have you tried to contact the people at flex? That address has 8 gh/s, but seems they only scammed $18k. Doesn’t sound that much for a scam operation, unless they have more accounts.
If they are not hunting for things like this (ip from all over), blocking the wallet will probably only delay these guys a little until they update their code with a new address.
However, do try as Keaton suggested a clean install. Don’t use the media you had before until you had a chance to fully erase it. Change your rig id as well.
Seems that something is hijacking your rig. The doubt is whether it is something local to you or something on hive’s end?
@keaton_hiveon, just found that the paris ip shows when I use the app on ios. Why would it create a token from a paris ip?