If you're using cgminer, start it with 2>cgminer.log to enable logging to a file. I did this and found the following line in the log after two of my rigs were highjacked:

 [2014-03-23 11:34:15] Reconnect requested from pool 2 to 190.97.165.179:3333