Quote from: jennywhzz on July 02, 2017, 06:37:35 PM

Quote from: parshuram on July 01, 2017, 12:59:58 AM

MINING ON ETHOS

SETTINGS ON REMOTE CONFIG - DIGITAL OCEAN.

SO ALL THE SETTINGS OF POOL AND WALLET ARE SAVED IN ONE CONFIG FILE ON OCEAN AND EVERY RIG TAKES UP THAT SETTING.

NOW AT NIGHT MOSTLY BETWEEN 1-4 AM . SOMEONE USED TO ACCESS THE DROPLET AND CHANGE THE WALLET ADDRESS TO HIS OWN AND POOL TO EUROPE SERVERS AT ETHERMINE.ORG. BUT SOMEHOW THE RIGS NEVER MINED AND SHOWED 0 HASHRATE . AND CHANGING IT TO OLD CONFIG FILES AGAIN AFTER 4 AM AROUND

AS WE WERE MONITORING THE POOL ONLY, SO WE CONSULTED MANY PEOPLE THAT RIGS ARE MINING BUT ARE NOT SHOWING UP IN THE POOL. BUT OBVIOUSLY NO ONE AGREED.

SO TODAY HE CHANGED THE SERVERS TO INDIAN SERVER NEAREST TO OUR RIGS AND THEY MINED LIKE 4-5 MINUTES. I BECAME AWARE OF THE ISSUE AND CHECKED HIS WALLET ADDRESS ALL MACHINES WERE ONLINE.

BUT AS SOON AS I SHUT DOWN THE RIGS HE CHANGED THE CONFIG FILES TO ORIGINAL SETTINGS.

HERE IS THE WALLET ADDRESS : https://ethermine.org/miners/85b4203fff14f350b388f8d6f9b082ed184d4b69

AND WHY IN HIS WALLET ADDRESS, ONLY WHEN THE WORKERS ARE ACTIVE THEN ONLY WE CAN SEE THEM OTHERWISE THEY ARE REMOVED FROM POOL AT THAT TIME ONLY. USUALLY INACTIVE WORKERS STAYS ON THE POOL FOR A DAY AT LEAST.

TRIED CHANGING DIGITAL OCEAN PASSWORD TWICE.

DOES ANY ONE KNOWS THIS ? ANYONE EVER BEEN ATTACKED THE SAME WAY PREVIOUSLY ?

HERE ARE SOME SCREENSHOTS OF TODAY, YOU CAN CHECK OUT THE TIMINGS AT THE TOP LEFT FOR MORE CLARITY -

http://imgur.com/a/nvaMB - THESE TWO WHEN EVERY RIG WAS MINING AT HIS ADDRESS AT 2:52AM

http://imgur.com/a/wRHxN - THIS ONE OF THE MORNING AT 6:13 AM

KINDLY HELP AND GUIDE.

THANKS .

I am totally confused. Is this person changing the settings on a website or your rig? Are you renting from digital ocean or mining from home?

Yup using digital ocean and ssh login via mobaxterm. Plus he was accessing the config file of the droplet directly.