Network Communication With Crypto Mining Pool

Title: Network Communication With Crypto Mining Pool
Status: stable
Description:Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.
References:
  -https://www.poolwatch.io/coin/monero
  -https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt
  -https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-10-26
modified:2026-07-24
Tags:

• -'attack.impact'
• -'attack.t1496'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    DestinationHostname:
      -'aeon-pool.com'
      -'alimabi.cn'
      -'ap.luckpool.net'
      -'api.fastpool.xyz'
      -'auto.c3pool.org'
      -'awgoaigartnj-xmr.com'
      -'backup.fastpool.xyz'
      -'bcn.pool.minergate.com'
      -'bcn.vip.pool.minergate.com'
      -'bizxmr.cc'
      -'bmpool.org'
      -'bohemianpool.com'
      -'byw.dscloud.me'
      -'c3.wptask.cyou'
      -'c3pool.org'
      -'ca-aipg.miningocean.org'
      -'ca-dynex.miningocean.org'
      -'ca-neurai.miningocean.org'
      -'ca-qrl.miningocean.org'
      -'ca-upx.miningocean.org'
      -'ca-zephyr.miningocean.org'
      -'ca.minexmr.com'
      -'ca.monero.herominers.com'
      -'cbd.monerpool.org'
      -'cbdv2.monerpool.org'
      -'community-pools.mysrv.cloud'
      -'covid19crypto.com'
      -'cryptmonero.com'
      -'crypto-pool.fr'
      -'crypto-pool.info'
      -'cryptominded.com'
      -'cryptonight-hub.miningpoolhub.com'
      -'d1pool.ddns.net'
      -'d5pool.us'
      -'daili01.monerpool.org'
      -'de-aipg.miningocean.org'
      -'de-dynex.miningocean.org'
      -'de-zephyr.miningocean.org'
      -'de.minexmr.com'
      -'de.moneroocean.stream'
      -'de.salvium.herominers.com'
      -'de.zephyr.herominers.com'
      -'dl.nbminer.com'
      -'donate.graef.in'
      -'donate.ssl.xmrig.com'
      -'donate.v2.xmrig.com'
      -'donate.xmrig.com'
      -'donate2.graef.in'
      -'drill.moneroworld.com'
      -'dwarfpool.com'
      -'emercoin.com'
      -'emercoin.net'
      -'emergate.net'
      -'ethereumpool.co'
      -'eu.luckpool.net'
      -'eu.minerpool.pw'
      -'f2pool.com'
      -'fastpool.xyz'
      -'fcn-xmr.pool.minergate.com'
      -'fee.xmrig.com'
      -'fi.moneroocean.stream'
      -'fr-aipg.miningocean.org'
      -'fr-dynex.miningocean.org'
      -'fr-neurai.miningocean.org'
      -'fr-qrl.miningocean.org'
      -'fr-tarirx.luckypool.io'
      -'fr-upx.miningocean.org'
      -'fr-zephyr.miningocean.org'
      -'fr.minexmr.com'
      -'fr.moneroocean.stream'
      -'friendspool.club'
      -'ftp.fastpool.xyz'
      -'gandalph3000.com'
      -'googleminer.com'
      -'grin.2miners.com'
      -'gulf.moneroocean.stream'
      -'hellominer.com'
      -'herominers.com'
      -'hk-aipg.miningocean.org'
      -'hk-dynex.miningocean.org'
      -'hk-neurai.miningocean.org'
      -'hk-qrl.miningocean.org'
      -'hk-upx.miningocean.org'
      -'hk-zephyr.miningocean.org'
      -'hns.f2pool.com'
      -'huadong1-aeon.ppxxmr.com'
      -'imap.fastpool.xyz'
      -'iwanttoearn.money'
      -'joulecoin.org'
      -'jp.moneroocean.stream'
