cgminer 5820 user 10u IPv4 3470164 0t0 TCP GPUMiner001:57242->server.live-chat-studio.com:3333 (ESTABLISHED)
a lie: my other rig that's a clean Ubuntu install was hijacked as well (it was mining DOGE on multipool)
I think a redirection feature must be disabled. Someone is firing redirection packages at will.
I've got a route to 127.0.0.1 in place now for that network now, so if they do hijack my rigs, my hash rate will go to zero, but they'll get no free mining time from me.