This post describes and discusses the behavior of an entity I call LinkingLion.
The entity opens connections to many Bitcoin nodes using four IP address ranges
and listens to transaction announcements. This might allow the entity to link
newly broadcast transactions to node IP addresses. The entity has been active in
some capacity since 2018 and is also active on the Monero network using the same
IP address ranges. The entity might be a blockchain analysis company collecting
data to improve its products.