two Cloudflare names, walk.ns.cloudflare.com and valentin.ns.cloudflare.com. The A records for those names are three addresses each, and the two sets are disjoint. Order in the NS reply moves between queries. The addresses are the check.
dig NS lowendbox.com +short
dig A valentin.ns.cloudflare.com +short
dig A walk.ns.cloudflare.com +shortThe failure shape is both names on one address. A lab resolver on 127.0.0.1 port 5354, answering for example-hosting.com, returns ns1 and ns2 and then 192.0.2.53 for each. That address is documentation space. The zone exists to show the shape, and it is a host that was stood up for the screenshot.
dig @127.0.0.1 -p 5354 \
NS example-hosting.com +short
dig @127.0.0.1 -p 5354 \
A ns1.example-hosting.com +short
dig @127.0.0.1 -p 5354 \
A ns2.example-hosting.com +short
A status hostname that resolves to the same address as the site is one box wearing two names. When that box stops, the status page stops with it, which is the silence phase in the graveyard writeup. The status page still says everything is up, or the page is down with the machine. Backups on that same provider go the same way. The OVH SBG2 piece is the version of that where the backup was in the building that burned.
Put the year next to the dispute window
The summer-host post uses an 8 GB plan at $20 a year as the shape of the offer. Spread across twelve months that is $1.67. The graveyard writeup's advice on the other side of the same price is to keep the prepay inside the amount you can stand to lose, and it names a three-year discount as three years of payments if the host closes the next month.
PayPal's purchase protection splits the clocks. A dispute for a missing item is 180 days from the payment. A dispute for an item that arrived and was the wrong thing is the sooner of 30 days after fulfillment and 180 days from the payment. A VPS you logged into was fulfilled. If the company dies in month four, the 30-day clock from fulfillment has passed, and a missing-item dispute is about a server you already logged into. PayPal's page also says that opening the dispute with the card issuer closes the PayPal claim, so the buyer picks one path. Card rights can be the wider of the two, and they follow the scheme's own window, which is a reason to read that scheme before treating "I paid by card" as a year of cover.
Crypto, in SalmonCloud's 2026 letter, needed a wallet address supplied in a ticket before the refund could be sent. Lewis's letter sent people to their bank for payments made before 21 December 2025, and said the earlier payments sat outside the new company's accounts. Upstream's notice is the other rail: refunds on the original payment method, processing from 14 November 2025 and done within three business days, or a ticket for refunds that method leaves out. The buttons on the order form are which of those letters you are buying.
SalmonCloud had already posted a shutdown for the end of July 2025, then told customers services would continue, then set the end at 1 June 2026, with a prorated refund for time after 31 May 2026. A monthly price would have made each of those turns one invoice. A year paid in the spring sat across the reversal and the second ending.
Lifetime deals are the far end of the same prepay. The graveyard writeup follows MyW, a lifetime-deal host that wound down in early 2025, and it reports one member's tally of $4,100 lost across CloudatCost and MyW. The same writeup's counterexample is DataIdeas, which gave notice and refunded unused prepaid time.
Read the last public letter
The graveyard writeup lays the decline out in four beats. The launch is fast replies and a price that looks keen. Then replies slow down and a few outages go unexplained, and the owner posts less. Then tickets sit for days, and the status page and the VPS disagree. Then either a short migration window arrives by email, or the servers stop.
SalmonCloud's second letter said the team was reduced and replies would take longer, and it made the refund a ticket. That is the slow-reply beat, written down by the host. Upstream named a last day for the VPS brands and kept the LIR. Lewis's customers heard from a new company that the old agreement would lapse on a date. ConfigServer sits on the summer thread's deadpool list too, and it is a different ending: Way to the Web set 31 August 2025 as the close of a software business that had run more than 25 years, with notice and a last day for downloads. Reading the list means reading which kind of close it was.
DediPath's customers got the shutdown email on 31 August 2023. The graveyard writeup's point about that one is the size: an advertiser, years of history, more than one location, and the email still came. A young domain is the easy miss. An old domain still wants the other four checks.
A presales ticket is the live half of this check. One question, and the clock until a human answer. The letters already contain that clock. A ticket sent for this article would have been a second one.
What a marketplace checks before the listing
Preflight re-checks a plan on a schedule, about every few minutes, and a red gate pulls the plan out of search. The gates are the addon, the agent, the platform API, the node, physical fit, sell capacity, an IP from the pool, and an OS template. Physical fit asks whether the node reports enough cores, RAM, and disk for one instance of the plan. A rented server that reports those numbers passes it the same way an owned server does. The check is the report, and the title on the hardware stays with the host.
Live validation is the separate step. Someone starts it per plan and node. NodeRings creates a pilot VM, assigns addresses, pings them, can SSH in when the benchmark option is on, stops and starts the VM, and deletes it. A plan lists once a sell-region node has passed both. That run proves a VM can be born and removed. It is silent on whether a ticket in August gets a reply.
On the money side, billing has two payout rails. Stripe Connect sends the host through Stripe's own onboarding, business and bank details, and pays out once Stripe reports charges and payouts enabled. The Community commission is 15%, taken from the listed price. Manual payouts wait until the chargeback window has largely passed, which the page puts at 60 to 120 days. What NodeRings is is the longer account of that split. The node, the abuse desk, the backups, and the August ticket stay with the host.
| Check | Command or page | What you want to see |
|---|---|---|
| Company | whois on the domain | A creation day in line with the years the site claims, and a legal name you can find in a registry |
| Network | whois -h whois.radb.net on the test IP | An origin ASN that matches the page, and a valid RPKI state |
| Nameservers | dig NS, then dig A on each | Two names whose addresses differ |
| Money | The order form | A card or PayPal, and a monthly price beside the year |
| Support | The host's forum, then one ticket | A recent post by the operator, and a human answer |
The refund rail is the part the letters disagree on. Upstream promised the original payment method inside three business days. SalmonCloud's crypto refunds waited on a wallet address in a ticket. Lewis sent earlier payments to the bank. Those three are visible as buttons before you pay, or they arrive later as the shutdown letter.