New rules for trial accounts
A few weeks ago somebody signed up, verified their email, took the welcome credit, and created a one-core virtual machine. Ninety minutes later that machine was pinned at 100% CPU and asking DNS for a monero pool. It kept mining until the morning, when a human noticed.
That is the polite version of the story. The impolite version is that the same person had five accounts.
We have written the rules down and taught the platform to enforce them, so today the same machine would go quiet in under a minute. Here is what changed, and what it means if you are one of the people who is not doing any of this.
What a trial account is for
When you sign up you get credit to try the platform. Build something, break it, see whether our disks are as fast as we claim, decide if you want to stay. That is the entire purpose, and it costs us real money per account, which we are happy to spend.
What it is not is a free pool of compute for work that would otherwise have a bill attached. Mining is the obvious case. Scraping somebody else's site at machine speed is the quiet one. Scanning the internet is the third, and it is worse than it sounds: when a machine on our network sweeps a few thousand hosts, the complaints arrive at our abuse desk, our address ranges collect reputation damage, and every other customer on those ranges pays for it in blocked mail and captchas they did not earn.
What we stop
On trial accounts, these behaviours stop the account the moment we see them. None of them has an innocent reading from a trial machine:
- Cryptocurrency mining, whether through a pool, a proxy, or a script somebody pasted into a container
- Brute-force attempts against remote services: SSH, RDP, databases, the usual list
- Outbound spam, including bulk delivery attempts on port 25
- Command-and-control chatter of the kind botnets use to take orders
- Traffic floods, and participation in amplification attacks that use your machine to hit someone else
These three we ask about instead, because the pattern is real but the intent is not ours to guess:
- Crawling and scraping other people's sites at machine speed
- Port scanning and mass host discovery against systems you do not own
- Running declared scanning tools against third parties
Nothing is switched off for those. We open a ticket on your account with the lines we recorded and ask what the traffic is. A sentence is usually enough: it is my own estate, it is a load test, it is a crawler against sites I run. Silence is what escalates.
The full wording lives in section 4.1 of the terms of service, which we updated today.
The one that surprises people: crawlers
Mining is easy to agree on. Crawling is where we get argued with, so here is our reasoning.
Scraping farms are the second most common thing a trial account gets used for, and they are cheap to run and expensive to host. A single small machine can hold a few hundred outbound requests per second against somebody else's website for days. The site owner sees a flood from our address range and blocks the range, not the customer. We then explain to unrelated customers why their mail bounces and their API calls get captchas.
So the line is about whose infrastructure you are pointing at. Fetching from your own systems is fine at any rate you like, and running a crawler for a real product is a normal workload here. It just does not belong on free credit. Move it to a paid account, or tell support and we will lift the restriction.
How the platform sees it
Traffic leaving our network passes sensors that match known attack patterns. This is behaviour matching, not reading your data: a connection to a known mining pool looks like a connection to a known mining pool regardless of what is inside it, and a machine that opens sixty connections to sixty different hosts in thirty seconds is doing something specific.
Thresholds sit high enough that ordinary work never reaches them. Pulling packages, syncing a repository, serving a website, running a crawler against your own systems: none of that is close. A single alert already means a burst that no normal client produces, and for most categories we still wait for several before acting.
We only record the matches. Time, which of your machines it came from, where it went, which rule fired, and the connection metadata that is already in the clear: the hostname requested, the client identifier the software sends, the server name announced by a TLS handshake, the domain looked up. Not bodies, not payloads, not credentials, and nothing is decrypted. We keep that much because a rule number alone cannot be argued with, and when we act on a match you get the same lines we did. Traffic that matches nothing produces no record at all, and the matches are deleted after fourteen days. The privacy policy now says this in as many words.
What happens when it fires
When it is one of the conclusive ones, every virtual machine in the account is powered off, and the account cannot create resources or start machines again until the matter is settled. Your data stays where it is. You can still sign in, look at everything you own, and open a support ticket.
The ticket is the appeal, and it is a real one. Automation is fast and occasionally wrong; a human reading your explanation is the correction for that. If we stopped you by mistake, we lift it and say sorry.
The harder outcome is termination, which we keep for repeat offenders and for accounts created specifically to farm welcome credit. That one deletes everything in the account and cannot be undone.
Paying accounts are not enforced automatically. The same rules apply, but a person looks at the case before anything is switched off.
If you actually need to do one of these things
Some of it is legitimate work. Security research needs scanners. A mail product needs port 25. Mining on hardware you are paying full price for is your business, not ours.
All of that is fine, and the way to do it is to tell us first. Write to support, explain the shape of the workload, and we will lift the relevant restriction on your account. Nobody has to guess, and you will not find out where the line is by crossing it.
For everyone else, which is almost everyone reading this: nothing changes. You will never see any of this machinery. That is rather the point.