A Case Study: How One Big Player Could Impact the Cohive Business in China
<!--kg-card-begin: markdown--><p>&quot;Who is Stealing My Power&quot; is a series of articles on the topic of web mining that we observed from our DNSMon system.</p>
<p>As we mentioned in this series of <a href="__GHOST_URL__/who-is-stealing-my-power-web-mining-domains-measurement-via-dnsmon-en/"><strong>one</strong></a>, <a href="__GHOST_URL__/the-list-of-top-alexa-websites-with-web-mining-code-embedded-on-their-homepage/"><strong>two</strong></a>, and <a href="__GHOST_URL__/who-is-stealing-my-power-iii-an-adnetwork-company-case-study-en/"><strong>three</strong></a> , the players in the market can be mainly divided into mining sites and content/traffic sites. The former provides mining capabilities and the latter provides traffic.</p>
<p>For the mining sites, the coinhive family is currently the largest, accounts for roughly 58% of the market share.</p>
<p>A lot of interesting things can be observed by tracking DNS traffic for the coinhive family domain name through DNSMon. For example, the following figure shows the volume distribution of domain name requests that are closely related to coinhive.com. (Time: 2018-01-31 to 2018-02-15)</p>
<p><img src="__GHOST_URL__/content/images/2018/03/codomain-dnspai_counts_daily_v2-1.png" alt="" loading="lazy"></p>
<p>The domain names in the figure all have close relationship with coinhive.com , and you can see their dns request volumes vary. Now let’s take a close look at two of them <strong>kw.cndqsjlg.com</strong> and <strong>v.bjztkeji.com</strong>. From February 3 to February 8. The volume rapidly increased but quickly disappeared after February 9. Unlike other stable domain names, the appearance of these two domain names is very abrupt.</p>
<p>The request volumes of these two domain names shoot up at the beginning and then quickly disappeared. This abnormal behavior caught our attention. So here is our analysis.</p>
<h4 id="thefluctuationsofcoinhivecomrequesttraffic">The Fluctuations of Coinhive.com Request Traffic</h4>
<p><img src="__GHOST_URL__/content/images/2018/03/domain_wave_1.png" alt="" loading="lazy"></p>
<p>As seen in the above chart, the dns traffic of coinhive.com has some major fluctuations between Feb 1st and 10th. It can be broken into four sections:</p>
<ul>
<li><strong>The first spike</strong>, Feb 5th</li>
<li><strong>The first crash</strong>, Feb 6th</li>
<li><strong>The second spike</strong>, Feb 7th</li>
<li><strong>The second crash</strong>, Feb 8th</li>
</ul>
<p>Now let’s exam the causes of these anomalies.</p>
<h4 id="thefirstspikeofcoinhivetraffic">The First Spike of Coinhive Traffic</h4>
<p>You can easily spot the big spike of coinhive dns traffic in stage 1, what caused this?</p>
<p><img src="__GHOST_URL__/content/images/2018/03/domain_wave_2.png" alt="" loading="lazy"></p>
<p>Note the green line, domain <strong>kw.cndqsjlg.com</strong>:</p>
<ul>
<li>It is a brand-new domain, registered on Feb 2nd, only 48 hours before the peak</li>
<li>The web page of this domain has coinhive mining script. The corresponding site_key is <strong>76kBm8jdLIfdkW6rWAbAs58122fovBys</strong></li>
<li>The traffic pattern of this domain matched nicely with coinhive.</li>
<li>We estimate this domain name contributes ~18% of coinhive source traffic in mainland China</li>
</ul>
<h4 id="thefirstcoinhivetrafficcrash">The First Coinhive Traffic Crash</h4>
<p>During the period stage 2, from Feb 6 to Feb 7, you can see coinhive traffic had a significant dip, the reason?</p>
<ul>
<li>kw.cndqsjlg.com stopped using coinhive.</li>
<li>Instead, it used its <strong>own deepminer</strong> for mining to <strong>avoid 30% Fair Payouts</strong> from coinhive</li>
</ul>
<p>After the 7th, the domain name was no longer active.</p>
<h4 id="thesecondspikeofcoinhivetraffic">The Second Spike of Coinhive Traffic</h4>
<p>Now let’s take a look at stage 3, we can see there is another traffic spike for coinhive, the reason?</p>
<p><img src="__GHOST_URL__/content/images/2018/03/domain_wave_3.png" alt="" loading="lazy"></p>
<p>Similar to above, there is another new domain <strong>v.bjztkeji.com</strong> (blue line) started to show up:</p>
<ul>
<li>This new domain has the coinhive script running on its website, confirmed by analyzing the web page content</li>
<li>The corresponding site_key is 76kBm8jdLIfdkW6rWAbAs58122fovBys, same with the old kw.cndqsjlg.com</li>
<li>The traffic pattern of this domain name again matched nicely with the spike traffic of coinhive</li>
<li>Further analyze shows the traffic is taken from the old kw.cndqsjlg.com</li>
<li>We estimated that this domain name contributed ~15% of coinhive traffic in mainland China</li>
</ul>
<h4 id="thesecondcoinhivetrafficcrashvs360disclosure">The Second Coinhive Traffic Crash  VS 360 Disclosure</h4>
<p>On Feb 8, 360 security published an article <a href="https://www.anquanke.com/post/id/97904">disclosed</a> this security case, pointed out the company behind was a domestic adnetwork and blocked the above behavior in our browser products. Correspondingly:</p>
<ul>
<li>Traffic of kw.cndqsjlg.com: gradually fell to the floor</li>
<li>Traffic of v.bjztkeji.com: dropped to the floor after the 9th</li>
<li>Traffic of coinhive.com : substantially lower after 9th and keeps that way till this day. Traffic volume in last week is about 45% ~ 65% of the peak, in mainland China</li>
</ul>
<p>The corresponding traffic figure:<br>
<img src="__GHOST_URL__/content/images/2018/03/domain_wave_4.png" alt="" loading="lazy"></p>
<h4 id="nottheend">Not the end</h4>
<p>Ad network involved cryptojacking is something really worth noting. In our previous <a href="__GHOST_URL__/who-is-stealing-my-power-iii-an-adnetwork-company-case-study/">article</a>, we published a similar case regarding to an US company, we will not be surprised there are other players in the market that are doing similar thing.</p>
<p>We will continue to monitor the web mining market. If readers have new discoveries, feel free to contact us on  <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a>.</p>
<!--kg-card-end: markdown-->
"Who is Stealing My Power" is a series of articles on the topic of web mining that we observed from our DNSMon system.


