cgminer 5820 user 10u IPv4 3470164 0t0 TCP GPUMiner001:57242->server.live-chat-studio.com:3333 (ESTABLISHED)
a lie: my other rig that's a clean Ubuntu install was hijacked as well (it was mining DOGE on multipool)
I think a redirection feature must be disabled. Someone is firing redirection packages at will.