I dont know what is causing but i tried tons of fixes, i mainly use public torrenting, and sonarr and radarr are doing it.
I added *.arj and arj to the quality profile avoid list without success, and prowlarr is as torrent (i’ve read sometimes it gets confused and uses nzbget)
I got one so I picked it apart. The link runs a script on the local system that downloads a kubernetes runtime. From there I assume it runs a Bitcoin miner or something, I didn’t go any further.