Related: #1585578
I made a list of all nodes with ALL CAP aliases with one force closed channel seen in the last 30 days.
These are preliminary results. There are most likely some false positives. I don't want to start a witchhunt, but this looks serious. If you know any of these noderunners, warn them asap.
Note: Amboss says some of the closures are mutual, but if you look at the closing tx on mempool, it's labelled as a revoked lightning force close.
AGORANODE: Amboss | (victim) nodl-cloud: Amboss
ANGRYANALYST: Amboss | (victim) GreenBit: Amboss
ANGRYARK: Amboss | (victim) scubasound: Amboss
ANGRYARTIST: Amboss | (victim) ORANGESUCKER-v26.06.8: Amboss
ANGRYENTOURAGE: Amboss | (victim) El Salvador Cs the Lightning: Amboss
ANGRYSPORK: Amboss | (victim) scubasound: Amboss
ANGRYTROUGH: Amboss | (victim) scubasound: Amboss
BIZARREBEAM: Amboss | (victim) ln.jekovc.si: Amboss
BIZARRECHIPMUNK: Amboss | (victim) MAGNUS: Amboss
BIZARRESPORK: Amboss | (victim) LN-Haven: Amboss
BLUEBOUNCE: Amboss | (victim) achow101: Amboss
BLUESOURCE: Amboss | (victim) malar: Amboss
CHILLYMONKEY: Amboss | (victim) Movetoelsalvador.com v3: Amboss
CHILLYWALK: Amboss | (victim) scubasound: Amboss
GREENFIRE: Amboss | (victim) ghostbird: Amboss
GREENMONTANA: Amboss | (victim) void0: Amboss
GREENTRINITY: Amboss | (victim) p.zax.cloud: Amboss
GREENYARD: Amboss | (victim) Voltorb: Amboss
HAPPYBOUNCE: Amboss | (victim) ghostbird: Amboss
HAPPYCHIPMUNK: Amboss | (victim) ChurchOfBitcoin: Amboss
HAPPYSET: Amboss | (victim) LN-Haven: Amboss
HOPPINGSCAN: Amboss | (victim) the_holy_cheese_grater: Amboss
IRATEMOON: Amboss | (victim) ghostbird: Amboss
IRATESET: Amboss | (victim) LN-Haven: Amboss
IRATESET: Amboss | (victim) Bitmynt: Amboss
JUNIORARK: Amboss | (victim) IRONMONKEEEEE_CLN: Amboss
JUNIORCHASER: Amboss | (victim) Lightning_is_real_Bitcoin_Cash: Amboss
JUNIORROUTE: Amboss | (victim) achow101: Amboss
JUNIORSEAGULL: Amboss | (victim) void0: Amboss
JUNIORSOUFFLE: Amboss | (victim) ghostbird: Amboss
LATENTARK: Amboss | (victim) gzk9000 CLN: Amboss
LATENTENTOURAGE: Amboss | (victim) ghostbird: Amboss
LATENTWATER: Amboss | (victim) Luna: Amboss
LIGHTNINGIRON: Amboss | (victim) void0: Amboss
LIGHTNINGMASTER: Amboss | (victim) scubasound: Amboss
LIGHTNINGMONKEY: Amboss | (victim) ChurchOfBitcoin: Amboss
LIGHTNINGTRAWL: Amboss | (victim) void0: Amboss
LOUDBOUNCE: Amboss | (victim) the_holy_cheese_grater: Amboss
LOUDGOPHER: Amboss | (victim) Jabberwonky: Amboss
LOUDSEAGULL: Amboss | (victim) lnnode01: Amboss
LOUDSOURCE: Amboss | (victim) the_holy_cheese_grater: Amboss
LOUDSUCKER: Amboss | (victim) LN-Haven: Amboss
LOUDTRAWL: Amboss | (victim) p.zax.cloud: Amboss
ORANGEBEAM: Amboss | (victim) cyber-hornet-1: Amboss
ORANGEGLEE: Amboss | (victim) p.zax.cloud: Amboss
PEEVEDBEAM: Amboss | (victim) LN-Fukaya Japan: Amboss
PEEVEDCALENDAR: Amboss | (victim) boostbridge: Amboss
PEEVEDFEED: Amboss | (victim) Node009: Amboss
PEEVEDSEAGULL: Amboss | (victim) p.zax.cloud: Amboss
REDSEAGULL: Amboss | (victim) scubasound: Amboss
REDSPORK: Amboss | (victim) Lightning_is_real_Bitcoin_Cash: Amboss
REDSQUIRREL: Amboss | (victim) atraxs: Amboss
SILENTBEAM: Amboss | (victim) ghostbird: Amboss
SILENTMAESTRO: Amboss | (victim) IslandDSP: Amboss
