Google Cloud project suspended, because of cryptocurrency mining

[Amir Hadi]

Hi,

our Google Cloud production project was suspended, because Google believes that we are mining on their hardware, which is not true. What is true, is that we have a stratum proxy service running on Google Cloud for our users. Our users mine using their own hardware, we are just a service redirecting traffic to a mining pool. Is this the reason why we were blocked?

We can't even reach our database anymore and I am really angry about this! How is this thing designed? How can Google think that its ok to pull out the plug of a database server and don't even let me get my data before that!

Now over 10000 users are waiting because the project was suspended and everything is down. We didn't even receive a notice about the downtime upfront, just that they killed it.

Anyone has similar experiences?

Best,

Amir

[Michael Basilyan]

Hi Amir,

Sorry to hear about that. Can you email me (offline) your project id/number? 

Thanks,

Mike

--
© 2018 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043
 
Email preferences: You received this email because you signed up for the Google Compute Engine Discussion Google Group (gce-dis...@googlegroups.com) to participate in discussions with other members of the Google Compute Engine community and the Google Compute Engine Team.
---
You received this message because you are subscribed to the Google Groups "gce-discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to gce-discussio...@googlegroups.com.
To post to this group, send email to gce-dis...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/gce-discussion/0fdd7724-afc0-4b15-a4bf-c8b176ca8aba%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[George (Cloud Platform Support)]

Hello Amir, 

You seem to imply that you haven't engaged in cryptocurrency mining. How is this suspicion attached to your cloud activities? If this is an error, you should rest assured: it will get corrected in due course. 

If you would like us to examine the related status of the project, you may choose to send a private message with your project name and whatever details you may find relevant. The link to the private message window is to be found under the drop-down menu of the reply button at the top right of the edit window.

It is indeed not allowed to perform cryptocurrency mining, as stated on this line: "2.2 Customer may not use the Services to engage in mining cryptocurrency;", to be found on the "Supplemental Terms and Conditions For Google Cloud Platform Free Trial" page. 

[Nauman Khan]

Hi Sir, I am also receiving this message (project suspension because of cryptocurrency mining) again and again. My company is running in one of the cloud and want to put the code in google instance and run my website from here. But whenever i put the code, after 2 days i receive email from google that your project will be suspended. I don't know whats the issue. My website is drupal. 

[Jason]

Hi,

If your project has been suspended and you do not believe that it deserves to be. I would suggest contacting Google Cloud Billing as they would be the best team to reach out to in regards to help with this issue. I have attached a link on how you can contact billing support to the bottom of this message [1].

[1] https://support.google.com/cloud/contact/cloud_platform_billing

[Theodore Y. Ts'o]

On Fri, Nov 15, 2019 at 03:58:55AM -0800, Nauman Khan wrote:
> Hi Sir, I am also receiving this message (project suspension because of
> cryptocurrency mining) again and again. My company is running in one of the
> cloud and want to put the code in google instance and run my website from
> here. But whenever i put the code, after 2 days i receive email from google
> that your project will be suspended. I don't know whats the issue. My
> website is drupal.

Hi Nauman,

A very common problem that has happened to many people is that their
is some kind of security vulnerability in their VM setup, which gets
exploited by criminals to take over the VM to do cryptomining. This
is very CPU intensive, and it will slow your site to a crawl.

Even worse is when the criminals are able to steal your credentials
and they start up other VM's --- really big, expensive VM's with a lot
of CPU power (the better to do cryptomining), and this all gets
charged to *your* credit card. If this has happened, having your
project be suspended can actually be doing you (and your credit card)
a huge favor.

For example, this could happen if you have checked in API keys into
github (never, *ever* do that), or if you got phished and the
criminals were able to get their hands on your username and password.

So while contacting Google's Cloud Billing department is definitely
the right thing to do, in the mean time, you might want to review your
password security, since if in fact the criminals were able to gain
access to your Google login credentials, they could take over your
GMail account, or any other Google resources tied to your account.

If all you are running is drupal, that's a workload that seems
unlikely that to be mistaken for crypto mining. (Unless, of course,
there is some bug that that is causing that is spinning in a tight
loop, burning huge amounts of CPU doing nothing. But that seems
unlikely for Drupal.) This is why a very likely possibility is that
you have some kind of security breach in your account --- either with
the VM, an API key, or your login credentials.

Good luck,

- Ted

[nurul akter]

Facing the same problem. They don't even show proper reasoning. Which is really bad practice. There should be the proper reason and activity lists for suspension. This kind of false warning can cost one's reputation.