On 2026-01-08, I observed on multiple nodes a sustained rate of address announcements to my nodes where the addresses are either a self-announcement or a subnet-announcement (the IP being announced is from the same subnet as the sender is on). I had recently implemented a metric for this in metrics-tool: add self-announcement and subnet-announcement metrics for addr/addrv2 by 0xB10C · Pull Request #306 · peer-observer/peer-observer · GitHub.
Looking at the my debug.logs show connections from LinkingLion IP addresses, all with a similar pattern:
[net] [net] Added connection to LINKINGLION_IP:PORT peer=12345
[msghand] [net] received: version (116 bytes) peer=12345
[msghand] [net] sending version (103 bytes) peer=12345
[msghand] [net] send version message: version 70016, blocks=MY_HEIGHT, them=LINKINGLION_IP:PORT, txrelay=1, peer=12345
[msghand] [net] sending wtxidrelay (0 bytes) peer=12345
[msghand] [net] sending sendaddrv2 (0 bytes) peer=12345
[msghand] [net] sending verack (0 bytes) peer=12345
[msghand] [net] receive version message: /btcwire:0.5.0/Satoshi:25.0.0/: version 70016, blocks=[height older than 1 month], us=127.0.0.1:8333, txrelay=1, peer=12345 peeraddr=LINKINGLION_IP:PORT
[msghand] [net] received: version (116 bytes) peer=12345
[msghand] [net] redundant version message from peer=12345
[msghand] [net] received: verack (0 bytes) peer=12345
[msghand] New inbound v1 peer connected: version: 70016, blocks=[height older than 1 month], peer=12345 peeraddr=LINKINGLION_IP:PORT
[msghand] [net] sending sendcmpct (9 bytes) peer=12345
[msghand] [net] sending ping (8 bytes) peer=12345
[msghand] [net] sending getheaders (1029 bytes) peer=12345
[msghand] [net] initial getheaders (931409) to peer=12345 (startheight:[height older than 1 month])
[msghand] [net] sending feefilter (8 bytes) peer=12345
[msghand] [net] received: addr (24003 bytes) peer=12345
[msghand] [net] Received addr: 800 addresses (0 processed, 799 rate-limited) from peer=12345
[msghand] [net] Advertising address MY_IP:MY_PORT to peer=12345
[msghand] [net] sending addr (31 bytes) peer=12345
[msghand] [net] received: pong (8 bytes) peer=12345
[net] [net] selected inbound connection for eviction, disconnecting peer=12345 peeraddr=LINKINGLION_IP:PORT
[net] [net] Resetting socket for peer=12345 peeraddr=LINKINGLION_IP:PORT
[net] [net] Cleared nodestate for peer=12345
All addresses were rate-limited. This is the same fake user agent as before /btcwire:0.5.0/Satoshi:25.0.0/.