Cryptomining Domains List: Block Mining Pools and Cryptojacking
Unwanted cryptocurrency mining burns electricity, slows devices and runs up cloud bills. On a company network it is also one of the clearest signs that something has been compromised.
A cryptomining domains list stops devices from reaching the pools and script hosts that miners depend on, and turns every attempt into an alert you can act on.
Browser cryptojacking
A script on a web page mines while the tab is open. It needs a script host and a pool to report to.
Mining malware
A hidden program on a computer, server or container mines around the clock and connects to a pool.
What is in the cryptomining domains list
Mining domains sit in two of the 59 categories: Cryptocurrency for mining services and pools, and Malware / Phishing / Suspicious for cryptojacking and abuse. The cryptomining list is the mining-related part of both.
Mining pools
Pool websites and the hostnames miners connect to. Every miner has to reach one to be paid, which makes pools the best place to cut it off.
Browser miner hosts
Domains that serve in-browser mining scripts, including copies hosted under new names.
Miner downloads
Sites distributing mining software, often bundled with tools that hide the miner from users.
Mining proxies
Relays that forward miner traffic to pools, used to hide the real pool or get past filters.
Cloud mining services
Sites selling hosted mining contracts, a space where many offers are scams.
Mining dashboards
Pool account pages and mining management panels that show hashrate and payouts.
The category page covers the topic from the data side: see cryptomining domain filtering. As on every list page, we name no mining or cryptojacking domains here.
Mining list versus crypto exchange list
People often mix these up. They answer different questions, and most networks that block mining leave exchanges alone.
| Question | Cryptomining list | Crypto exchanges and wallets |
|---|---|---|
| What it stops | Devices mining for someone, with or without permission | People trading or holding cryptocurrency |
| Main risk | Compromise, power use, cloud bills, worn hardware | Fraud, policy, regulated trading at work |
| Who blocks it | Almost every company, school and MSP | Banks, schools and some regulated firms |
| Security signal | Strong; a hit from a server is an incident | Weak; usually a policy matter |
| Guide | This page | Block crypto exchanges |
Signs that mining is already happening
Mining wants as much processing power as it can get. That makes it noisy, if you know where to look.
High CPU or GPU
Sustained high load on idle machines, often from a process with an ordinary-looking name.
Heat and fans
Laptops running hot and loud while users report doing very little on them.
Cloud bills
Sudden compute spend in a cloud account, often in a region your team has never used before.
DNS lookups
Repeated lookups of pool hostnames in resolver logs, often at regular intervals around the clock. This is the signal the list is built to catch.
With the list loaded in log mode for a few days, resolver logs give you a ready-made inventory of every device that has tried to reach a mining pool.
Why unwanted mining is a business problem
Mining rarely steals data directly, so it is easy to rank it low. The costs add up in places that are slow to notice.
Power
Machines that should idle run at full load day and night, and the electricity bill shows it.
Hardware wear
Constant heat shortens the life of laptops, graphics cards and server components.
Cloud spend
Attackers who reach a cloud account start large instances, and the owner pays for them.
An open door
Whoever installed the miner can usually install something worse through the same gap.
How miners get in, and where the list helps
The domain list does not stop the break-in itself. It stops the miner from working and tells you which device to look at, whichever route was used.
| Entry route | Example | What the list does | What fixes the root cause |
|---|---|---|---|
| Unpatched internet services | An exposed admin panel or outdated app server | Blocks the pool and raises an alert | Patching and reducing exposed services |
| Leaked cloud credentials | Keys pushed to a public code repository | Blocks pool lookups from cloud resolvers you control | Key rotation and billing alerts |
| Bundled software | Unofficial installers and cracked tools | Blocks the miner's pool and download host | Software install controls |
| Browser extensions | A useful-looking extension with a hidden miner | Blocks the script host and pool | Extension allow lists on managed browsers |
| Compromised websites | A site with an injected mining script | Blocks the script host while users browse | The site owner's clean-up |
| Insiders | A user running a miner on work hardware | Blocks the pool and logs the device | Acceptable use policy and HR process |
How big the list is and how it stays current
The mining list is small next to content categories like Adult or Shopping. What it lacks in size it makes up for in churn, as script hosts and proxies move to new names.
Every day: new domains
About 300,000 newly registered domains are categorized daily, and new mining hosts arrive in the delta files.
After a week: first recheck
Each new domain is checked again, which catches hosts that sit empty before being put to use.
After a month: second recheck
A further check catches names that changed purpose after launch.
Every month: full refresh
All other domains are refreshed, so retired pools and dead script hosts drop out over time.
Exact counts move every day and are shared with licence holders. The full list is small enough to load on almost any resolver or firewall, including branch office devices.
Because the list is compact, there is rarely a reason to trim it. Load the full set everywhere, including small routers in branch offices and labs, so no segment is left as the easy place for a miner to run.
Formats for a mining pool blocklist
Licensed customers receive the source files and enforcement exports. Every format is explained in the blocklist formats guide.
Which format where
- DNS RPZ on resolvers, with a sinkhole address so every hit is logged with the client
- Firewall EDL so rules update without a change window
- Hosts and adblock style for small DNS boxes in branches and labs
- CSV, Parquet and JSON for SIEM enrichment and security products
- Lookup API for checking a domain from an alert or ticket
Examples use reserved .test names and a documentation address.
How to deploy the cryptomining list
A mining block works best in layers, because miners that fail at DNS often try other routes. Each layer below is simple on its own.
Network layers
- Load the list on the resolver every device uses, with a sinkhole for logging
- Force DNS through that resolver and block outside DNS servers
- Load the same list as an EDL on the firewall
- Restrict outbound connections from servers to the ports they actually need; mining protocols commonly use high ports such as 3333
- Block the VPN and proxy domains list so miners cannot tunnel out
Response layers
- Send resolver and firewall hits to the SIEM
- Alert on any hit from a server, container host or cloud workload
- Alert on repeated hits from one workstation
- Check browser extensions on devices with browser miner hits
- Review cloud accounts for unknown instances when hits come from the cloud
Server hits are incidents. A web server or database has no reason to contact a mining pool. Isolate it, find the process, and look for how it got in, often an unpatched service or leaked credentials.
For the broader security stack, see threat intelligence integration and pair this list with the malware and phishing domain list.
What a mining domain list cannot see
Be clear about the limits so the list is one layer in a plan, not the whole plan. These gaps need other controls.
Direct IP connections
A miner set up with a pool's IP address skips DNS entirely. Egress rules on servers close most of this gap.
Tunnelled traffic
Miners routed through a VPN or Tor hide the pool. The VPN and proxy list and Tor controls help here.
Off-network devices
A laptop on home Wi-Fi uses another resolver. Device agents or a cloud resolver extend the list there.
Private pools
An attacker's own pool on a fresh domain has no history yet. Blocking newly registered domains on servers narrows this.
Cloud resolvers you do not run
Workloads using a provider's default resolver need the list loaded there, or cloud firewall rules.
The break-in itself
The list stops the payoff, not the entry. Patching, credentials hygiene and endpoint protection do that job.
See how to block Tor and how to block newly registered domains for the two most useful companion controls.
Where a cryptomining block matters most
Mining shows up wherever there is spare power and weak oversight. These environments see it most and benefit most from the list.
| Environment | Typical source | What the list does | Extra step |
|---|---|---|---|
| Cloud and container hosts | Exposed services and leaked keys | Stops pool connections and flags the host | Billing alerts and key rotation |
| Office workstations | Bundled software and browser scripts | Blocks script hosts and pools | Software install controls |
| Schools and universities | Students running miners on lab machines | Keeps lab power for teaching | Lab images reset at logoff |
| Hospitals and factories | Infected unmanaged devices | Flags devices you cannot scan | Network segmentation |
| ISP and hosting networks | Compromised customer machines | Optional protection tier | Abuse desk notification |
| MSP client fleets | Any of the above | Baseline for every tenant | Monthly report of hits |
MSPs often include this list in every client baseline; see MSP web filtering. For campuses, see higher education web filtering.
Testing the mining block and keeping it healthy
Because legitimate traffic rarely touches mining domains, this list is easy to test and easy to forget. A short routine keeps it working.
