Overview

URL https://coin-hive.com/lib/coinhive.min.js
IP217.182.164.12
ASNAS5503 RM Education plc
Location United Kingdom
Report completed2018-12-16 03:16:37 CET
StatusLoading report..
urlquery Alerts Crypto currency mining script


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2018-12-16 2 coin-hive.com/lib/coinhive.min.js Malware
2018-12-16 2 coinhive.com/lib/coinhive.min.js Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 217.182.164.12

Date UQ / IDS / BL URL IP
2018-12-11 11:10:58 +0100
0 - 0 - 3 authedmine.com 217.182.164.12
2018-12-03 20:35:27 +0100
0 - 0 - 5 coin-hive.com 217.182.164.12
2018-12-02 09:39:12 +0100
0 - 1 - 5 cnhv.co/ 217.182.164.12
2018-11-29 00:01:40 +0100
0 - 1 - 3 coin-hive.com/ 217.182.164.12
2018-11-22 16:53:21 +0100
0 - 0 - 1 https://authedmine.com/lib/authedmine.min.js 217.182.164.12
2018-11-21 19:22:37 +0100
0 - 1 - 4 https://cnhv.co 217.182.164.12
2018-11-14 06:12:15 +0100
0 - 3 - 5 coin-hive.com/ 217.182.164.12
2018-10-31 07:58:45 +0100
0 - 0 - 3 authedmine.com/ 217.182.164.12
2018-10-25 14:21:58 +0200
2 - 0 - 2 https://cnhv.co/2rvk0 217.182.164.12
2018-10-24 20:22:32 +0200
2 - 0 - 3 cnhv.co/bflzv 217.182.164.12

Last 10 reports on ASN: AS5503 RM Education plc

Date UQ / IDS / BL URL IP
2019-03-24 19:45:32 +0100
0 - 0 - 5 coin-hive.com/ 217.182.164.9
2019-03-24 19:33:03 +0100
0 - 1 - 0 www.searchpage.com/download/searchpage_install.exe 217.182.14.184
2019-03-24 19:32:51 +0100
0 - 1 - 0 searchpage.com/download/searchpage_install.exe 217.182.14.184
2019-03-24 10:15:29 +0100
0 - 2 - 0 dev.bizes.xyz/ 217.182.166.36
2019-03-24 09:54:16 +0100
0 - 0 - 1 https://indir.2on.com/bandicam-925.exe 217.182.234.202
2019-03-24 04:04:36 +0100
0 - 0 - 1 sklep-elektroniczny.com/2018/08/16 217.182.9.221
2019-03-24 01:53:37 +0100
0 - 1 - 0 bizes.xyz/ 217.182.166.36
2019-03-23 23:31:48 +0100
0 - 0 - 11 royalclassnl.com/ 217.182.110.189
2019-03-23 22:04:27 +0100
0 - 0 - 1 https://spaces.slimspots.com/mobiledirect/?tr (...) 217.182.172.141
2019-03-23 19:56:20 +0100
0 - 0 - 1 joshuajasonpr.com/ 217.182.22.159

Last 10 reports on domain: coin-hive.com

Date UQ / IDS / BL URL IP
2019-03-24 19:45:32 +0100
0 - 0 - 5 coin-hive.com/ 217.182.164.9
2019-03-11 00:01:25 +0100
0 - 0 - 5 coin-hive.com/ 217.182.164.9
2019-03-10 00:01:32 +0100
0 - 0 - 5 coin-hive.com/ 217.182.164.10
2019-03-07 03:53:09 +0100
0 - 0 - 5 coin-hive.com/ 217.182.164.9
2019-02-22 04:55:58 +0100
0 - 1 - 5 coin-hive.com/ 217.182.164.10
2019-02-19 00:01:47 +0100
0 - 1 - 5 coin-hive.com/ 217.182.164.9
2019-02-18 00:01:38 +0100
0 - 1 - 5 coin-hive.com/ 217.182.164.10
2019-02-16 06:56:52 +0100
1 - 1 - 2 https://coin-hive.com/lib/coinhive.min.js 217.182.164.10
2019-02-04 03:49:31 +0100
0 - 0 - 4 coin-hive.com/ 217.182.164.10
2019-01-31 00:01:30 +0100
0 - 1 - 5 coin-hive.com/ 217.182.164.10


JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (9)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.16
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Wed, 12 Dec 2018 11:54:23 GMT
Etag: B1CCAC7084F2CB50D8D0D8CEB574240815D1E2B1
X-OCSP-Responder-ID: (null)
Content-Length: 471
Cache-Control: public, no-transform, must-revalidate, max-age=293335
Expires: Wed, 19 Dec 2018 11:44:59 GMT
Date: Sun, 16 Dec 2018 02:16:04 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   471
Md5:    e052886b4bbcd79d3fe4f3b938c45916
Sha1:   b1ccac7084f2cb50d8d0d8ceb574240815d1e2b1
Sha256: 1ba28460407b238677497beb37acaab7dd9e1263500904c07fea5ed5fd64dff2
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.16
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Tue, 11 Dec 2018 14:14:26 GMT
Etag: A6EDA65C2973ECDDA323DB47E8D543C6D387F6FD
X-OCSP-Responder-ID: (null)
Content-Length: 727
Cache-Control: public, no-transform, must-revalidate, max-age=215281
Expires: Tue, 18 Dec 2018 14:04:05 GMT
Date: Sun, 16 Dec 2018 02:16:04 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   727
Md5:    b3127c7a1c3adc112c0a789326bf5d6d
Sha1:   a6eda65c2973ecdda323db47e8d543c6d387f6fd
Sha256: 5d84bdeca71be004451765f4cc433edcd5a30d705a997ac128d2db7fa4fbe32b
                                        
