--- title: Pixalate unveils the list of sites secretly mining for cryptocurrency description: Coinhive provides site owners with JavaScript that can use visitors' CPUs to mine for cryptocurrency. Pixalate has compiled the list of sites using Coinhive. image: https://www.pixalate.com/hubfs/Blog_Media/Blog%20photos/sites-with-coinhive-pixalate-10-25.jpg --- [![pixalate-full-logo](https://www.pixalate.com/hs-fs/hubfs/Pixalate_Logos/pixalate-full-logo.jpg?width=150&height=60&name=pixalate-full-logo.jpg "pixalate-full-logo")](https://www.pixalate.com) Search **Menu** ** ** ![](https://www.pixalate.com/hubfs/Blog_Media/Blog%20photos/sites-with-coinhive-pixalate-10-25.jpg) [Thought Leadership](https://www.pixalate.com/blog/topic/thought-leadership) | 5 min read # Pixalate unveils the list of sites secretly mining for cryptocurrency Written by [Pixalate](https://www.pixalate.com/blog/author/pixalate) Oct 26, 2017 2:13:08 PM Cryptocurrencies such as Bitcoin, Monero, and Ethereum seem to be taking the world by storm, and their climbing values (Bitcoin is up [825% this year](http://www.philly.com/philly/business/bitcoin-is-up-825-this-year-surpassing-the-value-of-american-express-20171024.html)) have given rise to new methods of “mining” for the currency. In late September, [The Register](https://www.theregister.co.uk/2017/09/25/showtime_hit_with_coinmining_script) reported that CBS’s Showtime.com, and a sibling site, contained JavaScript from Coinhive, which tapped into its visitors’ CPUs to mine for cryptocurrency. The only problem: In many cases, users don’t know or consent to share their CPU, and they typically don’t receive any of the monetary benefits. Coinhive is one of several services which offer JavaScript that can mine for cryptocurrency without the users' knowledge or consent. ### Here's a video showing how cryptojacking works: ### **Which websites are using Coinhive?** **[![coinhive site list download](https://no-cache.hubspot.com/cta/default/2364596/345713ed-7bac-48b5-b3d7-9438623fdb8d.png)](https://cta-redirect.hubspot.com/cta/redirect/2364596/345713ed-7bac-48b5-b3d7-9438623fdb8d)** Coinhive is one of several companies offering this technology, but it is currently the most popular. Pixalate has compiled the list of sites with Coinhive enabled. You can [download the list here](https://info.pixalate.com/websites-with-coinhive). The list was last updated on November 27, 2017. - 13 of the Alexa top 1000 sites have the mining script enabled. Several of these are Blogspot sites with different top-level domains (TLD) — e.g. .com, .mx, etc. - 25 of the Alexa top 5000 sites have the script - 3 of the Pixalate top 1000 sites have the script - 9 of the Pixalate top 5000 sites have the script ### What is cryptojacking? Cryptojacking occurs when a JavaScript tag is integrated into a website's code to utilize the visitor's CPU to mine for cryptocurrency — such as Bitcoin, Monero, Ethereum, etc. — via their browser.  Here's an example of the code: ![coinhive-code.jpg](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/coinhive-code.jpg?width=640&name=coinhive-code.jpg) The above image is an example of a code in which the publisher controls how much of its visitors' CPU to utilize for mining (set by the throttle number).  The script causes the browser/website to "hijack" the user's CPU and use it to crack an encryption. The website owner — and the script provider — are paid, while the user typically does not benefit. In fact, if the script uses enough of their CPU, the quality of their browsing experience is likely to be reduced. Watch what can happen to your CPU when you visit one of the sites in question: ![cryptojacking-cpu-power.gif](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/cryptojacking-cpu-power.gif?width=640&name=cryptojacking-cpu-power.gif) ### **Most common TLDs for Coinhive sites:** About one-third (30.5%) of mining-enabled sites have a TLD of .com. **![coinhive november 27.png](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/coinhive%20november%2027.png?width=640&name=coinhive%20november%2027.png)** - .com — 30.5% - .si — 6.6% - .online — 6.3% - .net — 5.7% - .ru — 3.8% - .sk — 3.1% - .br — 2.9% - .info — 2.9% - .site — 2.1% - .org — 2.1% - All other TLDs — 34.2% ### **[![coinhive site list download](https://no-cache.hubspot.com/cta/default/2364596/345713ed-7bac-48b5-b3d7-9438623fdb8d.png)](https://cta-redirect.hubspot.com/cta/redirect/2364596/345713ed-7bac-48b5-b3d7-9438623fdb8d)** ### How does cryptojacking work? Essentially, cryptojacking turns your computer into a “miner,” and it uses the CPU to help chip away at an encryption. There’s a concrete value to the amount of electricity used to break the encryption. If a website helps crack the encryption, they get paid. Website owners who are installing the JavaScript code into their site are effectively turning their visitors’ computers into a data center. The murky area is that users might not know their computers are being used in this way. ### **Why should marketers care about cryptojacking?** Setting aside the morality debate — should websites tap into their visitor's computing power, without their knowledge or conset, for their own gain? — there are plenty of red flags for advertisers surrounding the sites that have implemented cryptojacking JavaScript.   According to Pixalate's data, anywhere between 60-80% of the sites with Coinhive enabled come with a major red flag.   ![coinhive-stats-november-27.png](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/coinhive-stats-november-27.png?width=1024&name=coinhive-stats-november-27.png) - 68.3% of the sites do not have a Privacy Policy - 56.8% of the sites do not have Terms & Conditions - 78.0% of the sites are High Risk, according to Pixalate And there is plenty of overlap: 49.3% of the sites lack both a Privacy Policy and Terms & Conditions. In many countries, posting a Privacy Policy online is required by law. Many of these sites are also ad-supported, which also requires a Privacy Policy for tracking purposes.  Having a Privacy Policy is common practice among legitimate websites. Even basic website tools — such as Google Analytics — require a Privacy Policy. The lack of these basic, and sometimes required, website items can be a red flag. ### **Calling on the industry to ad clean up quality** Some big brands are appearing on these sites, and the ads are being served by some of the world's biggest ad exchanges. Here is just one example: ![free-gg-ad.jpg](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/free-gg-ad.jpg?width=640&name=free-gg-ad.jpg) This website is not cluttered with ads or auto-play videos, but it does have a nearly 80% non-human traffic (NHT) rate, as measured by Pixalate, and it lacks both a Privacy Policy and Terms & Conditions. It also has Coinhive enabled. As you can see, an ad from a premium brand has been served to this site. The user experience can be drastically impacted, in a negative way, as a result of their hijacked CPU. Many of the sites are cluttered with ads and auto-play video ads that are difficult to close. Given the current climate in the industry around brand safety, transparency, and general quality, we urge marketers to carefully scrutinize the list we have provided and optimize your campaigns as appropriate.  [![coinhive site list download](https://no-cache.hubspot.com/cta/default/2364596/345713ed-7bac-48b5-b3d7-9438623fdb8d.png)](https://cta-redirect.hubspot.com/cta/redirect/2364596/345713ed-7bac-48b5-b3d7-9438623fdb8d) ### **The JavaScript provider gets paid. The website gets paid. But they use the visitor's computer to get money, and the visitor gets nothing?