Who is Stealing My Power: Web Mining Domains Measurement via DNSMon
<!--kg-card-begin: markdown--><p>At <a href="https://twitter.com/360Netlab">360Netlab</a>, we are continuously analyzing DNS traffic. Based on this, we have established a DNSMon detection system that analyzes various anomalies and correlations in DNS traffic.</p>
<p>We reported a few web mining sites such as openload.co in previous <a href="__GHOST_URL__/openload-co-and-other-popular-alex-sites-are-abusing-client-browsers-to-mining-cryptocurrency/">article</a>. After that, we try to <strong>use DNSMon to further analyze web mining on the entire Internet level</strong>. This article describes what we have seen so far.</p>
<p>At present:</p>
<ul>
<li><strong>0.2% websites have web mining code embedded in their homepage</strong>: 241 (0.24%) out of Alexa Top 100,000 websites, and 629 (0.21%) out of Alexa Top 300,000 websites</li>
<li><strong>Pornographic related websites constitute the main body</strong>, accounting for 49% . Others include fraud (8%), advertising (7%), mining (7%), film and television (6%) and other categories</li>
<li><strong>10+ sites offer technical capacity for mining</strong>. The largest of them is coinhive.com, accounting for about 57% of the share, followed by coin-hive.com (8%), load.jsecoin.com (7%), webmine.pro (4%), authedmine.com (4%) and others</li>
</ul>
<p>Web mining has currently become a market, including the following roles:</p>
<ul>
<li><strong>End users</strong>: currently their interests are neglected</li>
<li><strong>Mining sites</strong>: new players, providing the scripts and capability for web mining</li>
<li><strong>Content / traffic website</strong>: these are existing websites with large user base, but lack the means for monetization. Now they are directing their previously unprofitable traffic to the mining sites, and are making money by web mining using the visitors' computers. Recently some content sites have built their own mining capacity, so that they no longer need to share their profit with the mining sites.</li>
</ul>
<h4 id="600contenttrafficwebsites">600+ Content / Traffic Websites</h4>
<p>In Alexa Top 300,000 sites, by checking their homepage, we found 628 websites have embedded mining code. We map the keywords of these domain names below, so the readers can have a visual impression. Due to the particularity of pornography, we will not publish these domain names.</p>
<p><img src="__GHOST_URL__/content/images/2018/02/keywords.png" alt="" loading="lazy"></p>
<p>The contents of these websites fall into the following categories</p>
<p><img src="__GHOST_URL__/content/images/2018/02/content-sites-by-category.png" alt="" loading="lazy"></p>
<h4 id="10miningsites">10+ Mining Sites</h4>
<h6 id="marketsharerankingofminingsites">Market Share Ranking of Mining Sites</h6>
<p>Content sites will try to monetize their user traffic through mining sites.</p>
<p>According to the usages by content sites, we see the Top 10 mining sites on 2018-02-06 as follow:</p>
<p><img src="__GHOST_URL__/content/images/2018/02/mining-domain-usage.png" alt="" loading="lazy"></p>
<p>One thing to note is that while there are only 628 content sites in total, mining sites are used 728 times. This is because some content sites use two or more mining sites at the same time, which is common in this market.</p>
<h6 id="familiesofminingsites">Families of Mining Sites</h6>
<p>All of these mining sites can be attributed to several different families. Some known families include:</p>
<ul>
<li><strong>coinhive</strong>: coinhive.com, coin-hive.com, and a series of related</li>
<li><strong>jsecoin</strong>: load.jsecoin.com</li>
<li><strong>webmine</strong>: webmine.cz</li>
<li><strong>cryptoloot</strong>: crypto-loot.com, cryptoloot.pro, webmine.pro and a series of related</li>
<li><strong>coinhave</strong>: coin-have.com, ws.cab217f6.space series, api.cab217f6.space series</li>
</ul>
<h6 id="traffictrendofminingsites">Traffic Trend of Mining Sites</h6>
<p>DNS traffic of mining sites are shown in the following figure</p>
<p><img src="__GHOST_URL__/content/images/2018/02/web-miner-site-dns-traffic-1.png" alt="" loading="lazy"></p>
<p>We can see that:</p>
<ul>
<li><strong>The market started around 2017-09</strong>, coin-hive.com and coinhive.com are accessed massively since 2017-09-15 and 2017-09-28</li>
<li><strong>The market keeps growing</strong>, two boosts happened around 2017-10 and 2018-01.</li>
<li><strong>The biggest player is coinhive family</strong>, which is consistent with the above ranking statistics. As a representative, the popularity ranking of coinhive.com has arised to Top 20k.</li>
<li><strong>More and more mining site providers are entering the market</strong></li>
</ul>
<p>On the other side, we recently observed that the traffic of coinhave family's main site is shrinking as it starts to divert traffic into varieties of subsites for redundancy.</p>
<h6 id="newplayersandnewgames">New Players and New Games</h6>
<p>We also notice some new players show up in the market recently:</p>
<ul>
<li><strong>Advertiser</strong>: mining behavior in some content sites are actually introduced by advertisers</li>
<li><strong>Shell link</strong>: some content sites use shell links to evade detection by source code auditing</li>
<li><strong>URL shortener</strong>: goobo.com.br is a URL shortener in Brazil. Its homepage as well as the shortened URLs it generate will load coinhive mining script when being visited.</li>
<li><strong>Supply chain pollution</strong>: www.midijs.net is a JS based MIDI file player, whose <a href="http://www.midijs.net/lib/midi.js">source code</a> is embedded with coinhive script</li>
<li><strong>Self-built mine pool</strong>: there is an <a href="https://github.com/deepwn/deepMiner">opensource project</a> on github which can be used to set up private mine pool.</li>
<li><strong>End user aware web mining</strong>: authedmine.com is a new mining site, which declares only mining under user's permission</li>
</ul>
<h4 id="themechanismandadvantageofdetectingwebminingthroughdnsmon">The Mechanism and Advantage of Detecting Web Mining Through DNSMon</h4>
<p>We have been using DNSMon to monitor websites that launch web mining. The monitoring works effectively because:</p>
<ul>
<li>when user opens a content website that loads mining site (like coinhive.com) subsequently, such relation between the content site domain and mining site domain are recorded by our DNSMon system.</li>
<li>in this case, we can identify related content websites by investigating coinhive.com's correlation</li>
<li>content sites may switch mining sites occasionally, and we recorded all these changes. In this way, we can draw the whole picture of the market.</li>
</ul>
<p>Using DNSMon to detect mining websites has its own advantage and disadvantage:</p>
<ul>
<li>Advantage</li>
<li>wide coverage</li>
<li>near real-time</li>
<li>high precision</li>
<li>can use mining domain seeds to discover more new suspicious sites through domain correlation</li>
<li>support the detection in the case of link hijacking, which is better than traditional web scanners</li>
<li>Disadvantage</li>
<li>only reveals the relations between domains, and requires other methods to confirm web page mining behavior</li>
</ul>
<p>In summary, we can use DNSMon system to:</p>
<ul>
<li>discover suspicious sites in bulk</li>
<li>identify mining website quickly</li>
<li>locate mining sites that use techniques like code morphing or shell link</li>
</ul>
<h4 id="declaration">Declaration</h4>
<p>The tag graph in this blog is created via <a href="http://cloud.niucodata.com/">http://cloud.niucodata.com/</a></p>
<!--kg-card-end: markdown-->
At 360Netlab, we are continuously analyzing DNS traffic. Based on this, we have established a DNSMon detection system that analyzes various anomalies and correlations in DNS traffic.


