The stripe miner partially restored their operation

they seem to be using supportxmr only this time, judging by the chart at miningpoolstats.stream/monero

sech1: any idea here? monero-project/monero #9356

have you seen such reports before?

If the address is unknown, then pwned (or misconfigured RPC access). If it were known, it could be the background mining, if creating a wallet and saying "yes" without thinking.

it starts mining with 16 threads which I assume wouldn't be background mining

I will add a comment.

His command line doesn't enable public RPC

So it must be something on his PC

moneromooo: they got a log from the rpc call but netstat doesn't find anything on that port

ty, replied

can't they just run wireshark or something, and log all connections to port 18081?

does wireshark show process id?

no idea

I know that lsof can give you process id for each open connection

netstat too