Satori botnet operators are mass-scanning the Internet for exposed mining rigs, experts say. The operators are looking for devices with ports 3333 exposed online. This is the default port for the “Claymore”” dual Ethereum/Decred cryptocurrency miner. The miners are using the GPON routers to scan for Claymore miners
Source: telmex.com.”