# xway_ir IOC — Cryptominer Family (sub: miners)
# Source: curated from https://github.com/stamparm/maltrail (MIT)
# One IOC per line, # comments, blank lines ignored
# Used by: xway_ir.sh check_miner_cfg / check_process_miner

# --- miner pool domains ---
pool.minexmr.com
xmr.pool.to
moneroocean.stream
c3pool.org
hashvault.pro
nanopool.org
minexmr.com
pool.supportxmr.com
xmr.crypto-pool.fr
pool.tritonmining.com
asia1.ethpool.org
us-east.cryptonight-hub.miningpoolhub.com
zergpool.com
coinmine.pl
zpool.ca
hashcity.org
miningpoolhub.com
blockmasters.co
monero.crypto-pool.fr
aeon-pool.com
aeon.miningpoolhub.com
bcn.pool.com
dedi.pooldash.org
yiimp.ccminer.org
pool.coinlab.biz
pool.gemlab.biz
miningrigrentals.com
moriaxmr.com
xmr.nanopool.org
pool.electroneum.com
fairpool.cloud
wemineblocks.com

# --- miner domain keywords (substring match) ---
pool.min
.minexmr.
.moneroocean.
.c3pool.
.hashvault.
.nanopool.
.miningrigrentals.
.f2pool.
.antpool.
.btc.com
.pool.bitcoin.
.poolin.com
.viabtc.com
.btc.top
.slushpool.com
.litecoinpool.org
.p2pool.com
.ethpool.org
.ethermine.org
.sparkpool.com
.f2pool.com
.miningpoolhub.

# --- miner process / binary names ---
xmrig
minerd
cpuminer
cpuminer-multi
cpuminer-opt
minergate
nicehash
c3pool
stratum
stratum+tcp
stratum+ssl
cryptonight
cryptonote
monero
ksoftirqds
kthreaddk
.kswapd0
.nginx-x
kdevtmpfsi
kingminer
monero-miner
monero-miner-de
silentminer
webminer
coinminer
minerd
rsyncminer

# --- miner config patterns ---
"wallet-address"
"wallet-address":
"pool-url"
"stratum-url"
"crypto-algorithm"
"hash-algorithm"
"mining-pool"
"wallet-file"
"cpu-priority"
"randomx"
"cn/r"
"ghostrider"
argon2
"nicehash-stratum"
"xmrig-proxy"
"donate-level"
"keepalive"
"self-select"