So I have some scripts in place that check for btc1 nodes and ban them regularly.
Today I realized I have all the data available already so why not checking how many of nodes that advertise to the network as S2X run on AWS.
Amazon provides the list of their IP ranges here so it was fairly easy.
Here is my old script that gets the list of 2x nodes and saves them in a file.
Then there's the script that just goes through the list of IPs and checks whether they exist within the AWS IP range.
Those of you that know how to read PHP (probably almost everyone) can verify the source here (didn't want to put it on GitHub because it's a quick shit code).
Given how quickly the node count grew for btc1 it was obvious they're faking it. Now we have hard data that prove so.
For those that want to stop providing node resources to these attackers, feel free to ban them with these scripts.