Warnings of a breach appear on Coinhive-linked domains

The creator of Have I Been Pwned, Troy Hunt, posted warnings on Coinhive-linked domains that they had been breached.

A big slice of my last week has gone on doing something useful with the Coinhive domains. Yep, theyre now mine and the defunct cryptomining service was still getting millions of requests from infected websites every single day. Heres what Ive done: https://t.co/VjoO7O8crb

— Troy Hunt (@troyhunt) March 31, 2021

Hunt said that the coinhive.com and cnhv.co domains came under his control in May 2020. Analyzing incoming traffic via Cloudflare, he found that the service still receives over 3 million requests daily from more than 100,000 unique visitors.

Data: TroyHunt.com.

Primary traffic comes from China, Russia, the United States, Georgia and Vietnam.

Data: TroyHunt.com.

«A large portion of the traffic may flow through compromised MikroTik routers that continue to run Coinhive scripts as users visit various websites,» the security researcher wrote.

Troy Hunt set up traffic redirection from the coinhive.com domain to his new post about the hidden miner on TroyHunt.com. On sites with Coinhive scripts injected, a dialog now appears saying: «This website attempted to run a cryptominer in your browser».

Data: TroyHunt.com.

The expert warned that attackers may use abandoned domains to inject scripts into users browsers.

As a reminder, the Coinhive script exploited users computing power through their browsers to mine Monero. The service shut down in March 2019.

Developers attributed their decision to a drop in network hash rate following the Monero hard fork and a more than 85% drop in the cryptocurrencys price over the year.

In 2018, Monero mining via Coinhive brought the scripts creators around $250,000 a month.

Since Coinhives closure, the popularity of crypto-jacking has waned. Yet by Q2 2020 the number of instances hidden browser-based cryptocurrency mining grew by 163% versus the previous quarter.

Follow ForkLog on Twitter.