Problem: DNS seeds and security
Solution: I want to create a website which does the following:
- Check 'A' record for all domains used by 9 DNS seeds every 5 minutes
- Save all IP addresses in local database
- Check if these are bitcoin nodes
- Mark ✅ for DNS seed which has no issues, mark ⚠️ for DNS seed in which some IP addresses have issues and mark ❌ for DNS seed in which all IP addresses look suspicious
It will help in monitoring domains used by DNS seeds for any issues and alert users if one of them has some issues because hacked or other reasons.
Question: What exactly should I check in third step to consider an IP address as a bitcoin node with no issues? A normal bitcoin node would have some IP address, responding on port 8333 with UA string like
/Satoshi:0.21.1/ however nodes used by attacker can also do the same thing?
Sub-question: What kind of IP addresses or nodes would an attacker use if gets access to the DNS of one of the domains?