18:01:13 <ZZZZ> The last few days, I keep seeing messages in monerod that my node is 4 years behind. It seems my node is connecting to quite a few nodes that are around block height 4155000. Has anyone else seen this? 
18:05:51 <m-relay> <r​brunner7:monero.social> Yes. Nobody knows who or what is behind this, but it's harmless for Monero daemons. Chance has it that I just today I had a look into this and saw that the daemon disconnects almost immediately after such a node claims that it is 4 years ahead because it submits a different genesis block.
18:09:57 <ZZZZ> Good to know. Does the daemon ban IP's that do that? 
18:12:08 <m-relay> <r​brunner7:monero.social> Not sure, but I would suspect: There is nothing to recover from, because it's known that it's not a correct chain.
18:16:22 <ZZZZ> Got it. Thanks rbrunner7 :)
18:16:27 <m-relay> <r​brunner7:monero.social> The whole thing is a bit puzzling: If a Monero code fork forgets to change the so-called *network id* and starts with a fresh chain, which would trigger this behavior, the chain would be short. If somebody forks code *and* chain, why should they be ahead of us already so many blocks? Maybe somebody really, really does not know what they are doing ...
18:17:57 <ZZZZ> So in that case it's just an attempt at an attack, but it seems not worth it at all from what I can tell. The IP's I looked at appeared unrelated and possibly widely distributed (I didn't look too close)
18:18:46 <ZZZZ> I'd be happy to make a list of the IP's and keep a closer eye on it going forward if anyone would find that data useful.
18:18:52 <m-relay> <r​brunner7:monero.social> Well, an attacker that is worth anything wouldn't do something that makes our daemons disconnect immediately, in a reliable way, no?
18:19:14 <m-relay> <r​brunner7:monero.social> If the attack is "confuse those people" maybe :)
18:19:45 <ZZZZ> lol
18:20:30 <m-relay> <r​brunner7:monero.social> Watching this can't do any harm, and with such things you are never really sure. Might be interesting to collect some data, yes.
18:21:43 <ZZZZ> Cool I'll keep an eye on my node and see what else I might be able to find out
18:58:13 <ZZZZ> Since 2/22 my node has connected to 130 other distinct nodes that report being ahead. On 2/22 they were 3.2 years ahead, and now they're 4.x years ahead. Many of the addresses seem to be related to each other. 30 of the clients I connected to since 2/22 are in the 49.12.22x.xxx range.
20:06:01 <m-relay> <r​brunner7:monero.social> Our software looks at how many blocks the daemon is ahead and multiplies that with our average blocktime of 2 minutes to arrive at something like 4 years. If they raced through nearly 1 "year" of blocks in 10 days or so, they would have an average time between blocks of 4 seconds or so, if I calculated correctly.
20:21:23 <ZZZZ> Strange that there would be so many and so widely dispersed, and to have continued this long. I have to wonder if maybe they're getting some valuable data back in responses maybe, or maybe all the responses in aggregate. I imagine they're able to reach just about the whole network with 130 seperate nodes. I could be way off but I'm imagining block propagation research. Maybe it's simpler than that. 
20:22:31 <ZZZZ> 130 and counting actually
22:54:17 <m-relay> <e​ndor00:matrix.org> Hmmm, that ip range you mentioned seems different from the LinkingLion stuff I've seen in my network scans
22:54:59 <m-relay> <e​ndor00:matrix.org> Any chance you could put on a pastebin somewhere a list of the ip addresses in question? I'd like to see how they're connected to the rest of the network