Created a script to get the connections every time a new node connected. Everything looked normal in the peer list until I saw many nodes from:
100.42.27.* (around 200 peers)
193.142.59.* (around 200 peers)
199.116.84.* (around 100 peers)
209.222.252.* (around 150 peers)
91.198.115.* (around 150 peers)
The 100.42.27., 199.116.84., 209.222.252., and 91.198.115. all belong to “Lionlink Networks”.
These are around 600 nodes that are under that ISP and account for 20-30% of all nodes seen from a 3 day survey span.
This looks suspicious to me and the massive amounts of nodes raises many red flags and does not look natural at all.
If these were malicious, in concept, with the 13 default IN/OUT peers, if all connected are malicious, the innocent one would have no other data to compare it to.
(Edit: Updated Theory: having many nodes has the ability trace transactions and block miners easier based on timing attack)
MRL has recently noticed the same issue and is discussing solutions: https://github.com/monero-project/research-lab/issues/126
yea and all above IP ranges are found at the top of https://github.com/Boog900/monero-ban-list/blob/main/ban_list.txt. The ban list is good but it is not enabled by default.
This post/thread needs to be way way higher up for everyone to see. Sounds just like all the malicious nodes on the tor network. Everything gets tapped eventually. Hopefully a solution can be found. What is the easiest method to host a tor and XMR node safely? I’ve got a server PC to offer up for good use. Anything possible on a home network or too risky?
Interesting observation, would it be difficult to detect such anomalies automatically?
The attacker can just be smarter and use various ASNs + out-proxies for their backend.
My background is small-world network in distributed systems and anti-censorship software like Hyphanet. If the goal is to evict/lessen the purview of the metadata harvesting nodes then some version of web-of-trust + proof of work could be implemented.
Interesting, thanks for sharing!
