Block Monero miner

[gregoryhammond]

As of right now https://jobs.shoppersdrugmart.ca/ is hosting a Monero miner, it loads this javascript in the background.

Found this on the /r/Canada subreddit.

[Leondthurrell]

I've dug through the site and the file in question and I am not seeing anything that would make this a miner.

• It doesn't connect to coinhive like the thread says
• it doesn't create any miner threads
• not noticing any symptoms of a coin miner either (higher than normal CPU usage)

I'm not sure if maybe this file had been compromised and then fixed but right now I am confident that this site currently isn't using a miner at this time.

[keraf]

I had a look at the website when it was initially posted here but I haven't had a time to reply. There was indeed a miner but it looks like it has been removed. Interestingly, the script was the same as CoinHive but with different server addresses in there. Is CoinHive code available somewhere? Or is it based on something?

[gregoryhammond]

@keraf you can probably get the codehive code by signing up for codehive (https://coinhive.com/account/signup), the miner url is https://coinhive.com/lib/coinhive.min.js but there is a proxy available at https://github.com/cazala/coin-hive-proxy

[lucasgcb]

Another Website that uses this is kiwifarms, if you need another example.
https://kiwifarms.net/threads/the-mining-pit.34649/

This seems to be the script they use:
https://kiwifarms.net/js/Jawsh/xmr/xmr.min.js

[keraf]

I blocked the kiwifarms miner. I will close this issue as there is other ones about finding a more effective way to block new miners.