Timeline of cryptojacking scripts/malware

[tmursch]

We need to catalog the creation date of cryptojacking scripts/malware found. A list of past/present cryptojacking scripts/malware found needs to be documented first.

[shayanb]

2017-09-16 - First instances of Coinhive API usage (based on censys top 1M websites dataset)
2017-10-17 - First instances of Authedmine (based on censys top 1M websites dataset)
2017-11-23 - LiveHelpNow Hack incident (https://blog.livehelpnow.net/security-incident-nov-23rd-2017/)

Timeline on copycats (cryptoloot and ...)

[dougsillars]

This matches the HTTPArchive (updated every 2 weeks).
for mobile sites:
09/01/17 had 0 entries
9/15/17: 467 entries

Desktop:
9/01/17 had 0 entries
9/15/17: 529 entries

[dougsillars]

As for a list: here is an AdBlock based list:
https://github.com/hoshsadiq/adblock-nocoin-list/

[tmursch]

Here's another list, however it's not limited to specifically cryptojacking scripts. Other cryptomining domains are included. I will review further to extract browser based (JavaScript) services.

https://zerodot1.github.io/CoinBlockerLists/