def rule(event):
    if any(
        [
            "pool.minexmr.com" in event.deep_get("query", default=""),
            "fr.minexmr.com" in event.deep_get("query", default=""),
            "de.minexmr.com" in event.deep_get("query", default=""),
            "sg.minexmr.com" in event.deep_get("query", default=""),
            "ca.minexmr.com" in event.deep_get("query", default=""),
            "us-west.minexmr.com" in event.deep_get("query", default=""),
            "pool.supportxmr.com" in event.deep_get("query", default=""),
            "mine.c3pool.com" in event.deep_get("query", default=""),
            "xmr-eu1.nanopool.org" in event.deep_get("query", default=""),
            "xmr-eu2.nanopool.org" in event.deep_get("query", default=""),
            "xmr-us-east1.nanopool.org" in event.deep_get("query", default=""),
            "xmr-us-west1.nanopool.org" in event.deep_get("query", default=""),
            "xmr-asia1.nanopool.org" in event.deep_get("query", default=""),
            "xmr-jp1.nanopool.org" in event.deep_get("query", default=""),
            "xmr-au1.nanopool.org" in event.deep_get("query", default=""),
            "xmr.2miners.com" in event.deep_get("query", default=""),
            "xmr.hashcity.org" in event.deep_get("query", default=""),
            "xmr.f2pool.com" in event.deep_get("query", default=""),
            "xmrpool.eu" in event.deep_get("query", default=""),
            "pool.hashvault.pro" in event.deep_get("query", default=""),
        ]
    ):
        return True
    return False
