Just recently I had multiple IN connections from IP address 20.77.2.177 from different port numbers. On one relay - 20+ connections, on the other 100+ connections ! They are blocked now by firewall.
Anyone else has or had the same thing going on?
Sometimes can happen, u can limit to accept only one connection from same source
Also u can find the node (if is public) searching by ip or dns in mainnet topology file
similar experience just recently happened:
I blocked the IP but if this starts to be a common thing maybe it is worth to setup a list for allow IPs from topology what @Alexd1985 posted
Thank you both.