---
title: "Abuse detection · Ataris"
description: "Cryptomining detection, port scans, outbound spam, egress abuse, and free-tier farming, built from signals the host already has: each sandbox's network flows, CPU performance counters, block I/O, and KVM."
canonical: "https://ataris.dev/product/abuse-detection"
last-updated: 2026-11-02
---
# Catch abuse from the host, on any guest image.

Cryptomining detection, port scans, outbound spam, egress abuse, and free-tier farming, built from signals the host already has: each sandbox's network flows, CPU performance counters, block I/O, and KVM.

## Signals a sandbox can't hide from the host.

Whoever runs a sandbox controls everything inside it. They don't control what the host sees: the packets on its interface, the cycles its vCPUs burn, the blocks it writes. Ataris reads those, per sandbox, with eBPF on the host.

### 1. Observe: Read every sandbox from outside.

Flows on each sandbox's tap or veth interface, CPU performance counters per vCPU, block I/O, and KVM exits, attributed to the sandbox that caused them. Nothing runs in the guest, so there is nothing for the sandbox to disable.

Example (vm-3f1c · signals): tap0 flows = 38 new dests / min; vCPUs = 4 of 4 pinned; perf counters = hash-loop profile; block I/O = 6 MB burst, then idle; KVM exits = steady.

### 2. Detect: Rules for how abuse looks from the host.

Mining is pinned vCPUs with the counter profile of a hashing loop and a pool connection. A scan is a fan-out of short connections. Spam is a burst on port 25. Each rule combines signals, so one noisy metric doesn't open a case.

Example (vm-3f1c · rules): cryptomining = MATCH; port scanning = MATCH; outbound spam = no match; egress abuse = no match.

### 3. Link: Tie it to the account behind it.

Every detection lands on the sandbox and the account that owns it, next to its signup and billing data. Free-tier farming shows up as many accounts with the same runtime pattern.

Example (vm-3f1c · account): plan = free tier; card type = prepaid; accounts, same pattern = 4; automatic action = none · report only.

## What it detects.

Each detection is a rule over host signals, so it works the same on Firecracker, Cloud Hypervisor, Kata, gVisor, and containers.

- **Cryptomining.** The most common abuse of free and credit-funded compute. sustained vCPU saturation, hashing-loop counter profile, mining-pool connections, GPU and CPU sandboxes.
- **Network abuse.** Abuse that lands your IP ranges on blocklists. port and SYN scans, outbound spam bursts, egress abuse, per-sandbox flow history.
- **Free-tier farming.** Many accounts, one operator. repeat runtime patterns, linked to signup data, linked to billing data, ranked by account.

## Related

- [Cryptomining](https://ataris.dev/use-cases/cryptomining.md): Miners on free and paid accounts
- [Scanning and spam](https://ataris.dev/use-cases/network-abuse.md): Port scans, spam, egress abuse
- [Free-tier abuse](https://ataris.dev/use-cases/free-tier-abuse.md): Farmed credits and repeat signups

## See what your sandboxes are running.

Book a demo and we'll walk through the detections on a runtime like yours.

[Book a demo](https://ataris.dev/contact)