Increase in the number of reachable IPv4 nodes (bitprojects.io)

Observations
1

A few days ago, a sudden increase in the number of reachable IPv4 nodes from about 8,500 to 10,500 was observed by our monitoring nodes at KIT:

nconn-v-2592000-marked
nconn-v-2592000-marked1110Ă—555 119 KB

This increase seems to come mostly from 2040 new reachable addresses in the autonomous systems 12029 and 29798. From each of these ASes, we see 1020 IP addresses distributed over four /24 subnets:

AS 12029:
45.40.98.0/24
103.47.56.0/24
173.46.87.0/24
206.206.109.0/24

AS 29798:
89.106.27.0/24
174.140.231.0/24
184.174.95.0/24
216.107.135.0/24

According to whois data, these ASes are owned by TenSpire Network / bitprojects.io (see /Satoshi:29.1.0(dont-spam-me-bro)/ nodes?)

1 Like
2

Thanks for sharing! I think bitprojects went offline for a while to fix their misconfigurations (Antoine Poinsot - Misbehaving nodes investigation) and now came online again.

Note that /Satoshi:29.1.0(dont-spam-me-bro)/ nodes? - #2 by instagibbs mentions 203.11.72.185 as an example which isn’t included here. I assume there might be even more IP ranges belonging to them. I heard something of about 3000 IPs.

3

I also noticed that I don’t have any connections to them at the moment. Maybe they are offline again?

4

Seems like AS401199 (TenSpire Network) is the other AS:

66.163.223.0/24
103.246.186.0/24
23.100.246.0/24
203.11.72.0/24

5

nconn-v-604800-decrease
nconn-v-604800-decrease1110Ă—555 67 KB

Since yesterday, the addresses from the three mentioned ASes appear to be offline from the view of our monitors. However, I’m not sure whether they are actually offline or just blocking connections from our peers because one of our monitor nodes lost the connections to those peers about 24 hours earlier than the other two monitor nodes.

1 Like
6

Interesting! I noticed already last Friday (2025-10-24) that I didn’t have any open connections to “dont-spam-me-bro” nodes anymore. But they seems to just have changed their user-agent at around 3am UTC on that day.

7

Here are the TenSpire Network AS connections I’ve seen on my node fwiw

401199 (most common amongst my banned peers)
1426
12029
29798

8

fwiw: AS1426 is 104.204.252.0/23

9

nconn-v-604800-nov25
nconn-v-604800-nov251110Ă—555 72.1 KB

About 3000 nodes are back. Now, they have the user agent /Satoshi:29.2.0/Knots:20251110/.

versionstr_week-nov25
versionstr_week-nov251110Ă—630 14.5 KB

2 Likes
10

I think you are right. The person running bitprojects indicated that there is some automatic blocking of connections and specifically mentioned the KIT monitors to be affected by this.

1 Like