diff --git a/src/content/posts/how-to-verify-a-hosting-provider-before-you-buy.md b/src/content/posts/how-to-verify-a-hosting-provider-before-you-buy.md
new file mode 100644
index 0000000..606f678
--- /dev/null
+++ b/src/content/posts/how-to-verify-a-hosting-provider-before-you-buy.md
@@ -0,0 +1,129 @@
+---
+title: "How to Verify a Hosting Provider Before You Buy"
+description: "A reusable checklist for separating real hosting claims from marketing: check the domain age against the 'since' claim, read the AUP for silent disqualifiers, and cross-check reputation on third-party sources."
+pubDate: 2026-09-09
+category: tutorials
+tags: [hosting, vps, due-diligence, whois, devops]
+---
+
+Every hosting provider's homepage is a list of promises: *"in business since 2005"*,
+*"guaranteed uptime"*, *"privacy-friendly"*, *"unlimited bandwidth"*. Some of it is
+true. A surprising amount of it isn't — and none of it is checked before you hand
+over a card number and point DNS at their servers.
+
+Recently I had to shortlist a pool of providers for a project with specific
+requirements (privacy jurisdiction, payment methods, traffic limits). I couldn't
+afford to trust the marketing, so I built a quick verification pass. It caught
+real problems — providers whose "operating for years" claim was younger than my
+last haircut, providers whose own terms quietly banned the exact thing I wanted
+to run, and providers on third-party blacklists.
+
+Here's the checklist, in the order I run it. None of it needs a paid tool.
+
+## 1. Check the domain age against the "since" claim
+
+A provider that says *"trusted since 2012"* should have a domain older than my
+coffee order. If the domain is four months old, "since 2012" is either a
+re-branded shell or a lie — either way it tells you something about how the
+company describes itself.
+
+The quickest check is a WHOIS/RDAP lookup. RDAP is the modern replacement for
+WHOIS and returns JSON, which is easier to parse:
+
+```bash
+curl -s "https://rdap.org/domain/example.tld" | python -m json.tool
+```
+
+Look at the `events` array for the `registration` event — that's the original
+creation date, not the last renewal. (Renewal dates and registrar changes will
+hide further down the timeline; the *first* registration is the one you want.)
+
+The false-negative rule cuts both ways: a brand-new domain *can* be a legitimate
+new company. But an old "since" claim on a young domain is always a flag — it
+means the historical claim isn't independently verifiable, and I treat anything
+else on that page with the same skepticism.
+
+## 2. Read the AUP (Acceptable Use Policy) — not the features page
+
+This is the highest-signal step and the one most people skip. The features page
+tells you what they *allow you to pay for*. The AUP tells you what they'll
+suspend you for. Those are different lists.
+
+The disqualifiers are usually in the "Prohibited activities" section, and the
+phrasing is what matters:
+
+- **"TOR nodes", "Tor relays", or "exit nodes"** — if you plan to run anonymity
+  tooling, this is a hard no, and it can hide in a list that *looks* like it's
+  only about abuse.
+- **"reverse proxies", "anonymizing services", "tunnels"** — this bans far more
+  than you'd think. A lot of legitimate architecture (a caching proxy, a
+  GitOps webhook relay) technically trips this wording.
+- **Jurisdiction and identity clauses** — "must provide accurate identity",
+  "complies with local law enforcement", or the AUP being bound to a specific
+  country's law. If your whole reason for choosing the provider is jurisdictional
+  distance, this line voids it.
+
+The One Weird Trick: paste the AUP URL and search for the word you care about.
+I spent ten minutes reading a whole AUP once before realizing a single
+`Ctrl-F` for "tor" would have answered my question in five seconds.
+
+## 3. Cross-check reputation — but on third-party sources, not their page
+
+Testimonials on the provider's own site are decoration. You want places where
+the provider can't delete the bad reviews:
+
+- **Trustpilot** — but read the *trend*, not the average. A 3.5 with a long tail
+  is fine; a 3.5 where the last six months are all 1-star "they suspended my
+  server" reviews is a real signal.
+- **Reddit, especially r/hosting, r/webhosting, r/sysadmin** — search the brand
+  name. The community has a long memory for exit-scams and mass-suspension
+  events, and it's usually blunt about which providers are "a well-known
+  scammer."
+- **WHTop / HostAdvice** — the ratings are noisy, but a 1.8/10 with a pattern of
+  the same complaint repeated is different from a 1.8 with a handful of one-off
+  gripes.
