[
  {
    "id": 323665890,
    "indicator": "xmrig.com",
    "type": "domain",
    "created": "2026-05-11T14:36:07",
    "content": "",
    "title": "",
    "description": "XMRig miner delivery (cryptomining malware)",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 886636527,
    "indicator": "nicehash.com",
    "type": "domain",
    "created": "2026-05-11T14:36:07",
    "content": "",
    "title": "",
    "description": "NiceHash mining pool endpoint used by malware",
    "expiration": null,
    "is_active": 1
  }
]