Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Dissecting the Infrastructure Used in Web-based Cryptojacking: A Measurement Perspective

Ayodeji Adeniran, Kieran Human, David Mohaisen

TL;DR

The paper analyzes the infrastructure behind web-based cryptojacking by leveraging the MANiC dataset of 887 sites, Whois-derived hosting data, and VirusTotal scans to assess current malicious content and geographic distribution. It finds CoinHive as the dominant cryptomining service within the malicious subset and reveals a heavy-tailed geographic distribution with concentration in the United States and other tech-forward regions. A substantial fraction of sites have cleaned up or no longer host malicious content, but a nontrivial portion remains at risk, underscoring detection gaps and the need for ongoing monitoring. The study provides an infrastructure-centric view of cryptojacking, offering actionable insights for security practitioners and policymakers to target hosting patterns, strengthen defenses, and track threat evolution.

Abstract

This paper conducts a comprehensive examination of the infrastructure supporting cryptojacking operations. The analysis elucidates the methodologies, frameworks, and technologies malicious entities employ to misuse computational resources for unauthorized cryptocurrency mining. The investigation focuses on identifying websites serving as platforms for cryptojacking activities. A dataset of 887 websites, previously identified as cryptojacking sites, was compiled and analyzed to categorize the attacks and malicious activities observed. The study further delves into the DNS IP addresses, registrars, and name servers associated with hosting these websites to understand their structure and components. Various malware and illicit activities linked to these sites were identified, indicating the presence of unauthorized cryptocurrency mining via compromised sites. The findings highlight the vulnerability of website infrastructures to cryptojacking.

Dissecting the Infrastructure Used in Web-based Cryptojacking: A Measurement Perspective

TL;DR

The paper analyzes the infrastructure behind web-based cryptojacking by leveraging the MANiC dataset of 887 sites, Whois-derived hosting data, and VirusTotal scans to assess current malicious content and geographic distribution. It finds CoinHive as the dominant cryptomining service within the malicious subset and reveals a heavy-tailed geographic distribution with concentration in the United States and other tech-forward regions. A substantial fraction of sites have cleaned up or no longer host malicious content, but a nontrivial portion remains at risk, underscoring detection gaps and the need for ongoing monitoring. The study provides an infrastructure-centric view of cryptojacking, offering actionable insights for security practitioners and policymakers to target hosting patterns, strengthen defenses, and track threat evolution.

Abstract

This paper conducts a comprehensive examination of the infrastructure supporting cryptojacking operations. The analysis elucidates the methodologies, frameworks, and technologies malicious entities employ to misuse computational resources for unauthorized cryptocurrency mining. The investigation focuses on identifying websites serving as platforms for cryptojacking activities. A dataset of 887 websites, previously identified as cryptojacking sites, was compiled and analyzed to categorize the attacks and malicious activities observed. The study further delves into the DNS IP addresses, registrars, and name servers associated with hosting these websites to understand their structure and components. Various malware and illicit activities linked to these sites were identified, indicating the presence of unauthorized cryptocurrency mining via compromised sites. The findings highlight the vulnerability of website infrastructures to cryptojacking.
Paper Structure (14 sections, 3 figures, 6 tables)

This paper contains 14 sections, 3 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Problem Statement and Research Questions
  4. Technical Approach
  5. Dataset and Preprocessing
  6. Analysis Dimensions
  7. Results
  8. Cryptojacking malware in the malicious dataset
  9. Cryptojacking infrastructure websites distribution
  10. Threat categories and classifications
  11. Malicious contents in the cryptojacking infrastructures
  12. Correlation and statistical test
  13. Summary of Results and Findings
  14. Concluding Remarks

Figures (3)

  • Figure 1: This figure shows the prevalence of various cryptojacking malware types found within the malicious dataset, with CoinHive being the most significant contributor
  • Figure 2: Cryptojacking websites distribution. A heavy-tailed distribution regarding the number of websites associated with cryptojacking activities.
  • Figure 3: Security engines categories with the number of occurrences.