+
+The single most useful signal I've found: **suspension reports.** A provider that
+responds to abuse complaints by suspending first and charging a "reinstatement
+fee" second will say so in black and white in someone's review. That's a
+business-model red flag, not a support incident.
+
+## 4. Verify the "privacy" claim if it matters to you
+
+"Privacy-friendly" and "offshore" are marketing words until they're reflected in
+the actual documents:
+
+- **The privacy policy's retention section.** A provider that says "we retain
+  records as long as necessary for legal / tax / accounting" is telling you they
+  keep logs. Full stop.
+- **The payment rail.** Who actually processes crypto, and is it a third-party
+  gateway that itself requires KYC? A self-hosted gateway with no external
+  identity step is a very different privacy posture than "bitcoin via a
+  KYC-reseller."
+- **The incorporated entity.** "Offshore hosting since 2000" is worth almost
+  nothing if the company is registered in, and bound by the law of, a country in
+  your threat model.
+
+## 5. Check the traffic terms — "unlimited" rarely means unlimited
+
+The word "unmetered" has a specific meaning that "unlimited" doesn't. Formally
+unmetered = you pay a flat rate regardless of transfer, but the *port speed*
+caps the ceiling. "Unlimited" on a plan with a metered 1 TB cap is just
+marketing.
+
+If you're paying for traffic (as opposed to a flat rate), model the real number
+before you sign up: a relay that both receives *and* forwards a file pays for it
+twice. A plan that looked cheap on "1 TB included" can be the expensive option
+once you double the actual transit.
+
+## The shape of the whole pass
+
+Run these in order — domain age, AUP, reputation, privacy docs, traffic terms —
+and score each provider on the same simple numbers. The goal isn't perfection;
+it's to make the *claims you're actually relying on* explicit and checkable, so
+you're not discovering the truth from a suspension email at 2 AM.
+
+It's the same instinct as writing a unit test: state the assumption, then try to
+break it. Most of the providers I eliminated weren't lying in a way a human
+could spot from the homepage — they were lying in a way a *ten-minute checklist*
+caught.
\ No newline at end of file
diff --git a/src/content/posts/zh/how-to-verify-a-hosting-provider-before-you-buy.md b/src/content/posts/zh/how-to-verify-a-hosting-provider-before-you-buy.md
new file mode 100644
index 0000000..12f6498
--- /dev/null
+++ b/src/content/posts/zh/how-to-verify-a-hosting-provider-before-you-buy.md
@@ -0,0 +1,100 @@
+---
+title: "购买主机前，如何核实一家服务商的真实情况"
+description: "一份可复用的核查清单，帮你把真实的主机声明和营销话术分开：对比域名年龄与「运营多年」的说法、在 AUP 里找出隐藏的禁止条款、并用第三方渠道交叉验证口碑。"
