Newegg crypto-mining?

[lexluthermiester]

Was going to look for something on Newegg and was greeted with this crap;

What the actual eff? Newegg is a retail site that makes money from sales. Why do they suddenly feel the need to cryptomine in the sly? Shady Newegg, very shady.

PS to mods; Couldn't decide were to put this thread, this seemed like the best place. If there's a better location please let me know.

 

[Old-Greg]

Sneaky SOB's. It's like a neighbor stealing your Electricity.

 

[lexluthermiester]

Sneaky SOB's. It's like a neighbor stealing your Electricity.

Or your internet over wifi.

 

[Robert Bourgoin]

Another reason not to use them.

 

[lexluthermiester]

Another reason not to use them.

I would say it's a reason to give them the virtual smack down..

 

[DeathtoGnomes]

Cant say I am surprised, they are owned by China.

 

[remixedcat]

Ever since the fake GPU and CPU thing I've been weary of them. I only have bought a couple cheap wifi adapters lately and a 100 dollar dell latitude, but that dell is going to be the last thing I ever get if they keep up this shit.

 

[DRDNA]

Was going to look for something on Newegg and was greeted with this crap;

What the actual eff? Newegg is a retail site that makes money from sales. Why do they suddenly feel the need to cryptomine in the sly? Shady Newegg, very shady.

PS to mods; Could decide were to put this thread, this seemed like the best place. If there's a better location please let me know.

what app are you using for that detection? NoCoin app doesnt show newegg as having a miner...confused...

 

[dj-electric]

Yeah. What addon is this?

 

[Vario]

Would like to know as well please share.

 

[R-T-B]

I would say it's a reason to give them the virtual smack down..

I mean, they’ve been hosting third party ads on their site for literally months. They had fake “flash update” ads slip through a partner ad recently that they removed.

This is likely the same, advertising abuse. That said, why they feel the need to advertise on a site that is already selling you shit is beyond me...

 

[Static~Charge]

what app are you using for that detection? NoCoin app doesnt show newegg as having a miner...confused...

Yeah. What addon is this?

I'm using Mining Blocker 0.53, and it doesn't like the b-s that Newegg is up to.

 

[lexluthermiester]

what app are you using for that detection? NoCoin app doesnt show newegg as having a miner...confused...

Yeah. What addon is this?

Would like to know as well please share.

Literally called "Mining Blocker" for Firefox.

I'm using Mining Blocker 0.53, and it doesn't like the b-s that Newegg is up to.

And that is the current version.

 

[Keullo-e]

This made me finally also install a mining blocker.

 

[lexluthermiester]

Ever since the fake GPU and CPU thing I've been weary of them. I only have bought a couple cheap wifi adapters lately and a 100 dollar dell latitude, but that dell is going to be the last thing I ever get if they keep up this shit.

To be fair, it's still a good place to get stuff, you just have to be careful what you click on.

 

[remixedcat]

To be fair, it's still a good place to get stuff, you just have to be careful what you click on.

Yeah I gotta pay a lot of attention to the "sold by whatever" thing. Still out of principal it's greasy tho...

 

[Ryandh]

this is false positive. I can see the same miner running on my machine. the miner called "moneta"

the plugin "miner blocker" is very simple, it search all script by the naming.
Newegg used https://www.monetate.com/ to do tagging mgmt. which contains moneta, then it triggered the mining alarm.

var searchListContent = ['miner',

'c-hive',
'moneta',
'hasCrypto',
'hashunited'];

searchListURLS.forEach(function (searchFor){
if (no.matches('script') && no.src.toUpperCase().includes(searchFor.toUpperCase())) {
no.src = "";
scriptsRemove++;
console.log("Found mining: "+ searchFor);

 

[lexluthermiester]

this is false positive.

Not false positive. To test I disabled the plugin and reloaded the page, and magically Firefox was suddenly using 80% of my CPU time. Newegg was the only page open. Closing the browser stopped the CPU usage. Opening it back up and going to Google.com and nothing happens. Going back to Newegg, BAM! 80% CPU usage again. Explain that if it's not mining? Anyone can try this, though, you know, at your own risk.

 

[jboydgolfer]

I want to run a performance monitor during a visit to the website and see exactly what % of my pc's hp they're using without my knowledge

i dont see any performance being used......im not doubting the claim, but im having trouble recreating it...

ill tell you , as a person who used to make thousands of $'s worth of purchases each year from NE, they are easily one of the top 3 "must avoid" etailers online today , atleast for tech gear. they have time and time again, let me down for a variety of reasons, most recently, it took nearly 2 &1/2 mopnths to get a refund , from approval, to me getting the funds back!!! this was not just me making the claim, and waiting either, i spent around 5 hours on the phone, and around 3 or so in live chat, trying over & over again to explain the situation to a new support person.....they dont care about you as a consumer, they just want your $$. only for them to ignore their own terms, and refudn me in ways i didnt pay for the item ( i used my debit card, they sent me a f@ckin check!) i dont know if its due to them being bought out, or what, but it DID dstart right around the time that their sale was announced.