                                            POST / HTTP/1.1 
Host: ocsp.usertrust.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.19
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Tue, 11 Dec 2018 14:14:26 GMT
Etag: 888D5FC4B0835169497CCCBE3030E1E8D59FED77
X-OCSP-Responder-ID: (null)
Content-Length: 471
Cache-Control: public, no-transform, must-revalidate, max-age=215313
Expires: Tue, 18 Dec 2018 14:04:37 GMT
Date: Sun, 16 Dec 2018 02:16:04 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   471
Md5:    d55c7b89fc25a262f8272f9c2e169ba9
Sha1:   888d5fc4b0835169497cccbe3030e1e8d59fed77
Sha256: 7dab7f594b34e7483f7d4d6d8076140fda6696cb3c11b2cc432c23a6a4e4e75f
                                        
                                            GET /lib/coinhive.min.js HTTP/1.1 
Host: coin-hive.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         217.182.164.13
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: nginx
Date: Sun, 16 Dec 2018 02:16:04 GMT
Content-Length: 178
Connection: keep-alive
Location: https://coinhive.com/lib/coinhive.min.js


--- Additional Info ---
Magic:  HTML document text
Size:   178
Md5:    cd2e0e43980a00fb6a2742d3afd803b8
Sha1:   81ffbd1712afe8cdf138b570c0fc9934742c33c1
Sha256: bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

Alerts:
  urlquery:
    - Crypto currency mining script
  Blacklists:
    - fortinet: Malware
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca4.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.25
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Wed, 12 Dec 2018 13:21:30 GMT
Etag: C6B64C56F618599F3D712EE59FAB037859F776C4
X-OCSP-Responder-ID: (null)
Content-Length: 471
Cache-Control: public, no-transform, must-revalidate, max-age=298524
Expires: Wed, 19 Dec 2018 13:11:28 GMT
Date: Sun, 16 Dec 2018 02:16:04 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   471
Md5:    0ac182e9f196f7508899ec62ecee52d0
Sha1:   c6b64c56f618599f3d712ee59fab037859f776c4
Sha256: 46de7d7883760c7ae7e37ba9f30ffef99b1b72172dd35dc2f6cc13c9b45626c2
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca4.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.25
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Tue, 11 Dec 2018 14:14:26 GMT
Etag: A9FDB55703B7012768C8781B0C4BF5C81AD36AA4
X-OCSP-Responder-ID: (null)
Content-Length: 727
Cache-Control: public, no-transform, must-revalidate, max-age=215277
Expires: Tue, 18 Dec 2018 14:04:01 GMT
Date: Sun, 16 Dec 2018 02:16:04 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   727
Md5:    2dc644411e9b04988e6d3ee24732d667
Sha1:   a9fdb55703b7012768c8781b0c4bf5c81ad36aa4
Sha256: 597f8acf1da9ea3bddbff8479f504028762348e1f3db0963aef29527adc2f7b0
                                        
                                            GET /lib/coinhive.min.js HTTP/1.1 
Host: coinhive.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         104.20.208.59
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sun, 16 Dec 2018 02:16:04 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dcc156f7426debb0e58cbff59fad350011544926564; expires=Mon, 16-Dec-19 02:16:04 GMT; path=/; domain=.coinhive.com; HttpOnly
Last-Modified: Mon, 15 Oct 2018 11:57:18 GMT
Etag: W/"5bc4809e-423b4"
Expires: Sun, 16 Dec 2018 10:16:04 GMT
Cache-Control: public, max-age=28800
Access-Control-Allow-Origin: *
Content-Encoding: gzip
CF-Cache-Status: HIT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 489da553cd9e3d43-CPH


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   70162
Md5:    b6bb44f95a22a27e8b92d2ccbc591524
Sha1:   b5f4bf87301fb5291d70f392758d9c56ae374cc3
Sha256: e32b7829c99619bfa2c1de9e1ed9e9e515863b2d094e86c629c67c7350e8c96d

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: coinhive.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: __cfduid=dcc156f7426debb0e58cbff59fad350011544926564

                                         
                                         104.20.208.59
HTTP/1.1 404 Not Found
Content-Type: text/html;charset=UTF-8
                                        
Date: Sun, 16 Dec 2018 02:16:04 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: EXPIRED
Expires: Sun, 16 Dec 2018 06:16:04 GMT
Cache-Control: public, max-age=14400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 489da5555df13d43-CPH
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   739
Md5:    2e5399f1192d860bfffaa83a75485f09
Sha1:   d0c4fa85686d6bbce470dd61410ec9c9a91097ae
Sha256: 0efa969be400fa08937b0aa57dd794bd2b3662c9c2b57a46e8b0bed392969c16
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: coinhive.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: __cfduid=dcc156f7426debb0e58cbff59fad350011544926564

                                         
                                         104.20.208.59
HTTP/1.1 404 Not Found
Content-Type: text/html;charset=UTF-8
                                        
Date: Sun, 16 Dec 2018 02:16:07 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Expires: Sun, 16 Dec 2018 06:16:07 GMT
Cache-Control: public, max-age=14400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 489da5681b4a3d43-CPH
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   739
Md5:    2e5399f1192d860bfffaa83a75485f09
Sha1:   d0c4fa85686d6bbce470dd61410ec9c9a91097ae
Sha256: 0efa969be400fa08937b0aa57dd794bd2b3662c9c2b57a46e8b0bed392969c16