The @shodanhq results show a similar distribution of service providers.
https://www.shodan.io/search?query=http.component%3A%22coinhive%22+product%3A%22MikroTik+http+proxy%22+country%3A%22US%22 …pic.twitter.com/XUB7ybKEkt
Show this thread
Over 4,000 compromised #MikroTik routers in the United States injecting Coinhive found on @censysio.
𝐓𝐎𝐏 𝟓 𝐒𝐄𝐑𝐕𝐈𝐂𝐄 𝐏𝐑𝐎𝐕𝐈𝐃𝐄𝐑𝐒
@CogentCo: 2,935
@Windstream: 442
Surfnet: 130
hiQ: 83
@CoxComm / @Charter: 66 (tie)
Source:
https://censys.io/ipv4?q=%28%28%22CoinHive.Anonymous%22%29+AND+%28MikroTik%29%29+AND+location.country_code%3A+US+AND+NOT+autonomous_system.description.raw%3A+%22FERNANDA+CRISTINA+RUIZ+MATIAZZO+-+ME%2C+BR%22 …pic.twitter.com/lVmaJ1bd4x
-
-
-
.
@zoomeye_team results show 2018-08-05 as earliest infection date in the US. https://www.zoomeye.org/searchResult?q=%20coinhive.anonymous%20%2Bcountry:%22US%22%20%2Bapp:%22MikroTik%20http%20proxy%22&t=all …pic.twitter.com/NJmKfj2KgP
Show this thread -
Some of the infected routers use a fake loading page to inject Coinhive. A small throttle is applied as not to consume all CPU resources of the target device.pic.twitter.com/2NZYIPckz9
Show this thread
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.