+pubDate: 2026-09-09
+category: tutorials
+tags: [hosting, vps, due-diligence, whois, devops]
+---
+
+每家主机服务商的首页都是一串承诺：_「自 2005 年起运营」_、_「保证在线率」_、
+_「注重隐私」_、_「不限流量」_。其中有些是真的，但出人意料地大量是假的——
+而且在你刷信用卡、把 DNS 指向他们服务器之前，没人会去核实。
+
+最近我要为一个有具体要求的项目（隐私司法辖区、付款方式、流量上限）筛选一批
+服务商。我承受不起只看营销话术，于是搭了一套快速核查流程。它确实揪出了问题——
+有的服务商声称「运营多年」，但域名比我的手机还新；有的服务商自己条款里就静悄悄地
+禁止了我想跑的东西；还有的上了第三方黑名单。
+
+下面这份清单，就是我按顺序跑的流程。全程不需要付费工具。
+
+## 1. 把域名年龄和「自 X 年起」的说法做对比
+
+一家说 _「自 2012 年起值得信赖」_ 的服务商，它的域名应该比我的上一单咖啡还老。
+要是域名才四个月，「自 2012 年起」要么是个换了马甲的壳，要么就是撒谎——无论哪种，
+它都告诉了你这家公司是怎么描述自己的。
+
+最快的办法是查 WHOIS/RDAP。RDAP 是 WHOIS 的现代替代品，返回 JSON，更好解析：
+
+```bash
+curl -s "https://rdap.org/domain/example.tld" | python -m json.tool
+```
+
+在 `events` 数组里找 `registration` 事件——那是**最初**的注册日期，不是最近一次续费。
+（续费日期和注册商变更会排在时间线的后面，你要找的是*第一次*注册那条。）
+
+误判规则要双向看：一个全新的域名*可能*是一家正当的新公司。但「自很久以前起」的
+说法配上一个年轻的域名，永远是个红旗——它意味着这个历史声明无法独立验证，于是
+那个页面上的其他话我也都会用同样的怀疑眼光看待。
+
+## 2. 读 AUP（可接受使用政策）——不是特性页
+
+这是信号最强、却最常被跳过的一步。特性页告诉你他们*允许你付钱买什么*，
+AUP 告诉你他们*会以什么理由封停你*。这是两份不同的清单。
+
+否决项通常藏在「禁止活动」那一节，而且措辞是关键：
+
+- **「TOR 节点」「Tor 中继」或「出口节点」**——如果你打算跑匿名工具，这就是硬性
+  否决，而且它可能藏在一份*看起来*只针对滥用行为的清单里。
+- **「反向代理」「匿名化服务」「隧道」**——它禁掉的东西远超你的想象。很多正当架构
+  （缓存代理、GitOps webhook 中继）在字面上都会踩中这种措辞。
+- **司法辖区与身份条款**——「必须提供真实身份」「配合当地执法」、或者 AUP 绑定某个
+  具体国家的法律。如果你选这家服务商就是为了司法辖区的距离，这条就直接抵消了。
+
+一个实用技巧：把 AUP 链接打开，直接搜你关心的关键词。我曾经花十分钟通读了整份 AUP，
+后来才意识到一次 `Ctrl-F` 搜「tor」五秒钟就能得到答案。
+
+## 3. 交叉核对口碑——用第三方渠道，不是他们的官网
+
+服务商自己网站上的客户评价只是装饰。你要找的是服务商**删不掉差评**的地方：
+
+- **Trustpilot**——但要看*趋势*，不是平均值。3.5 分带一条长尾很正常；但如果是
+  3.5 分、而最近半年全是一星「他们封停了我的服务器」评论，那就是真信号。
+- **Reddit，尤其 r/hosting、r/webhosting、r/sysadmin**——搜品牌名。社区对
+  卷款跑路和大规模封停事件有长记忆，而且通常直白得很，会直接说哪家是「知名骗子」。
+- **WHTop / HostAdvice**——评分本身很嘈杂，但「1.8/10 且反复出现同一种投诉」和
+  「1.8 分但只是零散的零星差评」是两码事。
+
+我找到的最有用的单一信号是：**封停报告。** 一家服务商遇到滥用投诉时的第一反应是
+「先封停」、第二反应是「收『恢复费』」，这会在某条评论里白纸黑字写出来。那是
+商业模式的红旗，不是一次客服事故。
+
+## 4. 如果你在意隐私，就去核实「隐私」这个说法
+
+在你核实到具体文档之前，「注重隐私」和「离岸」都只是营销词：
+
+- **隐私政策里的留存条款。** 一家说「我们会依据法律／税务／会计需要，尽可能长期保留
+  记录」的服务商，等于在告诉你他们保留日志。句号。
+- **付款通道。** 到底是谁在真正处理加密货币，而且那是不是一家本身就要求 KYC 的
+  第三方网关？一个没有外部身份验证步骤的自建网关，其隐私姿态和「通过 KYC 转售商
+  买比特币」完全不同。
+- **注册实体。** 如果公司注册在、并且受你威胁模型内某个国家的法律约束，那么
+  「离岸托管，自 2000 年起」几乎一文不值。
+
+## 5. 核对流量条款——「不限」很少真的不限
+
+「防计量（unmetered）」这个词有特定含义，和「不限（unlimited）」不一样。严格意义的
+unmetered = 无论传输多少都按固定价收费，但*端口速率*封死了上限。一个带 1 TB 计量
+上限的计划上写「无限」，只是营销罢了。
+
+如果你要按流量付费（而不是固定价），签约前先算真实数字：一个既要*接收*又要*转发*
+文件的节点，要为这份流量付两次钱。一个看着「含 1 TB」很便宜的计划，一旦你把实际
+传输量翻倍，反而成了最贵的选择。
+
+## 整段流程的样子
+
+按这个顺序跑——域名年龄、AUP、口碑、隐私文档、流量条款——然后对每家服务商用同样
+的几个简单数字打分。目标不是完美，而是把你*真正依赖的*那几条声明显式地列出来、
+变成可核查的，这样你就不会在凌晨两点被一封封停邮件告知真相。
+
+这和写单元测试是同一个直觉：先把假设写下来，然后试着推翻它。我淘汰的大多数服务商，
+都不是人能凭肉眼从首页看出来的那种撒谎——而是那种**十分钟清单**就能抓出来的撒谎。
\ No newline at end of file