Menu
EN

Top Cryptojackers are video streaming websites, and they do not use CoinHive

Back in December 2017, we added a mechanism that allowed users to optionally report websites whenever a cryptojacking script is detected by AdGuard. It proved useful right away and allowed us to discover the largest known cryptojacking campaign, which was being run by some popular video streaming websites. Since then we have received more than a million user reports, and now it's time to analyze them.

Over the last two months, we received over 1.3 Million reports on more than 120 thousand websites. It's important to notice that sometimes cryptojacking was detected on some legitimate websites (Google, Youtube, Instagram, etc) and this is most likely caused by malicious browser extensions or malvertising.

However, 40% (over half a million) of the reports came from just 50 domains. Let's take a deeper look into what the top cryptojackers do.

Cryptojacking is defined as the secret use of your computing device in the background to mine cryptocurrency. All that is needed is to open the page that contains the script of the miner, and you will begin (without knowing) to "mine" the cryptocurrency for the script owner. The CPU consumption, in this case, can reach very high values, almost completely occupying the resources of the computer.

Top Cryptojackers do not use CoinHive

The first and the most popular in-browser cryptocurrency miner - CoinHive - has become synonymous with cryptojacking. Interestingly enough, though, it appears that most of the top cryptojackers do not use it. One might be led to think that the reason for this is that CoinHive domains are blocked by ad blockers and antivirus software, but that's only part of the truth. A more significant reason is the fact that CoinHive takes a 30% commission, which is a substantial part of the mining earnings. The alternatives are to use one of the CoinHive clones which take a smaller commission or to set up a self-hosted mining proxy. The latter may sound complicated, but in reality, it is rather easy to do, and reasonable, given how much they earn.

Top Cryptojackers by mining scripts

Video Hosting Cryptojacking Services

Half of the top cryptojacking domains belong to popular video hosting services. Some of them were discussed in our previous research. Let's remember these and also hail the new ones. Openload.co, Rapidshare.com and Streamango.com have been testing mining since the middle of December, but it seems now that they are not doing it anymore. On the other side, an insanely popular (#113 in the world according to SimilarWeb) OnlineVideoConverter.com is still doing it. Two more websites worth mentioning are streamplay.top and thevideo.me (and their mirrors). These two are responsible for almost 9% of all the registered reports.

Top Cryptojackers by category

Cryptojacking Malware

Five of the top 50 cryptojacking domains are likely to be a part of some malicious operations. Hidden iframes that load pages from these domains are injected into legitimate websites like Google, Instagram, Facebook, etc. Unfortunately, we don't have enough data to find every piece of malware injecting them.

However, we were able to identify 11 malicious Chrome extensions with a total weekly user count of almost 37,000:

Personal Finder

The first one is the so-called "Personal Finder" with almost 10k weekly users.

Personal Finder Cryptojacker

It uses a standard technique - an iframe is created on the extension's background page. After a short period of time, a mining script is loaded to that page and at this point, cryptojacking begins.

Personal Finder Malicious Iframe

Hastalavista family

The family name is due to the "hastalavista.org" domain that is used by all these extensions. We found ten extensions of this "family" so far, and they use an interesting trick to avoid detection. These extensions' code does not contain anything suspicious. Once the user installs any of these extensions, it opens a "thank you" page; and the malicious script is then loaded into the extension using Chrome's messaging mechanism.

Hastalavista Malware

Conclusion

It has been almost five months since the problem of cryptojacking emerged, and all that time I had held a secret hope that it could bring something positive and maybe even provide an alternative to the advertising-based model. Unfortunately, I have to state that with time this technique floats ever farther over to the dark side; some even say that cryptojacking is now the most prevalent malware online. Although there is still a chance for it if publishers start using it legitimately.

How can you protect yourself? Use an ad blocker, an antivirus or one of the specialized extensions to combat in-browser mining. Also, there is some good news from Google Chrome developers. They have started work on a performance improvement that could potentially cripple cryptojacking scripts. The idea is to throttle Javascript service workers running in background tabs. As it happens, all the known cryptocurrency miners rely on these selfsame service workers. However, this cannot be considered to be a final solution. The top cryptojackers are video streaming websites that run cryptocurrency miners while the user is watching a video, and they will be working at full strength all during this time.

Liked this post?
18,299 18299 user reviews
Excellent!

