Download websites that use CoinHive Captcha

About CoinHive Captcha

Proof of work was briefly sold as a humane replacement for the image grid. Instead of picking out crosswalks, a visitor would let the browser grind through a short mining task, and the site would keep what the browser earned. CoinHive Captcha was that idea packaged as a product by CoinHive, released under a Proprietary license and recorded in our data from 2017. The mining service the product depended on no longer operates.

So a match in the current data is not a report of active behaviour. The JavaScript include still sits in a template, the browser still tries to fetch it, and nothing happens. Presence records a maintenance failure rather than a technology choice, which makes the row more interesting as a hygiene indicator than as a product signal.

Understood that way, the domains are informative. A site still carrying the snippet is a site whose templates have not been reviewed in years, or one running a theme or a plugin that bundled the code and was never updated either. Abandoned third-party references also carry a real risk, because a script tag pointing at a domain the original operator walked away from hands control of what the browser executes to whoever holds that domain next.

As of October 2026 the reference still appears on 5 sites, filed under Cryptominers for what the product claimed to do rather than for anything the code does now. Counts in this range are small and the direction matters more than the level, so the value lies in tracking the set across releases and watching it shrink.

There is a subtler trap in the category label. An entry filed under security invites the assumption that the site has a control in place, and here the opposite holds: the control is inert, and an auditor treating the row as evidence of bot protection would draw exactly the wrong conclusion. Category labels in any technology dataset describe what a product was sold as, never what it currently does on a given host, and this entry is the clearest illustration of the gap we have.

Detection also depends on the original reference surviving intact. A copy that was self-hosted, renamed or folded into a build output will not match, so the figure is a floor and skews toward the least modified installs. For hosting abuse teams, security researchers and anyone measuring how long dead code lives on the web, the list itself is the deliverable. A single domain check tells you whether one site is clean. The download tells you which sites are not, and cleanup outreach or a decay study exists in no other form.