Hey everyone,
I've seen a lot of posts on Reddit from people who get caught off guard when their VPS gets suspended for high resource usage or suspected crypto mining. Honestly, Netcup’s hardware performance is fantastic for the price—and that’s exactly why malicious actors target these instances.
Disclaimer: There really isn't a catch with Netcup and that's why I am posting this, I am not getting paid. I simply have been with a lot of providers during my web development journey, and NetCup have definitely set the bars for me, and that is the only reason for this post.
So, yes, Netcup is great, but you do need to know how to properly lock down your environment. Otherwise, an unmonitored server will eventually get compromised.
The hidden miner headache
Unauthorized mining is a huge issue. I had to learn this the hard way a while back—attackers don't just drop a miner and leave. They set up persistent, self-regenerating scripts, hidden cron jobs, and sleeping background processes. You clean up the binary, think you're clear, and then a week later it's right back. If you have been there, you know the frustration 😤
Usually, the attack vectors come from legacy workflows or unpatched control panel vulnerabilities. If you're running old PHP setups or unmaintained Webmin/cPanel, CloudPanel, IP Config or any similar alternatives, it’s only a matter of time.
Practical steps to secure your server
If you want to avoid waking up to an abuse notification, here are the main things you should lock down from day one:
- SSH Hardening: Ditch plain FTP immediately. Use SSH/SFTP only with key-based authentication (ed25519 keys). Disable password authentication completely (PasswordAuthentication no) and disable direct root login (PermitRootLogin no). Also, consider changing the default SSH port to cut down 99% of botnet brute-force noise in your logs.
- Firewall & Intrusion Prevention: Run ufw or iptables and default to dropping all incoming traffic except what's explicitly needed (e.g., 80, 443, custom SSH). Pair this with Fail2ban or CrowdSec to automatically block IP addresses spamming SSH or HTTP endpoints.
Netcup have Firewall directly in your server control panel, I don't know why anyone wouldn't use it. Please use it as an extra layer of defense.
netcup.jpg - Modern Stacks & Containerization: If possible, isolate applications using Docker or LXC. If a vulnerability in one service gets exploited, containerization keeps the attacker trapped in an unprivileged container rather than getting immediate root access on the host node. If you're moving toward newer tech (SvelteKit, Bun, Go, Python, etc.), keep dependencies lean and regularly audited. If you must run legacy WordPress/PHP apps, use automated patch tools and strict file permission masks (chmod/chown).
- Process & Resource Isolation: Use systemd cgroups or Docker resource limits (--cpus, --memory) to limit what a single process can consume.
- Zitat
Never give a single process or application unrestricted access to all your server's resources—even if it's the only app you're running.
- If a miner does manage to execute, strict cgroups prevent it from hogging 100% of the CPU and triggering Netcup's automated host-node load flags.
- Active Monitoring: Don't rely solely on Netcup's panel to tell you something is wrong. Set up basic monitoring (htop, glances, or lightweight tools like Netdata) alongside alerts for unexpected CPU spikes, unauthorized cron modifications (crontab -l, /etc/cron*), or unusual outbound network connections on non-standard ports.
When Netcup suspends an account for excessive CPU or unauthorized mining, it's rarely a mistake—the automated system caught a runaway process or a compromised box before it impacted neighboring tenants on the hypervisor.
Lock your stuff down properly before deploying live workloads, and you won't run into issues here. Hope this helps anyone setting up a fresh node!