We reported a few web mining sites such as openload.co in previous article. After that, we try to use DNSMon to further analyze web mining on the entire Internet level. This article describes what we have seen so far.


At present:


 * 0.2% websites have web mining code embedded in their homepage: 241 (0.24%) out of Alexa Top 100,000 websites, and 629 (0.21%) out of Alexa Top 300,000 websites
 * Pornographic related websites constitute the main body, accounting for 49% . Others include fraud (8%), advertising (7%), mining (7%), film and television (6%) and other categories
 * 10+ sites offer technical capacity for mining. The largest of them is coinhive.com, accounting for about 57% of the share, followed by coin-hive.com (8%), load.jsecoin.com (7%), webmine.pro (4%), authedmine.com (4%) and others


Web mining has currently become a market, including the following roles:


 * End users: currently their interests are neglected
 * Mining sites: new players, providing the scripts and capability for web mining
 * Content / traffic website: these are existing websites with large user base, but lack the means for monetization. Now they are directing their previously unprofitable traffic to the mining sites, and are making money by web mining using the visitors' computers. Recently some content sites have built their own mining capacity, so that they no longer need to share their profit with the mining sites.


600+ Content / Traffic Websites


In Alexa Top 300,000 sites, by checking their homepage, we found 628 websites have embedded mining code. We map the keywords of these domain names below, so the readers can have a visual impression. Due to the particularity of pornography, we will not publish these domain names.