As we mentioned in this series of one, two, and three , the players in the market can be mainly divided into mining sites and content/traffic sites. The former provides mining capabilities and the latter provides traffic.


For the mining sites, the coinhive family is currently the largest, accounts for roughly 58% of the market share.


A lot of interesting things can be observed by tracking DNS traffic for the coinhive family domain name through DNSMon. For example, the following figure shows the volume distribution of domain name requests that are closely related to coinhive.com. (Time: 2018-01-31 to 2018-02-15)





The domain names in the figure all have close relationship with coinhive.com , and you can see their dns request volumes vary. Now let’s take a close look at two of them kw.cndqsjlg.com and v.bjztkeji.com. From February 3 to February 8. The volume rapidly increased but quickly disappeared after February 9. Unlike other stable domain names, the appearance of these two domain names is very abrupt.


The request volumes of these two domain names shoot up at the beginning and then quickly disappeared. This abnormal behavior caught our attention. So here is our analysis.


The Fluctuations of Coinhive.com Request Traffic





As seen in the above chart, the dns traffic of coinhive.com has some major fluctuations between Feb 1st and 10th. It can be broken into four sections:


 * The first spike, Feb 5th
 * The first crash, Feb 6th
 * The second spike, Feb 7th
 * The second crash, Feb 8th


Now let’s exam the causes of these anomalies.