** In most cases, the user does not receive any of the cryptocurrency earned through cryptojacking. In some cases, the websites are giving the user something of "value" as it relates to that particular site. They may be rewarding visitors with digital currency to spend on a game or on the website. The purpose is to incentivize users to stay longer, which therefore allows the site to use their CPU for longer, which earns the site more money. As the above video illustrates, Coinhive pays 0.000137 Monero (XMR) per 1 million hashes. Looking at it another way, that’s 1 XMR per 7.3 billion hashes. As of this writing, a Monero (XMR) is worth roughly $90 USD. Per Coinhive, using an Intel i7 CPU — one of the fastest desktop CPUs — you would see a hash rate of about 90 hashes per second. In order to reach 7.3 billion hashes, you would need 81.1 million device seconds to earn 1 XMR. Worldstarhiphop.com, a site that is featured in the video above and had the Coinhive JavaScript enabled (but no longer does), saw roughly 47.5 million visitors in September per SimilarWeb, and the average visitor duration was roughly 6.8 minutes. This equates to 408 device seconds per visitor. If you multiply the device seconds per visitor (408) by the number of visitors (47.5 million), you get 19.38 billion device seconds per month. Per Coinhive’s estimates that roughly 81.1 million device seconds earn one XMR, then 47.5 million visitors equates to about 239 XMR, or roughly $21,500, earned per month. [![coinhive site list download](https://no-cache.hubspot.com/cta/default/2364596/345713ed-7bac-48b5-b3d7-9438623fdb8d.png)](https://cta-redirect.hubspot.com/cta/redirect/2364596/345713ed-7bac-48b5-b3d7-9438623fdb8d) *Want more data-driven insights? Sign up for our blog! * ### Search Blog Search ### Follow Pixalate ### Subscribe to our blog *By entering your email address and clicking Subscribe, you are agreeing to our [Terms of Use ](https://www.pixalate.com/terms)and [Privacy Policy.](https://www.pixalate.com/privacypolicy) Previous Story [← Pixalate Week in Review: October 16 - 20, 2017](https://www.pixalate.com/blog/programmatic-ad-fraud-news-week-in-review-october-20-2017) [** ](https://www.pixalate.com/blog) Next Story [Pixalate Week in Review: October 23 - 27, 2017 →](https://www.pixalate.com/blog/programmatic-ad-fraud-news-week-in-review-october-27-2017) ## You May Also Like These Stories on Thought Leadership [![](https://www.pixalate.com/hubfs/Q%26A%20with%20Krush%20Media%20-%20cover.png) ](https://www.pixalate.com/blog/krush-media-qa) [Case Studies](https://www.pixalate.com/blog/topic/case-studies) ### [Q&A with Steven Slaughter, Head of Ad Ops & Yield at Krush Media, on managing a clean CTV and Mobile Ad Supply Chain](https://www.pixalate.com/blog/krush-media-qa) Jun 27, 2023 12:00:00 PM | 4 min read [![](https://www.pixalate.com/hubfs/Q%26A%20with%20Screencore%20-%20cover.png) ](https://www.pixalate.com/blog/screencore-qa) [Case Studies](https://www.pixalate.com/blog/topic/case-studies) ### [Q&A with Jess Okan, Co-founder and CEO of Screencore, on strategies for minimizing ad fraud in the connected TV ecosystem](https://www.pixalate.com/blog/screencore-qa) May 30, 2023 7:00:00 AM | 6 min read [![](https://www.pixalate.com/hubfs/Oleksandra%20Kazantseva.png) ](https://www.pixalate.com/blog/bizzclick-qa) [Case Studies](https://www.pixalate.com/blog/topic/case-studies) ### [Q&A with Oleksandra Kazantseva, Head of Programmatic at BizzClick, on transparency, trust, and security](https://www.pixalate.com/blog/bizzclick-qa) Apr 17, 2023 2:00:00 PM | 4 min read ** ### Subscribe to our blog *By entering your email address and clicking Subscribe, you are agreeing to our [Terms of Use ](https://www.pixalate.com/terms)and [Privacy Policy.](https://www.pixalate.com/privacypolicy) ![pixalate-logo-red-small](https://www.pixalate.com/hs-fs/hubfs/2018NewTemplate/pixalate-logo-red-small.png?width=208&name=pixalate-logo-red-small.png "pixalate-logo-red-small") ** By entering your email address and clicking Subscribe, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and [Privacy Policy](https://www.pixalate.com/privacypolicy) Products [Analytics](https://www.pixalate.com/products/analytics) [Blocking](https://www.pixalate.com/products/blocking) [Media Rating Terminal](https://www.pixalate.com/products/mrt) [Publisher Trust Indexes](https://www.pixalate.com/rankings/?group=app&reportId=publisherTrustIndex) [Seller Trust