I recently wrote a simple scanner that goes through a list of websites, accesses them with a headless browser and measures the CPU performance on the browser's process. It's fairly good at identifying obvious miners, but false positives are abound. It's available here: https://github.com/wrinkl3/MineSweepR

Any idea what metrics could be added for miner detection? I briefly considered proxying the browser's requests against a domain blacklist, but then you'd just end up with a more elaborate version of NoMine.