Some recent debug logs from one of my nodes :
disconnecting node 70.33.211.11:50769
socket closed
disconnecting node 70.33.211.11:56482
socket closed
disconnecting node 70.33.211.11:53752
socket closed
disconnecting node 70.33.211.11:28708
socket closed
disconnecting node 70.33.211.11:9633
ERROR: ConnectInputs() : 6c559a52a7 mapTransactions prev not found a16b29f09a
ERROR: AcceptToMemoryPool() : ConnectInputs failed 6c559a52a7
ERROR: ConnectInputs() : 1eb011afb8 mapTransactions prev not found b4925f51be
ERROR: AcceptToMemoryPool() : ConnectInputs failed 1eb011afb8
received block 00000000000000000292
accepted connection 70.33.211.11:2900
accepted connection 70.33.211.11:16962
accepted connection 70.33.211.11:14480
socket closed
disconnecting node 70.33.211.11:51022
socket closed
disconnecting node 70.33.211.11:36724
socket closed
disconnecting node 70.33.211.11:20712
socket closed
disconnecting node 70.33.211.11:39841
socket closed
disconnecting node 70.33.211.11:62678
socket closed
disconnecting node 70.33.211.11:10185
socket closed
disconnecting node 70.33.211.11:49771
socket closed
disconnecting node 70.33.211.11:31754
socket closed
disconnecting node 70.33.211.11:21291
socket closed
disconnecting node 70.33.211.11:49837
accepted connection 70.33.211.11:13159
accepted connection 70.33.211.11:44050
accepted connection 70.33.211.11:1235
accepted connection 70.33.211.11:12469
socket closed
disconnecting node 70.33.211.11:55158
socket closed
disconnecting node 70.33.211.11:22483
socket closed
disconnecting node 70.33.211.11:17697
accepted connection 70.33.211.11:62079
accepted connection 70.33.211.11:53365
accepted connection 70.33.211.11:29730
socket closed
disconnecting node 70.33.211.11:60027
socket closed
disconnecting node 70.33.211.11:30607
socket closed
disconnecting node 70.33.211.11:28335
socket closed
disconnecting node 70.33.211.11:21164
socket closed
disconnecting node 70.33.211.11:10443
socket closed
disconnecting node 70.33.211.11:9370
socket closed
disconnecting node 70.33.211.11:50904
socket closed
disconnecting node 70.33.211.11:28309
socket closed
disconnecting node 70.33.211.11:43033
socket closed
disconnecting node 70.33.211.11:16226
socket closed
disconnecting node 70.33.211.11:8880
accepted connection 70.33.211.11:51248
accepted connection 70.33.211.11:56145
socket closed
disconnecting node 70.33.211.11:29502
socket closed
disconnecting node 70.33.211.11:13159
socket closed
disconnecting node 70.33.211.11:44050
socket closed
disconnecting node 70.33.211.11:1235
accepted connection 70.33.211.11:10412
accepted connection 70.33.211.11:20728
accepted connection 70.33.211.11:3694
accepted connection 70.33.211.11:36381
socket closed
disconnecting node 70.33.211.11:12469
socket closed
disconnecting node 70.33.211.11:62079
socket closed
disconnecting node 70.33.211.11:53365
socket closed
disconnecting node 70.33.211.11:29730
accepted connection 70.33.211.11:4244
accepted connection 70.33.211.11:57985
accepted connection 70.33.211.11:10268
accepted connection 70.33.211.11:59811
accepted connection 70.33.211.11:54155
accepted connection 70.33.211.11:14730
accepted connection 70.33.211.11:34594
accepted connection 70.33.211.11:10178
SetBestChain: new best=00000000000000000292 height=429571 work=46450363347196141668520216
ProcessBlock: ACCEPTED
received block 000000000000000000d2
accepted connection 70.33.211.11:44363
socket closed
disconnecting node 70.33.211.11:51248
accepted connection 70.33.211.11:62270
accepted connection 70.33.211.11:53596
accepted connection 70.33.211.11:37797
accepted connection 70.33.211.11:61765
accepted connection 70.33.211.11:9604
accepted connection 70.33.211.11:47888
socket closed
disconnecting node 70.33.211.11:56145
socket closed
disconnecting node 70.33.211.11:10412
socket closed
disconnecting node 70.33.211.11:20728
socket closed
disconnecting node 70.33.211.11:3694
accepted connection 70.33.211.11:12623
accepted connection 70.33.211.11:38498
accepted connection 70.33.211.11:10492
accepted connection 70.33.211.11:4094
accepted connection 70.33.211.11:45039
accepted connection 70.33.211.11:25046
Who the fuck ? A fellow canuck :
NetRange: 70.33.211.0 – 70.33.211.15
CIDR: 70.33.211.0/28
NetName: PEER1-CANCOIN-01
NetHandle: NET-70-33-211-0-1
Parent: PEER1-BLK-14 (NET-70-33-192-0-1)
NetType: Reassigned
OriginAS:Customer: Cancoin (C05688322)
RegDate: 2015-04-20
Updated: 2015-04-20
Ref: https://whois.arin.net/rest/net/NET-70-33-211-0-1
CustName: Cancoin
Address: 20 Pullman Court
City: Scarborough
StateProv: ON
PostalCode: M1X 1E4
Country: CA
RegDate: 2015-04-20
Updated: 2015-04-20
Ref: https://whois.arin.net/rest/customer/C05688322
I’m not the only one he’s been poking either. Cancoin scammersi have been targetting other TRB nodes as well.
asciilifeform: in other noose, 70.33.211.11 (yes, 1 box) has been ddosing trb nodes, in particular zoolag.
asciilifeform: 1000s of connections /sec.
asciilifeform: https://cancoin.co << owner.
asciilifeform: well, dosing.
asciilifeform: no ‘d’.
In the end, kids always imagine themselves more vigourous and virile than they actually are, which is exactly where the whole premature ejaculation thing starts, and for many unfortunately never ends, but some chitlin eventually grow up, as they must if they’re ever to impregnate a woman.
This one might too. But I doubt it.
___ ___ ___
- Their blog turns up the names of Will Kane and Shawn Butchart as the two co-founders. Alas, “Mutli-sig” is not even a new or original scam in the Bitcoin space. Surely you’ll recall BitGo and their various “accidents.” Cancoin is exactly no different, but realising this, they’ve now branched off into the wonderful world of spamming. I’m sure I’ll be receiving a ransom notice from them any day now. ↩
The interesting aspect here is that it is, IMHO, entirely not obvious what the logical pill against this problem is.
Ban IP when connects / packets ratio falls too low ? This will result in banning friends who get blackholed (tcp diddling as discussed in #t.) Which happens routinely.
Ratio too high, rather.
To my mind, there are two broad categories of solutions : the passive and the active. The former is to allow the impetuous youth to exhaust his resources in the fullness of time, which, given that his resources are necessarily limited and that an hourglass is a better instrument for approximating said depletion than, say, a calendar is (as it is in all matters of adolescent fixation), this option is always and everywhere on the table. The latter is, of course, to have TRB operators manually ban individual miscreants using a mechanism similar to your famous AWS Banhammer (ie. iptables).
Either way, I agree that an automated “ban after this many attempts” mechanism is deeply flawed.