Indexes](https://www.pixalate.com/rankings/?group=app&reportId=publisherTrustIndex) [IoT Device Rankings](https://www.pixalate.com/rankings/?group=app&reportId=iotDeviceReach) Resources [Blog](https://blog.pixalate.com/) [Press](https://www.pixalate.com/press) [Careers](https://www.pixalate.com/jobs) [Team](https://info.pixalate.com/pixalate-leadership-team) Contact Email [** sales@pixalate.com ](mailto:sales@pixalate.com) [** privacy@pixalate.com ](mailto:privacy@pixalate.com) US: [** +1 888 749 2528 ](tel:+1%20888%20749%202528) EU: [** +44 (0)800 011 2050 ](tel:+44%20(0)800%20011%202050) Slack: [Join ATSAPI Slack Channel ](https://atsapi-pixalate.slack.com/join/shared_invite/zt-10dtow5cj-OEtlNr5yzJkrZMQUqcEEow#/shared-invite/email) Offices Global Offices US 1775 Greensboro Station Place, Suite 425, McLean, VA 22102 UK 20 North Audley Street London, W1K 6WE, United Kingdom EU 10 Earlsfort Terrace Dublin 2, D02 T380, Ireland Singapore 10 Anson Road, #22-02 International Plaza, Singapore 079903 [![facebook](https://www.pixalate.com/hubfs/footer/icons/facebook.png) ](https://www.facebook.com/pixalate) [![x](https://www.pixalate.com/hubfs/footer/icons/twitter-x.png) ](https://twitter.com/pixalateinc) [![linkedin](https://www.pixalate.com/hubfs/footer/icons/linkedin.png) ](https://www.linkedin.com/company/pixalate) ![wechat](https://www.pixalate.com/hubfs/footer/icons/wechat.png) [![slack](https://www.pixalate.com/hubfs/footer/icons/slack.png) ](https://atsapi-pixalate.slack.com/join/shared_invite/zt-10dtow5cj-OEtlNr5yzJkrZMQUqcEEow#/shared-invite/email) [Terms of Use](https://www.pixalate.com/terms) [Privacy Policy](https://www.pixalate.com/privacypolicy) [GDPR Compliance](https://www.pixalate.com/gdpr) Disclaimer Copyright © 2025 Pixalate [Back to top **](https://www.pixalate.com/blog/coinhive-cryptocurrency-mining-cpu-site-list#) # Disclaimer Disclaimer: The content of this page reflects Pixalate’s opinions with respect to the factors that Pixalate believes can be useful to the digital media industry. Any proprietary data shared is grounded in Pixalate’s proprietary technology and analytics, which Pixalate is continuously evaluating and updating. Any references to outside sources should not be construed as endorsements. Pixalate’s opinions are just that - opinion, not facts or guarantees. Per the MRC, “'Fraud' is not intended to represent fraud as defined in various laws, statutes and ordinances or as conventionally used in U.S. Court or other legal proceedings, but rather a custom definition strictly for advertising measurement purposes. Also per the MRC, “‘Invalid Traffic’ is defined generally as traffic that does not meet certain ad serving quality or completeness criteria, or otherwise does not represent legitimate ad traffic that should be included in measurement counts. Among the reasons why ad traffic may be deemed invalid is it is a result of non-human traffic (spiders, bots, etc.), or activity designed to produce fraudulent traffic.” ** ** *By clicking Download and entering your email address, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and have read and acknowledge our [Privacy Policy](https://www.pixalate.com/hubfs/2024-08-20_Pixalate_Privacy_Policy.pdf). *Copyright © 2025 Pixalate** * * * * * * * * * * * * * * * * * * * * * * * * * * * * × ## Subscribe to the Pixalate Blog The first step in ad fraud prevention. Loading... By entering your email address and clicking Submit, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and [Privacy Policy](https://www.pixalate.com/privacypolicy). ![pixalate-logo-white](https://www.pixalate.com/hubfs/Blog_V2_08_26_2016/logo/Pixalate_Logo_WHITE.png) ##### Contact Us12 Loading... ![pixalate-logo-white](https://www.pixalate.com/hubfs/Blog_V2_08_26_2016/logo/Pixalate_Logo_WHITE.png) ##### Download GSTI Loading... Schedule your demo today Please complete all fields Loading... By entering your email address and clicking Submit, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and [Privacy Policy](https://www.pixalate.com/privacypolicy). * * * * *