Help and FAQ for handling security violations

If you violate laws, regulations, or related policies when using Alibaba Cloud products or services, Alibaba Cloud will place restrictions on your devices, services, or account. Alibaba Cloud does not proactively remove non-compliant information or applications that you store or publish. You can follow the instructions in this topic to investigate and resolve the issue. After you remove the non-compliant content, you can submit a request to unblock your service.

Query violation management records

When Alibaba Cloud places a restriction on a product or service you use, you will receive a notification with information about the violation and the type of restriction:

• You can check the text messages sent to the mobile phone number associated with your account for restriction details. You can also check your mailbox or internal messages to find more information.

• You can also go to the Security Management console to query all management records:

  • For records of non-compliant content, such as pornography, gambling, or fraud, go to Non-compliant Content Management Events.

  • For records of network security issues, such as mining or external attacks, go to Network Security Management Events.

FAQ about querying security event management records

I received a restriction notification, but I am not sure what the violation is.

You can go to the Security Management console to find the reason for the restriction. Then, you can investigate the issue by referring to the rules in Types of security violation information and Types of security violation behavior. You should also check your website or operating system for hacker intrusions or viruses that may have caused the violation.

How can I query the details or a snapshot of the non-compliant information?

Alibaba Cloud does not directly disclose the details or snapshots of non-compliant information. If you disagree with the restriction, you can submit an appeal through the Alibaba Cloud Security Management Appeal Portal. Alibaba Cloud will provide feedback within 1 to 3 business days.

For restrictions on Object Storage Service (OSS), Alibaba Cloud determines whether you can download the file based on the violation's severity. You can go to the file list in the OSS console and try to download the file. If the download fails with an AccessForbidden error, you cannot retrieve the blocked file.

I received a violation alert, but I cannot find it in the Security Management console. Why?

This means the product or service in the alert is not yet under restriction, so no management record exists. You can follow the instructions in the text message, email, or internal message to resolve the issue promptly. For more information, see Guidelines for unblocking restricted services and Help with violation remediation.

I received a fraud-related alert. What part of my service is involved in fraud?

Your product or service might be spreading or storing information suspected of fraud. The tools or templates you use to build your application might also be widely used for illegal activities such as fraud. First, you can check for fraud-related information as defined in Types of security violation information (under the fraud section), Help with fraud remediation, and Quickly handle fraud-related restrictions. If you have completed the remediation or confirmed that your business is compliant, you can go to the Alibaba Cloud Fraud-related Alert Appeal page. You can submit the required explanation, and Alibaba Cloud will provide feedback within 1 to 3 business days.

Guidelines for unblocking restricted services

Quickly unblock services restricted for non-compliant content

• For general non-compliant content on computing products, such as ECS, Cloud Web Hosting, or Simple Application Server, and network products, such as SLB or Elastic IP Address, you can request to unblock the service from the Non-compliant Content Management Events page. Follow these steps:

  • Completely remove the non-compliant content.

  • In the console, select the management record you want to unblock.

  • Click Request Unblock. Alibaba Cloud will complete the review within 1 to 3 business days. You can click View Request Record to check the review status.

• For general violations on Object Storage Service (OSS) that result in frozen files, you can query the violation record on the Non-compliant Content Management Events page and delete the file. Deleting the file resolves the restriction. For more information, see Delete objects.

• For other restrictions that are listed on the Non-compliant Content Management Events page but are marked as 'Unblocking Prohibited', you cannot request to unblock them from the console. After you complete the remediation, you can submit your feedback through the Alibaba Cloud Security Management Appeal Portal. Alibaba Cloud will process your request within 1 to 3 business days.

Quickly handle restrictions for mining violations

If this is the first time your server has been shut down for a mining violation, you can go to the Network Security Management Events page to lift the shutdown lock yourself.

Quickly handle restrictions for fraud-related violations

• If you receive a fraud alert email from Alibaba Cloud but your host or domain name has not been shut down or blocked, you can go to the Alibaba Cloud Fraud-related Alert Appeal page. You can submit the required business description and qualification certificates. Alibaba Cloud will process your request within 1 to 3 business days. Your service will not be shut down during the review period.

