VM Suspended for mining cryptocurrency

[Sumit Mehta]

Hi guys,

My VM was suddenly suspended by Google after they thought that I was using it for mining cryptocurrency. I got it reinstated and I have 48 hours to resolve the issue. I checked the logs but I couldn't find anything that could give me a hint that my VM was compromised. Of course, I don't use it for mining cryptocurrency and it's just a simple web server. Kindly help me troubleshoot the issue. Or please let me know if this can also be a mistake at Google's side!

Thanks in advance.

[Mahmoud Sharif (Google Cloud Platform)]

Hello,

I assume that you mean that your project was suspended. That said, in such cases [1] [2], and in order to regain access as to recover your data, you either have to appeal if there was a violation to the Acceptable Use Policy, or verify your billing account if the billing account itself is suspended (also causes project suspension and all its resources)

If you have to appeal in case of [1], you should have received an email from google-clou...@google.com with the resources needed.

If you were not using your VM for cryptocurrency, and if you think that your project was compromised, I suggest that you read through this article from our public documentation on how to keep your instances secured from being reached from the internet and how to restrict access to users and service accounts by using Cloud IAM.

I hope that I answered your question.

[Sumit Mehta]

Hi,

Thanks for your reply. Below is what I received from google-clou...@google.com:

Dear Developer,

We’ve recently detected activity on your Google Cloud Platform / APIs project that violates our Terms of Service or Acceptable Use Policy. Specifically, your project XXXX was suspended for violating our Free Terms of Service by mining cryptocurrency between 2018-06-28 16:48 and 2018-06-28 16:52 (Pacific Time).

Please take a moment to review the Google Cloud Platform Terms of Service, the Acceptable Use Policy and the applicable Terms of Service for the specific Google API you are using so that you do not violate our terms and policies in the future.

One reason could be that my configured credit card got expired and I forgot to replace it and my free trial is about to expire in 8 days. But I am not sure why it is reporting a different reason. My project is a simple web server, having a simple control panel installed serving an API in DOTNETCORE and a simple static website. The rest of the settings are all out of the box and nothing changed.

Since I am a developer and not a networking expert, I find it pretty helpless to troubleshoot the issue. Probably the only option left is to migrate my API to "Azure App Service".

Do you think a wrong credit card may be a reason here and I can re-appeal after correcting it??

Thanks  

[Mahmoud Sharif (Google Cloud Platform)]

Hello,

I cannot state exactly the reason why the project was suspended. Only the specific billing team will be able to investigate it as they are the only ones who have visibility over this. 

As a side note, the GCP / APIs project may also detect mining activity if you are running a proxy server which proxies traffic between miners and mining pools.

If this is not the case. You can file an appeal using the “REQUEST APPEAL” button that is shown in the Dashboard project on your console. When completing the form, be sure to carefully complete each section.  

Sincerely,