Download websites that use CoinHive

About CoinHive

A dead script does not delete itself. CoinHive sold publishers a way to turn visitor processor cycles into Monero, and when the service behind it closed down the snippets stayed embedded in the pages that had adopted them. What our crawler meets today is largely residue, and the residue is the reason the list is worth pulling.

The original pitch was straightforward. Rather than sell ad space, a site owner pasted a fragment of JavaScript into a shared template and let each visitor's browser grind through hashes while the page was read. The idea arrived in 2017 on Proprietary terms, with the operator taking a cut of whatever was mined. Reality diverged from the pitch almost immediately, because the same fragment worked just as well when it was injected into a compromised site without anyone being told, and the technique became a standard payload for whoever had gained write access to a template.

Our version field is unusually informative for a product of this kind. Across the detections a single labelled build appears, opt-in, a label that points at the consent-asking variant rather than the silent one the security vendors began blocking on sight. Carrying the consent variant means somebody made a deliberate choice at some point and wrote it into the page. Carrying the silent variant means either a different choice or no choice at all, which is exactly the distinction an abuse researcher needs to draw and cannot draw from a domain name.

As of October 2026 we detect the fingerprint on 38 sites, and the figure should be read with an asterisk attached. Detection depends on the loader still being referenced in delivered markup, so a miner buried inside a minified bundle, or served only to selected user agents, will not appear. The count also says nothing about whether the code still does anything, because the endpoint that collected the work is gone. For a researcher the interesting object is not the mining but the maintenance signal, since a page still calling a shut-down service is a page nobody has audited in a very long time.

A per-domain lookup answers whether one site you already suspect is carrying the snippet. The downloadable file answers the shape of the problem: which hosting neighbourhoods, which publishing stacks and which country markets still serve it, and how much of that population looks abandoned rather than actively monetised. Sorting a whole population by a decay signal is not something anyone can do one query at a time.