@OSINTDojo It previously had a miner injected on tcp/3001, using an iframe to display the real content. Taking the id from the coinhive embed and searching shodan for that reveals others including 180[.]245[.]209[.98] and 125[.]163[.]252[.]184 https://twitter.com/bentasker/status/1548938415449710593/photo/1