Some peers in the Bitcoin P2P network distributed a huge amount of spam IP addresses during July 2021. These spam IP addresses did not belong to actual Bitcoin peers. We found that the behavior of the spamming peers can be used to determine the number of neighbors of public peers and to find Sybil peers (peers that have multiple addresses). We evaluate the method by running an analysis based on data collected by our monitor nodes and compare the data to a ground-truth based on few peers that we run ourselves. The node degree of public peers is found with high precision and Sybil peers are correctly classified with very high precision and high recall if the spamming peers and the monitor are connected to all Sybil addresses.
Download