The contents of these websites fall into the following categories





10+ Mining Sites


Market Share Ranking of Mining Sites


Content sites will try to monetize their user traffic through mining sites.


According to the usages by content sites, we see the Top 10 mining sites on 2018-02-06 as follow:





One thing to note is that while there are only 628 content sites in total, mining sites are used 728 times. This is because some content sites use two or more mining sites at the same time, which is common in this market.


Families of Mining Sites


All of these mining sites can be attributed to several different families. Some known families include:


 * coinhive: coinhive.com, coin-hive.com, and a series of related
 * jsecoin: load.jsecoin.com
 * webmine: webmine.cz
 * cryptoloot: crypto-loot.com, cryptoloot.pro, webmine.pro and a series of related
 * coinhave: coin-have.com, ws.cab217f6.space series, api.cab217f6.space series


Traffic Trend of Mining Sites


DNS traffic of mining sites are shown in the following figure





We can see that:


 * The market started around 2017-09, coin-hive.com and coinhive.com are accessed massively since 2017-09-15 and 2017-09-28
 * The market keeps growing, two boosts happened around 2017-10 and 2018-01.
 * The biggest player is coinhive family, which is consistent with the above ranking statistics. As a representative, the popularity ranking of coinhive.com has arised to Top 20k.
 * More and more mining site providers are entering the market


On the other side, we recently observed that the traffic of coinhave family's main site is shrinking as it starts to divert traffic into varieties of subsites for redundancy.


New Players and New Games


We also notice some new players show up in the market recently:


 * Advertiser: mining behavior in some content sites are actually introduced by advertisers
 * Shell link: some content sites use shell links to evade detection by source code auditing
 * URL shortener: goobo.com.br is a URL shortener in Brazil. Its homepage as well as the shortened URLs it generate will load coinhive mining script when being visited.
 * Supply chain pollution: www.midijs.net is a JS based MIDI file player, whose source code is embedded with coinhive script
 * Self-built mine pool: there is an opensource project on github which can be used to set up private mine pool.
 * End user aware web mining: authedmine.com is a new mining site, which declares only mining under user's permission


The Mechanism and Advantage of Detecting Web Mining Through DNSMon


We have been using DNSMon to monitor websites that launch web mining. The monitoring works effectively because:


 * when user opens a content website that loads mining site (like coinhive.com) subsequently, such relation between the content site domain and mining site domain are recorded by our DNSMon system.
 * in this case, we can identify related content websites by investigating coinhive.com's correlation
 * content sites may switch mining sites occasionally, and we recorded all these changes. In this way, we can draw the whole picture of the market.


Using DNSMon to detect mining websites has its own advantage and disadvantage:


 * Advantage
 * wide coverage
 * near real-time
 * high precision
 * can use mining domain seeds to discover more new suspicious sites through domain correlation
 * support the detection in the case of link hijacking, which is better than traditional web scanners
 * Disadvantage
 * only reveals the relations between domains, and requires other methods to confirm web page mining behavior


In summary, we can use DNSMon system to:


 * discover suspicious sites in bulk
 * identify mining website quickly
 * locate mining sites that use techniques like code morphing or shell link


