Mining for Better Threat Intelligence: Cryptominer Pools

ReliaQuest describes an automated methodology to detect cryptomining (cryptojacking) by enumerating active mining pools, extracting pool server domains and subdomains (using web scraping and subdomain enumeration tools), and resolving those to IPs to produce a high-confidence threat intelligence feed that can be integrated into network and endpoint controls; the report also notes challenges such as pools using nonstandard ports and SSL to evade detection and explains how GreyMatter curates and delivers these IOCs.