This paper provides study of behaviour on a drive-by crypto-jacking, specifically Coinhive’s Monero. Crypto-jacking is a form of cyber threat where a host machine’s processing power hijacked thru infected website to solve cryptographic puzzles as an unwitting participant. The sample study share host machine and network behaviours when host visited websites that have been embedded with Coinhive’s Monero related script. These data collection of behaviour can be utilize to identify and detect Coinhive’s Monero mining activities in networks.