This talk will focus on the activity observed on compromised websites, malicious redirectors, traffic distribution systems, and its link to cryptomining. This method is starting to become the preferred choice to cash out, versus the traditional financial fraud/account takeover model. The talk will also step through an investigation of a malicious campaign and how to recognize the patterns that allow you to tie the nefarious behavior to these actors.