I just did a quick search on one of our nodes for networks with many peers who announce a user agent that includes “breadwallet” which is a very simple heuristic for the LinkingLion behavior. The following networks were found:
143.20.137.0/24
31.58.215.0/24
87.229.79.0/24
2602:f5c0:0:ace::72:0/124