 

[Ryandh]

Not false positive. To test I disabled the plugin and reloaded the page, and magically Firefox was suddenly using 80% of my CPU time. Newegg was the only page open. Closing the browser stopped the CPU usage. Opening it back up and going to Google.com and nothing happens. Going back to Newegg, BAM! 80% CPU usage again. Explain that if it's not mining? Anyone can try this, though, you know, at your own risk.

It is false positive in this case. Customers using monatete will get the same warnning , Jcrew/Northface all got this false positive warring

 

[R-T-B]

Not false positive. To test I disabled the plugin and reloaded the page, and magically Firefox was suddenly using 80% of my CPU time. Newegg was the only page open. Closing the browser stopped the CPU usage. Opening it back up and going to Google.com and nothing happens. Going back to Newegg, BAM! 80% CPU usage again. Explain that if it's not mining? Anyone can try this, though, you know, at your own risk.

Can't really say I am seeing the same here on an unprotected browser. What's the machine?

 

[95Viper]

For anyone's curiosity...
If you wish to test your browser you can go to:

Opera Cryptojacking Test works to test any browser. Looks like they use a coinhive miner to test.
Quote from urlscan.io about above site:

This website contacted 7 IPs in 3 countries across 8 domains to perform 35 HTTP transactions. Of those, 28 were HTTPS (80 %) and 67% were IPv6.
The main IP is 54.230.93.176, located in Seattle, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is cryptojackingtest.com. It took 0.628 seconds to load this page.

Mineblock, also, has a test on their site... it is an add-on. You can try that one if you wish... I did and it said my browser (Edge) block the miner. Looks like they, also, use a coinhive miner to test.
Quote from Mineblock:

MINEBLOCK is the only way to block the crypto mining scripts and web miners that are currently taking over the internet. The miners run cryptocurrency algorithm using your CPU, your electricity and thus your money so they can hash coins and earn crypto cash without your knowledge!

Quote from urlscan.io about Mineblock:

This website contacted 2 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. Of those, 9 were HTTPS (90 %) and 100% were IPv6.
The main IP is 2400:cb00:2048:1::6818:7208, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is mineblock.org. It took 0.955 seconds to load this page.

If you wish to test a website you can go here, Who is Mining?, and enter the site address and see the result.
Quote from urlscan.io on the site who is Mining?:

This website contacted 4 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. Of those, 4 were HTTPS (80 %) and 75% were IPv6.
The main IP is 34.215.3.167, located in Boardman, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is whoismining.com. It took 0.507 seconds to load this page.

It seems the Opera Crytojacking Test and Who is mining are owned by, maybe, Amazon.com, Inc., US

I tried Newegg and NeweggBusiness, both, and they came up clean... TPU came up clean, too.

 

[lexluthermiester]

It is false positive in this case. Customers using monatete will get the same warnning , Jcrew/Northface all got this false positive warring

FYI, I'm not a moron and know what I was witnessing. Just tried both of those sites and nothing. The plugin literally shows, "Nothing Found", but Newegg is also now showing the same and no unusual CPU usage.

Can't really say I am seeing the same here on an unprotected browser. What's the machine?

I'll bet any amount of money they got caught by more than one watchful person and yanked it down. Wouldn't be surprising at all.

 

[Ryandh]

FYI, I'm not a moron and know what I was witnessing. Just tried both of those sites and nothing. The plugin literally shows, "Nothing Found", but Newegg is also now showing the same and no unusual CPU usage.

I'll bet any amount of money they got caught by more than one watchful person and yanked it down. Wouldn't be surprising at all.

there is no magic for the plugin, it';s just keyword matching. could you send me the plugin [ link and version] that you are using? I am a programmer, I can explain the why.

 

[lexluthermiester]

there is no magic for the plugin, it';s just keyword matching. could you send me the plugin [ link and version] that you are using? I am a programmer, I can explain the why.

Ok, Install Firefox, look up "Mining Blocker" in the "Add-ons" section, install. You should be able to find the plugin itself in the Mozilla folder inside the "Roaming" folder under the user profile directory.

Given the somewhat iffy activities Newegg has been involved in, it would not be surprising at all to find out they were testing something new to see if anyone would notice.