A short note on the roughly 9k clearnet figures above: as discussed in #121, bitnod.es and btcnodes each include about 950 reachable endpoints from the same AS63949 fleet. They complete the Bitcoin handshake but do not behave like normal Bitcoin Core nodes afterward.
And thanks for the link, @deadmanoz. I hadn’t seen this implementation before. I’ll take a closer look and may include it in my crawler comparison.