Problem: DNS seeds and security

Solution: I want to create a website which does the following:

  • Check 'A' record for all domains used by 9 DNS seeds every 5 minutes
  • Save all IP addresses in local database
  • Check if these are bitcoin nodes
  • Mark ✅ for DNS seed which has no issues, mark ⚠️ for DNS seed in which some IP addresses have issues and mark ❌ for DNS seed in which all IP addresses look suspicious


It will help in monitoring domains used by DNS seeds for any issues and alert users if one of them has some issues because hacked or other reasons.

Question: What exactly should I check in third step to consider an IP address as a bitcoin node with no issues? A normal bitcoin node would have some IP address, responding on port 8333 with UA string like /Satoshi:0.21.1/ however nodes used by attacker can also do the same thing?

Sub-question: What kind of IP addresses or nodes would an attacker use if gets access to the DNS of one of the domains?

  • 1
    A malicious node attempting an eclipse would feed you an alternative history from genesis with orders of magnitude less proof of work. Check that the Bitcoin nodes give you the actual block history from genesis? Other than identifying malicious or spammy behavior there is no way to identify an attacker in advance I don't think. Oct 14, 2021 at 18:02
  • Hmm will have to read about eclipse attacks before working on this. I think there can be few more red flags based on version returned in UA string. Context: reddit.com/r/Bitcoin/comments/lb6dpi/vulnerable_bitcoin_nodes/…
    – user103136
    Oct 14, 2021 at 18:51
  • I don't know to what extent this "from genesis eclipse attack" is mitigated by checkpoints in Core. Eclipse attacks are always viable if the attacker has significant network hash rate. Eclipse attacks that don't need any hash rate are cheaper to pull off (and hence more concerning imo). I think checkpoints are a partial but not entire mitigation against zero hash rate eclipse attacks. Oct 15, 2021 at 10:11
  • There's not really "checkpoints" in Bitcoin Core with the expectation that they are consensus critical.
    – Claris
    Oct 15, 2021 at 10:44
  • Definitely not consensus critical, agreed but as a flag/alert to being a victim of a "from genesis eclipse attack"? Oct 15, 2021 at 12:21


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.