  Cryptocurrencies, arguably the most prominent application of blockchains,
have been on the rise with a wide mainstream acceptance. A central concept in
cryptocurrencies is "mining pools", groups of cooperating cryptocurrency miners
who agree to share block rewards in proportion to their contributed mining
power. Despite many promised benefits of cryptocurrencies, they are equally
utilized for malicious activities; e.g., ransomware payments, stealthy command,
control, etc. Thus, understanding the interplay between cryptocurrencies,
particularly the mining pools, and other essential infrastructure for profiling
and modeling is important.
  In this paper, we study the interplay between mining pools and public clouds
by analyzing their communication association through passive domain name system
(pDNS) traces. We observe that 24 cloud providers have some association with
mining pools as observed from the pDNS query traces, where popular public cloud
providers, namely Amazon and Google, have almost 48% of such an association.
Moreover, we found that the cloud provider presence and cloud
provider-to-mining pool association both exhibit a heavy-tailed distribution,
emphasizing an intrinsic preferential attachment model with both mining pools
and cloud providers. We measure the security risk and exposure of the cloud
providers, as that might aid in understanding the intent of the mining: among
the top two cloud providers, we found almost 35% and 30% of their associated
endpoints are positively detected to be associated with malicious activities,
per the virustotal.com scan. Finally, we found that the mining pools presented
in our dataset are predominantly used for mining Metaverse currencies,
highlighting a shift in cryptocurrency use, and demonstrating the prevalence of
mining using public clouds.
