In March 2023, I published LinkingLion: An entity linking Bitcoin transactions to IPs? about an entity which opens connections to many Bitcoin nodes using four IP address ranges and listens to transaction announcements. This might allow the entity to link newly broadcast transactions to node IP addr…

A year later, I published an Update on LinkingLion: Reduced activity and a statement by LionLink Networks .

As of today (2025-10-13), LinkingLion is still active on the network and makes up about 1%-2% of inbound bandwidth and 3%-5% of outbound traffic (measured in bytes) of my nodes. Due to frequently being evicted and then reconnecting, they make up for about 5%-10% of inbound messages and 7%-13% of out…

LinkingLion connections are (and this has been happening for a while now) gossiping the address 10.1.1.71:8333. The 10.0.0.0/8 network is a private network, so this might be unintentional?

This shows connections from LIONLINK networks and from Digital Ocean (see also DigitalOcean /Satoshi:24.0.1/ spy nodes connected during IBD ) next to each other. I found it weird that these seem to rise and fall at the same time. Need to look into it further… [image]

Re-posting the LinkingLion (fake) UserAgents here to enable finding this topic if someone searches for these: from https://b10c.me/data/observations/06-linkinglion/linkinglion-user-agents.txt /Satoshi:0.14.1/Knots:20170420/ /bitcoinj:0.14.4/Bitcoin Wallet:5.26/ /Satoshi:0.14.2(UASF-SegWit-BIP148)/…

While looking at IP address self-announcements that are rate-limited by Bitcoin Core nodes in https://github.com/bitcoin/bitcoin/pull/33699#issuecomment-3613987461 , I stumbled across another LinkingLion IP address range announced by the LionLink Networks AS I previously was unaware about: 199.116.…

[image] b10c: A custom client with the user agent /btcwire:0.5.0/Satoshi:25.0.0/ I guess the user agent is just fake since it makes no sense. btcwire is a Go package that btcd uses, so it’s a bit weird that Satoshi appears in the user agent also.

Note that all connections from the original LinkingLion IPs stopped across all of my 18 monitoring nodes on 2025-12-05 at around 11:25 UTC.

I’m seeing similar connections now from IPs announced by “AS401476 - Spruce Creek Networks LLC”. Will publish a full list of IPs after further investigation.

I just did a quick search on one of our nodes for networks with many peers who announce a user agent that includes “breadwallet” which is a very simple heuristic for the LinkingLion behavior. The following networks were found: 143.20.137.0/24 31.58.215.0/24 87.229.79.0/24 2602:f5c0:0:ace::72:0/1…

LinkingLion: An entity linking Bitcoin transactions to IPs?

Observations

b10c October 9, 2026, 1:38pm 17

The OP in this post contained only the old IPs. I’ve added the new IPs there too: