I found that one user is making connections to coin mining related domains. Is there any way to stop this activity, with respect to that user?

closed as unclear what you're asking by Steffen Ullrich, Jacco, Matthew, CaffeineAddiction, Serge Ballesta Oct 2 '17 at 9:26

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I assume by your tags that you are an analyst in a SOC and you saw in the proxy logs that someone's machine made connections to bitcoin mining related domains? – skooog Sep 29 '17 at 9:09

It depends on the context of these connections, but things that you could do are:

  1. Identify whether these connections related to someone just browsing about coin miners (e.g. with intention to install one) or are they made by the actual software/malware (which means that the user has it installed and running). If the user was just browsing the links but didn't install anything, this activity itself is not a threat;

  2. Take a look at the domains' categorization. Does it seem suitable? The names depend on the vendor you use, but if it's something like "Business", "Internet services" or no category then they are likely permitted even though they maybe shouldn't be permitted. In this case you should inform the vendor about the false category, they will recategorize the domains and next time these connections will be blocked. Possibly a local block for particular domains can be locally enforced, from your company's side if you report this activity;

  3. If it is determined that the user has a miner installed, uninstall it or reinstall the whole host (depends really on your company's policy how to act here).

There is a pretty broad spectrum of possible actions in this case, depending on the context, but these things above are the usual.


Sinkhole the domains.

Either at the DNS server level or in the user's hosts file, make it resolve to

Also, be advised: more and more sites (even legit ones, sadly) are running Javascript bitcoin miners at pageload. The big one that's making waves lately is coinhive, and it seems malware authors are also starting to incorporate it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.