AdGuard for Windows

AdGuard for Windows is more than an ad blocker. It is a multipurpose tool that blocks ads, controls access to dangerous sites, speeds up page loading, and protects children from inappropriate content.
By downloading the program you accept the terms of the License agreement
Read more
18,299 18299 user reviews
Excellent!

AdGuard for Mac

AdGuard for Mac is a unique ad blocker designed with macOS in mind. In addition to protecting you from annoying ads in browsers and apps, it shields you from tracking, phishing, and fraud.
By downloading the program you accept the terms of the License agreement
Read more
18,299 18299 user reviews
Excellent!

AdGuard for Android

AdGuard for Android is a perfect solution for Android devices. Unlike most other ad blockers, AdGuard doesn't require root access and provides a wide range of app management options.
By downloading the program you accept the terms of the License agreement
Read more
18,299 18299 user reviews
Excellent!

AdGuard for iOS

The best iOS ad blocker for iPhone and iPad. AdGuard eliminates all kinds of ads in Safari, protects your privacy, and speeds up page loading. AdGuard for iOS ad-blocking technology ensures the highest quality filtering and allows you to use multiple filters at the same time
By downloading the program you accept the terms of the License agreement
Read more
18,299 18299 user reviews
Excellent!

AdGuard VPN

74 locations worldwide

Access to any content

Strong encryption

No-logging policy

Fastest connection

24/7 support

Try for free
By downloading the program you accept the terms of the License agreement
Read more
18,299 18299 user reviews
Excellent!

AdGuard Content Blocker

AdGuard Content Blocker will eliminate all kinds of ads in mobile browsers that support content blocker technology — namely, Samsung Internet and Yandex.Browser. While being more limited than AdGuard for Android, it is free, easy to install and still provides high ad blocking quality.
By downloading the program you accept the terms of the License agreement
Read more
18,299 18299 user reviews
Excellent!

AdGuard Browser Extension

AdGuard is the fastest and most lightweight ad blocking extension that effectively blocks all types of ads on all web pages! Choose AdGuard for the browser you use and get ad-free, fast and safe browsing.
18,299 18299 user reviews
Excellent!

AdGuard Assistant

A companion browser extension for AdGuard desktop apps. It offers an in-browser access to such features as custom element blocking, allowlisting a website or sending a report.
18,299 18299 user reviews
Excellent!

AdGuard DNS

AdGuard DNS is a foolproof way to block Internet ads that does not require installing any applications. It is easy to use, absolutely free, easily set up on any device, and provides you with minimal necessary functions to block ads, counters, malicious websites, and adult content.
18,299 18299 user reviews
Excellent!

AdGuard Home

AdGuard Home is a network-wide software for blocking ads & tracking. After you set it up, it’ll cover ALL your home devices, and you don’t need any client-side software for that. With the rise of Internet-Of-Things and connected devices, it becomes more and more important to be able to control your whole network.
18,299 18299 user reviews
Excellent!

AdGuard Pro for iOS

AdGuard Pro has much to offer on top of the excellent iOS ad blocking in Safari already known to the users of the regular version. By providing access to custom DNS settings, the app allows you to block ads, protect your kids from adult content online, and safeguard your personal data from theft.
By downloading the program you accept the terms of the License agreement
Read more
18,299 18299 user reviews
Excellent!

AdGuard for Safari

Ad blocking extensions for Safari are having hard time since Apple started to force everyone to use the new SDK. AdGuard extension is supposed to bring back the high quality ad blocking back to Safari.
18,299 18299 user reviews
Excellent!

AdGuard Temp Mail

A free temporary email address generator that keeps you anonymous and protects your privacy. No spam in your main inbox!
18,299 18299 user reviews
Excellent!

AdGuard for Android TV

AdGuard for Android TV is the only app that blocks ads, guards your privacy, and acts as a firewall for your Smart TV. Get warnings about web threats, use secure DNS, and benefit from encrypted traffic. Relax and dive into your favorite shows with top-notch security and zero ads!
Downloading AdGuard To install AdGuard, click the file indicated by the arrow Select "Open" and click "OK", then wait for the file to be downloaded. In the opened window, drag the AdGuard icon to the "Applications" folder. Thank you for choosing AdGuard! Select "Open" and click "OK", then wait for the file to be downloaded. In the opened window, click "Install". Thank you for choosing AdGuard!
Install AdGuard on your mobile device