• If you receive a fraud alert email from Alibaba Cloud and your host or domain name has been shut down or blocked, you must submit a ticket. In the ticket, you must provide a business description and the required business qualifications, such as ICP filing, business license, or value-added telecommunications business license, for the non-compliant address.

FAQ about unblocking restricted services

After I submit an unblocking request, what is the basis for Alibaba Cloud's decision to unblock the service?

When you submit an unblocking request, Alibaba Cloud will unblock the service if the review finds no non-compliant content.

For general violations on Object Storage Service (OSS) that result in frozen files, deleting the non-compliant file is considered an unblocking action.

For unblocking requests submitted through the Alibaba Cloud Security Management Appeal Portal, Alibaba Cloud makes a decision based on a comprehensive review. This review considers whether your device or service still contains non-compliant information or exhibits non-compliant behavior, along with the qualifications and business description you provide. For critical or especially critical violations, if you cannot prove your business is compliant, your service cannot be unblocked, as stated in the relevant agreements.

What are general, critical, and especially critical violations?

For more information, see Penalty levels for security violations.

Help with violation remediation

Remove non-compliant content

You can find the reason for the restriction and the specific URL or device with non-compliant content from the restriction notification or the Non-compliant Content Management Events page in the Security Management console. Then, you can refer to Types of security violation information to further investigate, locate, and remove the non-compliant content. If you find that your device was hacked or implanted with malicious code, see Best practices for defending against trojan attacks to learn how to use Security Center to detect and handle trojan files.

If your Object Storage Service (OSS) files are frozen or access is restricted due to non-compliant information, you can directly delete the non-compliant files.

Remove mining programs

1. Mining programs are often difficult to remove. We strongly recommend that you back up your important data and then re-initialize the disk. This ensures the complete removal of the mining program.

2. You can also investigate your service by following these steps:

• Check for abnormal CPU usage. Note: A mining trojan may not use 100% of your CPU. Instead, CPU usage might remain stable at a certain level, such as 20% or 50%, for a long time.

• Check for abnormal network connections, such as connections to uncommon ports or unknown or overseas IP addresses.

• Check for unknown or malicious commands in scheduled system tasks.

3. You can use a free trial of Security Center and Cloud Firewall to help you investigate mining activities. (Note: The scan results from the trial are for emergency investigation only and should not be your sole source of information.)

• Use Security Center to remove mining programs: Log on to the Security Center console (free trial) → Client Installation → Virus Scan → Alert Handling. For more information, see Best practices for handling mining programs.

• Use Cloud Firewall to prevent mining programs from being re-implanted: Log on to the Cloud Firewall console (free trial) → Attack Prevention → Mitigation Settings (Block Mode) → Turn on the switches for Threat Intelligence, Basic Protection, and Virtual Patches. For more information, see Best practices for defending against mining programs.

Help with fraud remediation

Fraud-related alerts and remediation methods

An alert or block was triggered because the content associated with your domain name or IP address poses a fraud threat. You must investigate and remediate the issue promptly. After you are finished, you can submit the required materials for an appeal through the Alibaba Cloud Fraud-related Alert Appeal Form. (Note: Refer to the following table for the materials required for your business type). If you cannot provide certain materials, explain why in the "Other Instructions" section of the appeal form for our review. We also recommend that you add your ICP filing information, logo, and company name to your website.

FAQ about violation remediation

I have tried various methods but still cannot completely remove the virus. What should I do?

We recommend that you back up your data and then re-initialize the disk to completely remove the virus.

I have removed the mining program, but I am not sure if any traces remain or if my server will be shut down again.

If mining activity is still detected on the server, Alibaba Cloud will send you a notification by text message, email, or internal message 2 days before the shutdown deadline. You should monitor your notifications. If you do not receive a mining administration notification within 2 days of the shutdown deadline, your ECS instance will not be shut down.

My service is about to be shut down due to mining, but I cannot complete the remediation in time for reasons beyond my control. What should I do?

You can request an extension by submitting a ticket to Alibaba Cloud customer service. If your request is approved, the shutdown deadline will be extended.