The First Spike of Coinhive Traffic


You can easily spot the big spike of coinhive dns traffic in stage 1, what caused this?





Note the green line, domain kw.cndqsjlg.com:


 * It is a brand-new domain, registered on Feb 2nd, only 48 hours before the peak
 * The web page of this domain has coinhive mining script. The corresponding site_key is 76kBm8jdLIfdkW6rWAbAs58122fovBys
 * The traffic pattern of this domain matched nicely with coinhive.
 * We estimate this domain name contributes ~18% of coinhive source traffic in mainland China


The First Coinhive Traffic Crash


During the period stage 2, from Feb 6 to Feb 7, you can see coinhive traffic had a significant dip, the reason?


 * kw.cndqsjlg.com stopped using coinhive.
 * Instead, it used its own deepminer for mining to avoid 30% Fair Payouts from coinhive


After the 7th, the domain name was no longer active.


The Second Spike of Coinhive Traffic


Now let’s take a look at stage 3, we can see there is another traffic spike for coinhive, the reason?





Similar to above, there is another new domain v.bjztkeji.com (blue line) started to show up:


 * This new domain has the coinhive script running on its website, confirmed by analyzing the web page content
 * The corresponding site_key is 76kBm8jdLIfdkW6rWAbAs58122fovBys, same with the old kw.cndqsjlg.com
 * The traffic pattern of this domain name again matched nicely with the spike traffic of coinhive
 * Further analyze shows the traffic is taken from the old kw.cndqsjlg.com
 * We estimated that this domain name contributed ~15% of coinhive traffic in mainland China


The Second Coinhive Traffic Crash VS 360 Disclosure


On Feb 8, 360 security published an article disclosed this security case, pointed out the company behind was a domestic adnetwork and blocked the above behavior in our browser products. Correspondingly:


 * Traffic of kw.cndqsjlg.com: gradually fell to the floor
 * Traffic of v.bjztkeji.com: dropped to the floor after the 9th
 * Traffic of coinhive.com : substantially lower after 9th and keeps that way till this day. Traffic volume in last week is about 45% ~ 65% of the peak, in mainland China


The corresponding traffic figure:




Not the end


Ad network involved cryptojacking is something really worth noting. In our previous article, we published a similar case regarding to an US company, we will not be surprised there are other players in the market that are doing similar thing.


We will continue to monitor the web mining market. If readers have new discoveries, feel free to contact us on twitter.