Declaration


The tag graph in this blog is created via http://cloud.niucodata.com/

{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"\nAt [360Netlab](https://twitter.com/360Netlab), we are continuously analyzing DNS traffic. Based on this, we have established a DNSMon detection system that analyzes various anomalies and correlations in DNS traffic.\n\nWe reported a few web mining sites such as openload.co in previous [article](__GHOST_URL__/openload-co-and-other-popular-alex-sites-are-abusing-client-browsers-to-mining-cryptocurrency/). After that, we try to **use DNSMon to further analyze web mining on the entire Internet level**. This article describes what we have seen so far.\n\nAt present:\n\n - **0.2% websites have web mining code embedded in their homepage**: 241 (0.24%) out of Alexa Top 100,000 websites, and 629 (0.21%) out of Alexa Top 300,000 websites\n - **Pornographic related websites constitute the main body**, accounting for 49% . Others include fraud (8%), advertising (7%), mining (7%), film and television (6%) and other categories\n - **10+ sites offer technical capacity for mining**. The largest of them is coinhive.com, accounting for about 57% of the share, followed by coin-hive.com (8%), load.jsecoin.com (7%), webmine.pro (4%), authedmine.com (4%) and others\n\nWeb mining has currently become a market, including the following roles:\n\n - **End users**: currently their interests are neglected\n - **Mining sites**: new players, providing the scripts and capability for web mining\n - **Content / traffic website**: these are existing websites with large user base, but lack the means for monetization. Now they are directing their previously unprofitable traffic to the mining sites, and are making money by web mining using the visitors' computers. Recently some content sites have built their own mining capacity, so that they no longer need to share their profit with the mining sites.\n\n#### 600+ Content / Traffic Websites\n\nIn Alexa Top 300,000 sites, by checking their homepage, we found 628 websites have embedded mining code. We map the keywords of these domain names below, so the readers can have a visual impression. Due to the particularity of pornography, we will not publish these domain names.\n\n![](__GHOST_URL__/content/images/2018/02/keywords.png)\n\nThe contents of these websites fall into the following categories\n\n![](__GHOST_URL__/content/images/2018/02/content-sites-by-category.png)\n\n#### 10+ Mining Sites\n\n###### Market Share Ranking of Mining Sites\nContent sites will try to monetize their user traffic through mining sites. \n\nAccording to the usages by content sites, we see the Top 10 mining sites on 2018-02-06 as follow:\n\n![](__GHOST_URL__/content/images/2018/02/mining-domain-usage.png)\n\nOne thing to note is that while there are only 628 content sites in total, mining sites are used 728 times. This is because some content sites use two or more mining sites at the same time, which is common in this market.\n\n###### Families of Mining Sites\n\nAll of these mining sites can be attributed to several different families. Some known families include:\n\n- **coinhive**: coinhive.com, coin-hive.com, and a series of related\n- **jsecoin**: load.jsecoin.com\n- **webmine**: webmine.cz\n- **cryptoloot**: crypto-loot.com, cryptoloot.pro, webmine.pro and a series of related\n- **coinhave**: coin-have.com, ws.cab217f6.space series, api.cab217f6.space series \n\n###### Traffic Trend of Mining Sites\n\nDNS traffic of mining sites are shown in the following figure\n\n![](__GHOST_URL__/content/images/2018/02/web-miner-site-dns-traffic-1.png)\n\nWe can see that:\n\n - **The market started around 2017-09**, coin-hive.com and coinhive.com are accessed massively since 2017-09-15 and 2017-09-28\n - **The market keeps growing**, two boosts happened around 2017-10 and 2018-01.\n - **The biggest player is coinhive family**, which is consistent with the above ranking statistics. As a representative, the popularity ranking of coinhive.com has arised to Top 20k.\n - **More and more mining site providers are entering the market**\n\nOn the other side, we recently observed that the traffic of coinhave family's main site is shrinking as it starts to divert traffic into varieties of subsites for redundancy.\n\n###### New Players and New Games\n\nWe also notice some new players show up in the market recently:\n\n- **Advertiser**: mining behavior in some content sites are actually introduced by advertisers\n- **Shell link**: some content sites use shell links to evade detection by source code auditing\n- **URL shortener**: goobo.com.br is a URL shortener in Brazil. Its homepage as well as the shortened URLs it generate will load coinhive mining script when being visited.\n- **Supply chain pollution**: www.midijs.net is a JS based MIDI file player, whose [source code](http://www.midijs.net/lib/midi.js) is embedded with coinhive script\n- **Self-built mine pool**: there is an [opensource project](https://github.com/deepwn/deepMiner) on github which can be used to set up private mine pool. \n- **End user aware web mining**: authedmine.com is a new mining site, which declares only mining under user's permission\n\n#### The Mechanism and Advantage of Detecting Web Mining Through DNSMon\n\nWe have been using DNSMon to monitor websites that launch web mining. The monitoring works effectively because:\n\n - when user opens a content website that loads mining site (like coinhive.com) subsequently, such relation between the content site domain and mining site domain are recorded by our DNSMon system.\n - in this case, we can identify related content websites by investigating coinhive.com's correlation\n - content sites may switch mining sites occasionally, and we recorded all these changes. In this way, we can draw the whole picture of the market.\n\nUsing DNSMon to detect mining websites has its own advantage and disadvantage:\n\n- Advantage\n - wide coverage\n - near real-time\n - high precision\n - can use mining domain seeds to discover more new suspicious sites through domain correlation\n - support the detection in the case of link hijacking, which is better than traditional web scanners\n- Disadvantage\n - only reveals the relations between domains, and requires other methods to confirm web page mining behavior\n\nIn summary, we can use DNSMon system to:\n\n - discover suspicious sites in bulk\n - identify mining website quickly\n - locate mining sites that use techniques like code morphing or shell link\n\n#### Declaration\nThe tag graph in this blog is created via http://cloud.niucodata.com/\n"}]],"sections":[[10,0]],"ghostVersion":"3.0"}