Question About Potential Single ElectrumX Cluster with Identical TLS CN

[fulctables]

Description

Hello Electrum developers,

I am investigating a set of public ElectrumX nodes (around 80 IPs, running version 1.19.0) that appear in Electrum clients' list of possible connections and share the same TLS Common Name (CN).
Most of these nodes are hosted on Google Cloud Platform (GCP).
Some of the addresses also appear in the public list at https://1209k.com/bitcoin-eye/ele.php.

My observations and questions:

1. Given that many nodes share the same TLS CN, is it reasonable to assume they belong to a single cluster?
2. Could these nodes instead represent multiple known public ElectrumX clusters, despite having the same TLS CN?
3. Are there any privacy or security implications for Electrum clients connecting to this set of nodes?
4. How does Electrum choose nodes when there is a large set of public ElectrumX servers?
5. If this question is not appropriate for this repository or scope, could you advise where I might direct it to get proper clarification?

List of nodes:

136.107.155.173 50001 50002 ElectrumX 1.19.0
136.107.225.110 50001 50002 ElectrumX 1.19.0
136.107.72.87 50001 50002 ElectrumX 1.19.0
136.110.114.84 50001 50002 ElectrumX 1.19.0
136.110.67.212 50001 50002 ElectrumX 1.19.0
34.101.170.221 50001 50002 ElectrumX 1.19.0
34.101.39.54 50001 50002 ElectrumX 1.19.0
34.116.254.239 50001 50002 ElectrumX 1.19.0
34.118.1.54 50001 50002 ElectrumX 1.19.0
34.121.73.82 50001 50002 ElectrumX 1.19.0
34.128.68.204 50001 50002 ElectrumX 1.19.0
34.128.81.215 50001 50002 ElectrumX 1.19.0
34.13.139.195 50001 50002 ElectrumX 1.19.0
34.133.127.109 50001 50002 ElectrumX 1.19.0
34.138.250.15 50001 50002 ElectrumX 1.19.0
34.141.75.29 50001 50002 ElectrumX 1.19.0
34.153.192.8 50001 50002 ElectrumX 1.19.0
34.159.103.181 50001 50002 ElectrumX 1.19.0
34.159.228.34 50001 50002 ElectrumX 1.19.0
34.171.34.8 50001 50002 ElectrumX 1.19.0
34.172.232.121 50001 50002 ElectrumX 1.19.0
34.173.233.138 50001 50002 ElectrumX 1.19.0
34.174.156.170 50001 50002 ElectrumX 1.19.0
34.174.158.243 50001 50002 ElectrumX 1.19.0
34.174.167.84 50001 50002 ElectrumX 1.19.0
34.174.217.104 50001 50002 ElectrumX 1.19.0
34.174.46.235 50001 50002 ElectrumX 1.19.0
34.175.239.109 50001 50002 ElectrumX 1.19.0
34.179.190.163 50001 50002 ElectrumX 1.19.0
34.18.66.115 50001 50002 ElectrumX 1.19.0
34.18.69.244 50001 50002 ElectrumX 1.19.0
34.19.148.24 50001 50002 ElectrumX 1.19.0
34.19.234.1 50001 50002 ElectrumX 1.19.0
34.21.56.132 50001 50002 ElectrumX 1.19.0
34.32.12.235 50001 50002 ElectrumX 1.19.0
34.32.226.149 50001 50002 ElectrumX 1.19.0
34.32.36.131 50001 50002 ElectrumX 1.19.0
34.32.48.252 50001 50002 ElectrumX 1.19.0
34.32.48.56 50001 50002 ElectrumX 1.19.0
34.32.51.209 50001 50002 ElectrumX 1.19.0
34.38.117.239 50001 50002 ElectrumX 1.19.0
34.39.9.100 50001 50002 ElectrumX 1.19.0
34.40.149.244 50001 50002 ElectrumX 1.19.0
34.47.18.226 50001 50002 ElectrumX 1.19.0
34.47.183.146 50001 50002 ElectrumX 1.19.0
34.47.55.201 50001 50002 ElectrumX 1.19.0
34.48.222.31 50001 50002 ElectrumX 1.19.0
34.50.93.134 50001 50002 ElectrumX 1.19.0
34.64.177.133 50001 50002 ElectrumX 1.19.0
34.7.95.198 50001 50002 ElectrumX 1.19.0
34.77.81.160 50001 50002 ElectrumX 1.19.0
34.84.171.172 50001 50002 ElectrumX 1.19.0
34.87.220.132 50001 50002 ElectrumX 1.19.0
34.87.227.41 50001 50002 ElectrumX 1.19.0
34.88.214.4 50001 50002 ElectrumX 1.19.0
34.90.51.226 50001 50002 ElectrumX 1.19.0
34.93.250.242 50001 50002 ElectrumX 1.19.0
34.93.251.171 50001 50002 ElectrumX 1.19.0
34.94.210.245 50001 50002 ElectrumX 1.19.0
34.96.220.189 50001 50002 ElectrumX 1.19.0
35.189.13.187 50001 50002 ElectrumX 1.19.0
35.190.233.80 50001 50002 ElectrumX 1.19.0
35.194.147.142 50001 50002 ElectrumX 1.19.0
35.197.22.214 50001 50002 ElectrumX 1.19.0
35.198.35.60 50001 50002 ElectrumX 1.19.0
35.200.169.149 50001 50002 ElectrumX 1.19.0
35.200.205.108 50001 50002 ElectrumX 1.19.0
35.203.107.152 50001 50002 ElectrumX 1.19.0
35.204.93.87 50001 50002 ElectrumX 1.19.0
35.205.207.213 50001 50002 ElectrumX 1.19.0
35.205.222.207 50001 50002 ElectrumX 1.19.0
35.221.221.16 50001 50002 ElectrumX 1.19.0
35.225.75.62 50001 50002 ElectrumX 1.19.0
35.233.45.83 50001 50002 ElectrumX 1.19.0
35.238.228.147 50001 50002 ElectrumX 1.19.0
35.244.75.164 50001 50002 ElectrumX 1.19.0
35.244.75.18 50001 50002 ElectrumX 1.19.0
35.244.89.238 50001 50002 ElectrumX 1.19.0
35.246.146.80 50001 50002 ElectrumX 1.19.0