{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"\"Who is Stealing My Power\" is a series of articles on the topic of web mining that we observed from our DNSMon system.\n\nAs we mentioned in this series of [**one**](__GHOST_URL__/who-is-stealing-my-power-web-mining-domains-measurement-via-dnsmon-en/), [**two**](__GHOST_URL__/the-list-of-top-alexa-websites-with-web-mining-code-embedded-on-their-homepage/), and [**three**](__GHOST_URL__/who-is-stealing-my-power-iii-an-adnetwork-company-case-study-en/) , the players in the market can be mainly divided into mining sites and content/traffic sites. The former provides mining capabilities and the latter provides traffic. \n\nFor the mining sites, the coinhive family is currently the largest, accounts for roughly 58% of the market share.\n\nA lot of interesting things can be observed by tracking DNS traffic for the coinhive family domain name through DNSMon. For example, the following figure shows the volume distribution of domain name requests that are closely related to coinhive.com. (Time: 2018-01-31 to 2018-02-15)\n\n![](__GHOST_URL__/content/images/2018/03/codomain-dnspai_counts_daily_v2-1.png)\n\nThe domain names in the figure all have close relationship with coinhive.com , and you can see their dns request volumes vary. Now let’s take a close look at two of them **kw.cndqsjlg.com** and **v.bjztkeji.com**. From February 3 to February 8. The volume rapidly increased but quickly disappeared after February 9. Unlike other stable domain names, the appearance of these two domain names is very abrupt.\n\nThe request volumes of these two domain names shoot up at the beginning and then quickly disappeared. This abnormal behavior caught our attention. So here is our analysis.\n\n#### The Fluctuations of Coinhive.com Request Traffic\n\n![](__GHOST_URL__/content/images/2018/03/domain_wave_1.png)\n\nAs seen in the above chart, the dns traffic of coinhive.com has some major fluctuations between Feb 1st and 10th. It can be broken into four sections:\n\n - **The first spike**, Feb 5th\n - **The first crash**, Feb 6th\n - **The second spike**, Feb 7th\n - **The second crash**, Feb 8th\n\nNow let’s exam the causes of these anomalies.\n\n#### The First Spike of Coinhive Traffic\n\nYou can easily spot the big spike of coinhive dns traffic in stage 1, what caused this?\n\n![](__GHOST_URL__/content/images/2018/03/domain_wave_2.png)\n\nNote the green line, domain **kw.cndqsjlg.com**:\n\n - It is a brand-new domain, registered on Feb 2nd, only 48 hours before the peak\n - The web page of this domain has coinhive mining script. The corresponding site_key is **76kBm8jdLIfdkW6rWAbAs58122fovBys**\n - The traffic pattern of this domain matched nicely with coinhive.\n - We estimate this domain name contributes ~18% of coinhive source traffic in mainland China\n\n#### The First Coinhive Traffic Crash  \n\nDuring the period stage 2, from Feb 6 to Feb 7, you can see coinhive traffic had a significant dip, the reason?\n\n - kw.cndqsjlg.com stopped using coinhive.\n - Instead, it used its **own deepminer** for mining to **avoid 30% Fair Payouts** from coinhive \n\nAfter the 7th, the domain name was no longer active.\n\n#### The Second Spike of Coinhive Traffic\n\nNow let’s take a look at stage 3, we can see there is another traffic spike for coinhive, the reason?\n\n![](__GHOST_URL__/content/images/2018/03/domain_wave_3.png)\n\nSimilar to above, there is another new domain **v.bjztkeji.com** (blue line) started to show up:\n\n - This new domain has the coinhive script running on its website, confirmed by analyzing the web page content\n - The corresponding site\\_key is 76kBm8jdLIfdkW6rWAbAs58122fovBys, same with the old kw.cndqsjlg.com\n - The traffic pattern of this domain name again matched nicely with the spike traffic of coinhive\n - Further analyze shows the traffic is taken from the old kw.cndqsjlg.com\n - We estimated that this domain name contributed ~15% of coinhive traffic in mainland China\n\n#### The Second Coinhive Traffic Crash  VS 360 Disclosure\n\nOn Feb 8, 360 security published an article [disclosed](https://www.anquanke.com/post/id/97904) this security case, pointed out the company behind was a domestic adnetwork and blocked the above behavior in our browser products. Correspondingly:\n\n - Traffic of kw.cndqsjlg.com: gradually fell to the floor\n - Traffic of v.bjztkeji.com: dropped to the floor after the 9th\n - Traffic of coinhive.com : substantially lower after 9th and keeps that way till this day. Traffic volume in last week is about 45% ~ 65% of the peak, in mainland China\n\nThe corresponding traffic figure:\n![](__GHOST_URL__/content/images/2018/03/domain_wave_4.png)\n\n#### Not the end\n\nAd network involved cryptojacking is something really worth noting. In our previous [article](__GHOST_URL__/who-is-stealing-my-power-iii-an-adnetwork-company-case-study/), we published a similar case regarding to an US company, we will not be surprised there are other players in the market that are doing similar thing.\n\nWe will continue to monitor the web mining market. If readers have new discoveries, feel free to contact us on  [**twitter**](https://twitter.com/360Netlab)."}]],"sections":[[10,0]],"ghostVersion":"3.0"}