It would be great to find a miner who was keeping share logs AND actually solved a block, as then we could trace it to a wallet address, perhaps seeing how much they were able to siphon and where it might ultimately have ended up.
Even if they didn't solve a block, the coinbase parameter in the packet contains a payout address, so we can at least see where the coins would have gone.
Someone on Reddit posted a
packet capture when it was mining Worldcoin, but a Litecoin or Dogecoin packet would be more interesting.