GCP falsely tagging and suspending Compute Engine for Cryptomining, when no Cryptomining is happening.

[Adarsh S]

I run an airflow instance which python process scheduler, which is used to trigger different python ML process which has no relation to crypto mining. This is the process which is running this dockerized process https://github.com/puckel/docker-airflow

Multiple times this instance had been flagged and I tried reaching out to support and they reactivated it once. Then, right now, the whole project has been suspended for the same. I feel GCP falsely tagging this is very harmful to small projects like ours since it stops all the development workflow. We'd have to move to AWS or Azure if this is not rectified ASAP.

This is the Email I got:

Dear Developer,

We've detected that your Google Cloud Project xxxxx (id: xxxxx) is engaging in cryptocurrency mining, resulting in the suspension of all project resources displaying this behavior.

I called the support and it's futile. Even though we're running the free tier, we just got clients and were moving to activate the paid plans, but this is hindering all progress. Any help would be appreciated.

[Anthony Leo]

Hello Adarsh,

I am sorry to hear that your development workflow has been delayed due to Cryptomining falsely being flagged on your project.

In our documentation on Policy violations FAQ [1], there is a section on projects under Suspension status.

In this section, it explains that in the example scenario of Cryptomining, it is very often tied to fraud, where malicious users use compromised account credentials to mine for cryptocurrency. 

Because of the high likelihood that such fraudulent activity would impact other users, we require additional verification [2] for these reasons. 

Typically, you will see a suspension in the Cloud Console and be required to submit an appeal. If you are an established customer or have a verified account, you will be notified to ensure the activity is intended, but will not be suspended. Use of blockchain is specifically excluded from this policy.

Furthermore, since you are not using your GCP project for Cryptomining, the next step would be to start an appeal process for your project, you can follow this documentation [3] on how to do so.

I hope this helps!

[1]Policy violations FAQ > Suspension > Why is my project suspended?:

https://support.google.com/cloud/answer/7002354#suspension 

[2]Additional verification:

https://cloud.google.com/billing/docs/how-to/invoiced-billing 

[3]Policy violations FAQ > My project has received a warning. What should I do now?:

https://support.google.com/cloud/answer/7002354?hl=en#warning-to-do

[Paul Lombard]

Hi, 

Did you ever find a reason why they flagged you? I got the same issue. 

[Frederic Gervais]

Hello Paul,

Please refer to  Anthony’s comment [1] regarding the next steps you can take to solve your current issue.

Regards,

Frederic

Google Cloud Platform Support, Montreal

[1] https://groups.google.com/d/msg/gce-discussion/fOlpqEZQG1U/lFBGIJHNAQAJ

[Bart Joy]

Wow!

We're comparing GCP and Azure for hosting our SaaS product, and this kind of problem seems to be scarily prevalent in GCP. It appears that some automated algorithm detects a potential problem, and then either immediately, or with some level of warning (which may not even be received), the service is shut down. People want to run their business on GCP, and would expect not to be shut down for days without a clear recourse. For us, an outage of an hour is a huge deal.

OP, thanks for sharing your experiences here. Maybe GCP isn't suitable for us.