The nefarious stratum server on 190.97.164.179:3333 is no longer answering.
It was not running standard stratum server pool -- normally the client sends data first (like HTTP) but this server was sending mining.notify immediately (more like SMTP).
The mining.notify includes the hash of the previous block, but it's endianess is opposite of what any block explorer expects, but someone with more patience than myself should be able to find what coin it was mining.
These are a few hashes I collected:
67272dab30992028ef77ee8d027a52a1e95582234e11ea9052a11626181c2ad4 --> 181c2ad452a116264e11ea90e9558223027a52a1ef77ee8d3099202867272dab
a5ed793ec7847f3b1904c3194d6bcec6977dc97b354a9f91c5c8985fb6344bb9 --> b6344bb9c5c8985f354a9f91977dc97b4d6bcec61904c319c7847f3ba5ed793e
21cf02e69c9a41875ee6ea26dae7e9a1a993b2dc37b1fe0f829ae5172451612a --> 2451612a829ae51737b1fe0fa993b2dcdae7e9a15ee6ea269c9a418721cf02e6
d0f67fec0722ba7f4ed0e10703a9afcbc86564316187944426906b5267345f62 --> 67345f6226906b5261879444c865643103a9afcb4ed0e1070722ba7fd0f67fec
430719e64f1653d0adb10b79ecb0a6bbcc8bfca77ab18713e123c66c03274404 --> 03274404e123c66c7ab18713cc8bfca7ecb0a6bbadb10b794f1653d0430719e6
First column is the hash from the
mining.notify, second is the same swabbed around.