@darosior mentions these in Antoine Poinsot - Misbehaving nodes investigation
A couple days later, Eric comes back with another oddity. This time, he notices a bunch of nodes that don’t honour the
versionmessage’s relay flag. Therelayflag instructs a node whether it should announce transactions to the sender of theversionmessage. Not respecting this flag is a protocol violation and will result in a disconnection, in Bitcoin Core or Libbitcoin alike. In Eric’s experiment Libbitcoin would always setrelaytofalseand yet those peers would still announce it transactions. All of the misbehaving peers were Bitcoin Core version 25.0 or 25.1 (but never 25.2!). Again, weird. The announced transactions traffic appeared to be organic, it wasn’t someone trying to exploit something.
In both cases, these are nodes that are misbehaving but don’t appear to be particularly malicious. In both cases, the malicious nodes claim to be some outdated Bitcoin Core version, and in at least one of these cases we know it’s not true (Bitcoin Core will always honour therelayflag). Was it some script kiddy who modified a Bitcoin Core client without knowing what he’s doing? That seems highly unlikely as that’s 4 different versions and hundreds of nodes in total. Some proxy spoofing theversionmessage of a Bitcoin Core node? For what purpose?