How should cryptomining and automated abuse be reported?¶

Cryptomining and automated abuse should be reported by separating workload, resource consumption, control, benefit and personal attribution.

Evidential caution: that high cost, repeated activity or a wallet address identifies the offender.

What this means¶

A defensible report should identify:

the process, script or workload;

the device, account or cloud resource;

how it was introduced;

when it ran;

what resources it consumed;

which pool, wallet, service or beneficiary was linked;

whether activity was automated;

who controlled the account or configuration;

what attribution remains uncertain.

“A mining process ran on the server” is different from “the server owner operated the mining.”

“The wallet received mining credit” is different from “the wallet controller deployed the malware.”

“Thousands of requests were generated” is different from “a person made thousands of decisions.”

Explain compromised accounts, proxies, botnets, shared wallets and automation.

Where cost or resource impact is estimated, distinguish provider billing, measured utilisation and projected loss. A large bill may include legitimate services, while severe technical abuse may be stopped before substantial cost develops.

The report should also separate preparation from execution. A script, mining image or target list may show capability and intent, while scheduler, process, provider or network records show whether the automated workload actually ran.

State which findings are confirmed by direct workload evidence and which are inferred from utilisation, billing or repeated behaviour. The operational takeaway is:

Report the unauthorised workload, resource impact, automation, beneficiary and control as separate findings, and keep technical identifiers distinct from personal attribution.

================================================================================

What to check or do next¶

• Use precise language.

Evidential limits¶

It does not.