I found it hard to believe the number of IP addresses received including duplicates rose to 460,241 addresses on 31 august in a node I was looking at.
Apparently 99.2% of all the addresses which got rate limited in net_processing in the node’s debug.log (since it started) came from 1 ip address 82.221.101.217 which advertises it’s own IP addresses on 67 different ports. It sends all addresses with services = 0, so none of them would enter the addrman anyways.
addresses it sent:
from Aug 18 - 20: same ip address 82.221.101.217 on 20 contiguous different ports (so an ADDR message was 20 different addresses but it was the same IP on 20 different ports)
from Aug 20 onwards: same ip address 82.221.101.217 on 67 contiguous different ports from ports 8333–8399.
frequency: 1 ADDR message every ~30 seconds.
I tried connecting to it:
it’s version message was ver=70016 services=0000000000000000 height=1965166 ua='/btcwire:0.5.0/hemi-soak:1.0/' and the height is roughly double the real network’s ~964,600.
all its ports were reachable but it disconnected me after ~30 seconds. (I haven’t tried from a real node yet btw)
hmm probably software on some other chain accidentally connecting to us? seeing this on bitnod.es. seems to have connected to other normal nodes as well.
EDIT: no idea and could 100% be wrong but maybe https://hemi.xyz
oh wow, thanks for finding that UA! currently seeing 4,298,947 addresses from that IP address which got rate limited. maybe we should open an issue there.
stratospher · 
Jonathan Harvey-Buschel · 
