---
title: "Cryptomining · Ataris"
description: "Free credits and trial GPUs get turned into mining rigs within minutes of signup. Ataris detects mining from the host, with performance counters and network flows, and no agent inside the VM."
canonical: "https://ataris.dev/use-cases/cryptomining"
last-updated: 2026-11-02
---
# Catch cryptomining on your hosts.

Free credits and trial GPUs get turned into mining rigs within minutes of signup. Ataris detects mining from the host, with performance counters and network flows, and no agent inside the VM.

## A miner looks the same from the host, whatever the guest says.

Miners rename themselves, throttle, and hide from tools inside the guest. They can't hide the work: pinned vCPUs, a hashing profile in the counters, and a pool connection on the sandbox's interface.

### 1. Spot: The hashing loop in the counters.

CPU performance counters show the profile of a hashing loop, whatever the process is called inside the guest.

Example (vm-3f1c · perf): vCPUs = 4 of 4 pinned; profile = hash loop; since boot = 90 s.

### 2. Confirm: The pool connection on the wire.

A connection to a mining pool on the sandbox's tap or veth interface confirms it. Two signals together open the case.

Example (vm-3f1c · tap0): dest = 203.0.113.7:3333; protocol = stratum; duration = steady.

### 3. Prove: The miner by name.

For a flagged microVM, memory inspection lists the processes inside, so the case names the miner.

Example (vm-3f1c · snapshot): pid 412 = xmrig; parent = sh; account = free tier · day 1.

## Cryptomining detection, end to end.

From the first signal to a reviewed case.

- **Signals.** From the host. vCPU saturation, hashing counter profile, pool connections.
- **Evidence.** Attached to the case. flow timeline, memory snapshot, account context.
- **Where.** Covered runtimes. Firecracker, Cloud Hypervisor, Kata, gVisor, containers.

## Related

- [Abuse detection](https://ataris.dev/product/abuse-detection.md): Mining, scanning, spam, farmed free tiers
- [Guest memory inspection](https://ataris.dev/product/memory-inspection.md): Processes and binaries from a flagged VM
- [GPU clouds](https://ataris.dev/use-cases/gpu-clouds.md): Mining on credit-funded GPUs

## Find the miners on your fleet.

Book a demo and we'll walk through cryptomining detection on your runtime.

[Book a demo](https://ataris.dev/contact)