      -'jw-js1.ppxxmr.com'
      -'koto-pool.work'
      -'kronecoin.org'
      -'kryptex.network'
      -'kubo.ultra-pool.com'
      -'lhr.nbminer.com'
      -'lhr3.nbminer.com'
      -'linux.monerpool.org'
      -'litecoinpool.org'
      -'lokiturtle.herominers.com'
      -'luckpool.net'
      -'luckypool.io'
      -'mail.fastpool.xyz'
      -'masari.miner.rocks'
      -'mine.aeon-pool.com'
      -'mine.bmpool.org'
      -'mine.c3pool.com'
      -'mine.fastpool.xyz'
      -'mine.lesliejust.is'
      -'mine.moneropool.com'
      -'mine.ppxxmr.com'
      -'mine.zpool.ca'
      -'mine1.ppxxmr.com'
      -'minemonero.gq'
      -'miner.ppxxmr.com'
      -'miner.rocks'
      -'minercircle.com'
      -'minergate.com'
      -'minerpool.pw'
      -'minerrocks.com'
      -'miners.pro'
      -'minerxmr.ru'
      -'minexmr.cn'
      -'minexmr.com'
      -'mining-help.ru'
      -'mining.bittubeapp.com'
      -'miningocean.org'
      -'miningpoolhub.com'
      -'miningrigrentals.com'
      -'mixpools.org'
      -'moner.monerpool.org'
      -'moner1min.monerpool.org'
      -'monero-master.crypto-pool.fr'
      -'monero.crypto-pool.fr'
      -'monero.hashvault.pro'
      -'monero.herominers.com'
      -'monero.lindon-pool.win'
      -'monero.miners.pro'
      -'monero.riefly.id'
      -'monero.us.to'
      -'monerocean.stream'
      -'monerogb.com'
      -'monerohash.com'
      -'moneroocean.stream'
      -'monerooceans.stream'
      -'moneropool.com'
      -'moneropool.nl'
      -'monerorx.com'
      -'monerpool.org'
      -'moriaxmr.com'
      -'mro.pool.minergate.com'
      -'multipool.us'
      -'myxmr.pw'
      -'na.luckpool.net'
      -'nanopool.org'
      -'nbminer.com'
      -'node.btx.tools'
      -'node3.luckpool.net'
      -'noobxmr.com'
      -'p06.2miners.com'
      -'pangolinminer.com'
      -'pool-de.supportxmr.com'
      -'pool-fr.supportxmr.com'
      -'pool-nyc.supportxmr.com'
      -'pool-phx.supportxmr.com'
      -'pool.4i7i.com'
      -'pool.armornetwork.org'
      -'pool.awgoaigartnj-xmr.com'
      -'pool.cortins.tk'
      -'pool.gntl.co.uk'
      -'pool.hashvault.pro'
      -'pool.minergate.com'
      -'pool.minexmr.com'
      -'pool.minexmr.uk'
      -'pool.monero.hashvault.pro'
      -'pool.ppxxmr.com'
      -'pool.somec.cc'
      -'pool.support'
      -'pool.supportxmr.com'
      -'pool.usa-138.com'
      -'pool.xmr.pt'
      -'pool.xmrfast.com'
      -'pool2.armornetwork.org'
      -'poolchange.ppxxmr.com'
      -'pooldd.com'
      -'poolmining.org'
      -'poolto.be'
      -'pop.fastpool.xyz'
      -'ppxvip1.ppxxmr.com'
      -'ppxxmr.com'
      -'prohash.net'
      -'r.twotouchauthentication.online'
      -'randomx.xmrig.com'
      -'ratchetmining.com'
      -'rx.unmineable.com'
      -'salvium.herominers.com'
      -'seed.emercoin.com'
      -'seed.emercoin.net'
      -'seed.emergate.net'
      -'seed.kronecoin.org'
      -'seed.titcoinpool.com'
      -'seed.titcoins.info'
      -'seed1.joulecoin.org'
      -'seed2.joulecoin.org'
      -'seed3.joulecoin.org'
      -'seed4.joulecoin.org'