At rollout
- Add a placeholder test name to a staging copy and query it from a workstation and a server
- Confirm the sinkhole answers and the hit reaches the SIEM with the client address
- Confirm the alert rule fires for the server segment
- Check that outbound DNS to outside resolvers is refused
Every month
- Review all hits, grouped by device and network segment
- Follow up every server or cloud hit to a closed ticket
- Confirm the daily update job ran every day
- Check the allow list still matches approved research work
Rolling the list out across an MSP fleet
For MSPs the mining list is an easy win: it rarely blocks anything a client needs, and every hit is a finding worth reporting.
Week 1: log only, all tenants
Load the list in log mode everywhere and collect a baseline of hits per client.
Week 2: follow up the baseline
Clean up the devices the baseline found, then switch the list to block for every tenant.
Ongoing: alert and report
Raise a ticket for any server hit and include blocked mining attempts in each client's monthly report.
Exceptions: per tenant, documented
Allow rules only for named research or finance needs, recorded in the client's policy file.
For security product makers
Endpoint agents, DNS services, gateways and MSP platforms all benefit from a maintained mining list, and customers now expect a cryptomining toggle by default.
Ship it as a toggle
One category switch in your policy screen, on by default for business plans.
Update it daily
Load the daily delta files into your cloud service or push them to agents.
License it once
An OEM licence covers embedding the data in your product; group licences cover several products.
False positives and legitimate mining
Mining is not illegal in itself, and a small number of users have a genuine reason to reach these domains. Plan for them so the block stays credible.
Research labs
Blockchain research groups may run approved experiments. Give their segment a documented allow rule.
Crypto news
News and education about cryptocurrency stay in News/Media or Education/Reference, not in the mining list.
Finance teams
Analysts researching mining companies read investor sites, which sit in Financial Services or Business.
Hardware retail
Shops that sell graphics cards and mining rigs are in Shopping, not in the mining list.
Report it
If a domain has nothing to do with mining, allow it locally and report it for review.
Cryptomining domains list FAQ
What is a cryptomining domains list?
It is a list of domains used for cryptocurrency mining: mining pool sites and their connection endpoints, browser mining script hosts, mining software download sites and mining services. Blocking them stops devices from joining a pool or running a hidden miner.
What is cryptojacking?
Cryptojacking is mining cryptocurrency on someone else's device or cloud account without permission. It happens through hidden scripts in web pages or through malware installed on computers and servers.
Is a DNS block enough to stop mining malware?
It stops miners that look up pools by name, which is most of them. Some miners connect straight to IP addresses or through proxies, so pair the domain list with firewall egress rules and endpoint protection.
Does blocking mining domains block cryptocurrency exchanges?
No. Exchanges and wallets are a separate decision. The mining list targets pools, miners and mining services, while exchanges are covered under the Cryptocurrency category if you choose to block them.
What does it mean if a server tries to reach a mining pool?
It is a strong sign of compromise. Servers have almost no legitimate reason to contact a mining pool, so treat the hit as an incident: isolate the server, find the process and check how it got in.
Which formats is the cryptomining list available in?
Licensed customers receive CSV, Parquet and JSON source files and can receive DNS RPZ, hosts, adblock style, firewall external dynamic list and PAC exports.
Do universities and research labs need exceptions?
Sometimes. Blockchain research groups may run approved mining experiments. Give their lab segment a documented allow rule and keep the block everywhere else.
Can the list run on networks without internet access?
Yes. The data is delivered as files that run inside your own systems, so on-premise and air-gapped deployments are possible. Updates are copied in on your own schedule.
Why are no mining pool domains named on this page?
Listing pool and cryptojacking domains on a public page would help people looking for them more than people blocking them. Licensed customers receive the full list as files.
How much does a cryptomining domain list cost?
Mining domains come with the categorized database licence. Starter database tiers start from $999; enterprise and OEM licences are quoted per deployment.
Catch miners before the bill arrives
License the categorized database with mining, security and 59 web filtering categories, daily new-domain deltas and exports for resolvers, firewalls and SIEMs.