SILENTMONTANA: Amboss | (victim) ob⚡: Amboss
SILENTWALK: Amboss | (victim) NCC-1701-A: Amboss
SLEEPYBOUNCE: Amboss | (victim) boostbridge: Amboss
SLEEPYMONKEY: Amboss | (victim) gzk9000 CLN: Amboss
SLEEPYSUCKER: Amboss | (victim) ghostbird: Amboss
SLEEPYTOLL: Amboss | (victim) ZapKitty: Amboss
SLICKERSPAWN: Amboss | (victim) DeutscheBank|CLN: Amboss
SLICKERSPAWN: Amboss | (victim) cyber-hornet-1: Amboss
SLIMYPHOTO: Amboss | (victim) NthLNode: Amboss
SLIMYSCAN: Amboss | (victim) LunaNode: Amboss
SLIMYTOTE: Amboss | (victim) LunaNode: Amboss
SOMBERBEAM: Amboss | (victim) LN-Haven: Amboss
SOMBERGOPHER: Amboss | (victim) IRONMONKEEEEE_CLN: Amboss
SOMBERMONTANA: Amboss | (victim) Satsdays.Com: Amboss
SOMBERRAGE: Amboss | (victim) BTC2B Group | Lightning Checkout: Amboss
STRANGEDEITY: Amboss | (victim) Jubilee: Amboss
STRANGETOTE: Amboss | (victim) ChurchOfBitcoin: Amboss
UNITEDCHIPMUNK: Amboss | (victim) Node009: Amboss
UNITEDPLOW: Amboss | (victim) LunaNode: Amboss
UNITEDSET: Amboss | (victim) the_holy_cheese_grater: Amboss
UNITEDSPORK: Amboss | (victim) p.zax.cloud: Amboss
UNITEDWATER: Amboss | (victim) achow101: Amboss
VIOLENTARK: Amboss | (victim) start9-ijkv8mwie: Amboss
VIOLENTSOURCE: Amboss | (victim) Satsdays.Com: Amboss
VIOLENTSQUIRREL: Amboss | (victim) ZionBTC: Amboss
VIOLENTSUCKER: Amboss | (victim) Jubilee: Amboss
VIOLETWAFFLE: Amboss | (victim) machankura-z: Amboss
WEIRDANALYST: Amboss | (victim) the_holy_cheese_grater: Amboss
WEIRDMAESTRO: Amboss | (victim) start9-ke04nyy13: Amboss
WEIRDPHOTO: Amboss | (victim) p.zax.cloud: Amboss
WEIRDPLOW: Amboss | (victim) achow101: Amboss
WRONGFIRE: Amboss | (victim) ChurchOfBitcoin: Amboss
WRONGPHOTO: Amboss | (victim) axiom: Amboss
YELLOWCHIPMUNK: Amboss | (victim) Satsdays.Com: Amboss
YELLOWENTOURAGE: Amboss | (victim) ln.jekovc.si: Amboss
Total force closed capacity: 142,742,540 sats
Unique victims: 44
@Scoresby @Murch @k00b @niftynei
bc1qch29cr3v3jjn395qzmq5gper4f5ug2nsrss2vq
Are you sure these a certainly malicious nodes? ADJECTIVE+NOUN in caps is the alias CLN generates from the node id when the operator never sets one.
There is an ongoing attack however, I have been researching it.
"These are preliminary results. There are most likely some false positives. I don't want to start a witchhunt, but this looks serious. If you know any of these noderunners, warn them asap."
Look at ghostbird's node in the list.
The channel close with IRATEMOON was a revoked lightning force close. Similar capacity, (1.2M), four similar channels closed at the same time. The behavior is peculiar.
deleted by author
Are these ~lightning nodes?
Where is the
ALLCAPS + 1closedChan = maliciousevidence?Is this list created because of this?
You lack basic reading comprehension.
Check the closing transactions of these channels.
It shows weakness in structure.
Are you able to extend this search more than 30 days? I would be interested in 90 days because this would predate the recent activity drawing attention to the exploitation space. I recall seeing this activity before this, which may have been draining the node for longer.
I suspect this is one of several campaigns exploiting channel state bugs to slowly drain nodes over time.