Download websites that use Crypto-Loot

About Crypto-Loot

Selling a visitor's spare processor cycles instead of selling their attention was, for a short stretch, a serious commercial proposal. Crypto-Loot is one of the scripts built to make that trade work. A publisher pasted a small JavaScript file into a page template, and every reader who arrived contributed a little arithmetic to a mining pool for as long as the article stayed open. No banner, no subscription wall, no consent dialogue. The revenue per visitor was tiny and the idea only made sense at scale.

The mainstream version of the proposal collapsed on the question of consent. Anti-virus vendors, browser makers and blocklist maintainers stopped trying to distinguish a miner the site owner had installed from a miner an intruder had installed, and started blocking both. Ad blockers followed within months. 2017 is the earliest year our record associates with Crypto-Loot, which places its arrival inside the window when in-browser mining was being pitched openly to publishers as a revenue product.

History is what makes the fingerprint interesting now, rather than the scale of any current use. As of October 2026 we detect Crypto-Loot on 2 sites. A publisher actively earning from the script is only one of the explanations for a match. The mining code is Proprietary and loads from vendor infrastructure, so a tag pasted into a template long ago stays perfectly visible in the page source whether or not anybody is still watching what it returns.

What a leftover miner often marks is neglect. A page still serving a mining tag nobody remembers adding is a page that has not been reviewed in a long time, or a page that was compromised once and never fully cleaned. Hosting abuse teams, security researchers and anyone building a corpus of stale third-party code care about the second case in particular, because an injection point that worked once is often still open.

A per-domain lookup answers whether one site you already suspect carries the tag. The downloadable list answers the question in the other direction: which sites anywhere in the crawl still carry it, so you can sample them, date them against archived copies, or cross reference them against other neglected third-party tags. The honest limit is that our count is a floor rather than a total. Detection needs the fingerprint to survive in delivered markup or script, and a self-hosted, renamed or obfuscated fork of a miner will not match, which is exactly what anyone deploying one quietly today would use.