...
So what happened here is:
1. Miner got disconnected from its legitimate pool.
2. It tried to reconnect, but was connected to a fake pool instead.
3. This fake pool immediately ordered it to reconnect to a different IP, effectively redirecting it to another pool.
4. The miner connected to 190.x address and started mining on a malicious pool.
The mystery is why user was connected to a fake pool after being disconnected from legitimate pool.
This is probably some kind of MITM attack as the user was connected to a fake pool after disconnection. The question is where this MITM attack was performed.
Your pool operator Terk seems to have an excellent grasp of what is going on in this hashpower theft attack.
If I could add a point or two,
if the mitm attack is a dns hijack, in #2 above, if a server host name is configured in miner client, and that server host name is still contained with the operating system's cache of host name to ip address mappings, then the miner should connect back to the legitimate server when a stratum connection breaks. However, if the cache entry has already expired, then the server host name would need to be resolved again and possibly receive an illegitimate ip address in return.
So in the very short term in order to minimize your attack surface, you could disable external host name to ip address resolution, by hard coding a server ip address into the miner configuration, or by creating a static host name to ip address mapping in your operating system's version of a hosts file. Either of these attack mitigations
must be accompanied by disabling client.reconnect messages in your miner software (for now), in case the mitm attack is affecting more than just dns resolution.
In #3 above, the hashpower thieves are likely using client.reconnect to capture your miners at an illegitimate server if they are unable to steadily maintain the mitm attack. For without it, you miner would just connect back to the legitimate server if that hijacked stratum connection were to break.
Terk, if you have a minute, I would really like to get your perspective as a pool operator on this stratum mining protocol enhancement suggestion. Thanks.
https://bitcointalksearch.org/topic/m.5867183