      -'seed5.joulecoin.org'
      -'seed6.joulecoin.org'
      -'seed7.joulecoin.org'
      -'seed8.joulecoin.org'
      -'sg-aipg.miningocean.org'
      -'sg-dynex.miningocean.org'
      -'sg-neurai.miningocean.org'
      -'sg-qrl.miningocean.org'
      -'sg-upx.miningocean.org'
      -'sg-zephyr.miningocean.org'
      -'sg.minexmr.com'
      -'sheepman.mine.bz'
      -'siamining.com'
      -'smtp.fastpool.xyz'
      -'solarray.club'
      -'solo-grin.2miners.com'
      -'solo-grin.2miners.ru'
      -'solo-xmr.2miners.com'
      -'solo-xmr.2miners.ru'
      -'soloxmr2min.dyndns.org'
      -'sparechange.io'
      -'ssl.fastpool.xyz'
      -'sumokoin.minerrocks.com'
      -'supportxmr.com'
      -'suprnova.cc'
      -'system-check.services'
      -'system-update.info'
      -'teracycle.net'
      -'titcoinpool.com'
      -'titcoins.info'
      -'tpool.yiluzhuanqian.com'
      -'trtl.cnpool.cc'
      -'trtl.pool.mine2gether.com'
      -'turtle.miner.rocks'
      -'ultra-pool.com'
      -'unmineable.com'
      -'us-aipg.miningocean.org'
      -'us-dynex.miningocean.org'
      -'us-grin.2miners.com'
      -'us-neurai.miningocean.org'
      -'us-west.minexmr.com'
      -'us-zephyr.miningocean.org'
      -'usxmrpool.com'
      -'viaxmr.com'
      -'web.xmrpool.eu'
      -'webservicepag.webhop.net'
      -'winxmr.club'
      -'x109.node.btx.tools'
      -'xcn1.yiluzhuanqian.com'
      -'xiazai.monerpool.org'
      -'xiazai1.monerpool.org'
      -'xmc.pool.minergate.com'
      -'xmo.pool.minergate.com'
      -'xmr-asia1.nanopool.org'
      -'xmr-au1.nanopool.org'
      -'xmr-eu1.nanopool.org'
      -'xmr-eu2.nanopool.org'
      -'xmr-jp1.nanopool.org'
      -'xmr-us-east1.nanopool.org'
      -'xmr-us-west1.nanopool.org'
      -'xmr-us.suprnova.cc'
      -'xmr-usa.dwarfpool.com'
      -'xmr.2miners.com'
      -'xmr.5b6b7b.ru'
      -'xmr.748pz.net'
      -'xmr.alimabi.cn'
      -'xmr.bepooh.com'
      -'xmr.bohemianpool.com'
      -'xmr.crypto-pool.fr'
      -'xmr.crypto-pool.info'
      -'xmr.f2pool.com'
      -'xmr.hashcity.org'
      -'xmr.hex7e4.ru'
      -'xmr.ip28.net'
      -'xmr.kryptex.network'
      -'xmr.monerpool.org'
      -'xmr.mypool.online'
      -'xmr.nanopool.org'
      -'xmr.pool.gntl.co.uk'
      -'xmr.pool.minergate.com'
      -'xmr.poolto.be'
      -'xmr.ppxxmr.com'
      -'xmr.prohash.net'
      -'xmr.simka.pw'
      -'xmr.somec.cc'
      -'xmr.suprnova.cc'
      -'xmr.usa-138.com'
      -'xmr.vip.pool.minergate.com'
      -'xmr.yiluzhuanqian.com'
      -'xmr1min.monerpool.org'
      -'xmrf.520fjh.org'
      -'xmrf.fjhan.club'
      -'xmrfast.com'
      -'xmrigcc.graef.in'
      -'xmrminer.cc'
      -'xmrpool.de'
      -'xmrpool.eu'
      -'xmrpool.me'
      -'xmrpool.net'
      -'xmrpool.xyz'
      -'xx11m.monerpool.org'
      -'xx11mv2.monerpool.org'
      -'xxx.hex7e4.ru'
      -'yes.fastpool.xyz'
      -'zarabotaibitok.ru'
      -'zeph-eu2.nanopool.org'
      -'zeph.2miners.com'
      -'zephyr.herominers.com'
      -'zer0day.ru'

  condition:selection
Falsepositives:
  -Unlikely
Level: high