Any clarification regarding the ownership, clustering, or security of these nodes would be greatly appreciated.
Thank you for your time and support!

[SomberNight]

Hey. Looks interesting.

1. Given that many nodes share the same TLS CN, is it reasonable to assume they belong to a single cluster?
2. Could these nodes instead represent multiple known public ElectrumX clusters, despite having the same TLS CN?

I have only checked a few of the listed nodes but they indeed look like they might be sybils set up by a single entity.

They use self-signed SSL certs, and besides the Common Name looking similar, the certs were all created around the same time. Some were created only seconds apart.

$ openssl x509 -in ~/.electrum/certs/136.107.225.110 -noout -text
[...]
        Serial Number:
            3d:bd:ab:51:22:58:dc:f4:41:75:8b:79:02:2b:f8:e6:96:b4:40:1d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=ENG, L=London, CN=electrumx-us-east4-node-3
        Validity
            Not Before: Mar 26 19:42:52 2026 GMT
            Not After : Mar 25 19:42:52 2028 GMT
[...]

        Serial Number:
            1e:44:b2:d6:fb:84:bb:6d:39:0c:64:88:dd:b6:05:77:44:c6:71:4e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=JP, ST=13, L=Tokyo, CN=electrumx-us-east4-node-4
        Validity
            Not Before: Mar 26 19:43:02 2026 GMT
            Not After : Mar 25 19:43:02 2028 GMT

3. Are there any privacy or security implications for Electrum clients connecting to this set of nodes?

see https://electrum.readthedocs.io/en/latest/faq.html#does-electrum-trust-servers

By default the client connects to random servers, so if an attacker runs many servers, they have a good chance that a client will connect to some of them.

Sure, there are privacy implications: if the attacker manages to get the client select one of their servers as the main/history server, then they will learn the wallet addresses of the client.

Also, by default the client for the ETA fee estimates uses the median from the 10 connected servers: if the client connects to 6+ attacker servers out of the 10 slots, the attacker can fully influence the fee estimates (within hard limits).

If the attacker runs so many servers that they manage to fill all 10 slots of the client, they can also eclipse the block header chain view of the client. This only gets interesting if the attacker also has enough hash power to mine a block - in that case they can try to fake tx confirmations (e.g. with 1% hashpower they might mine a tx in a block in a fork that is 100 blocks behind the real main chain, and present that to the client - normally the client would show that the connected server is lagging but not if it is eclipsed).

4. How does Electrum choose nodes when there is a large set of public ElectrumX servers?

For clearnet IPv4 connections, the client buckets servers into /16 subnets, and only connects to one server per bucket.
(This is re the 10 total number of server connections that the client maintains.)

In general, see network.py and interface.py for this logic.

[f321x]

Somewhat related, I, for fun sake, asked Claude to implement AS bucketing (asmap) in Electrum.
The implementation turned out to be surprisingly simple (except maybe for the asmap parser, but it is fully isolated from existing logic, so the potential for introducing regressions seems low).

Testing it with the IPs from this issue the master branch bucketing creates 54 buckets while the asmap bucketing puts all IP addresses in a single bucket (AS396982, Google Cloud Platform) with the current asmap data.

This seems to be quite effective (at least in increasing the cost to spin up a sybil), it might make sense for us to actually consider reviewing this approach.

(env) user@fedora:/var/home/user/code/vibecoding_vm/electrum$ python3 compare_asmap_bucketing.py 
loaded asmap: /var/home/user/code/vibecoding_vm/electrum/electrum/asmap/asmap.dat
  size   = 1519688 bytes
  sha256 = 478d61986c59365cf86cd244485bbbe76a9ca0c630864717286dd19949879074
  ips    = 79

=== master branch (/16 for IPv4, /48 for IPv6) ===
distinct buckets: 54
  34.32.0.0/16         [ 6]  34.32.12.235, 34.32.226.149, 34.32.36.131, 34.32.48.252, 34.32.48.56, 34.32.51.209
  34.174.0.0/16        [ 5]  34.174.156.170, 34.174.158.243, 34.174.167.84, 34.174.217.104, 34.174.46.235
  136.107.0.0/16       [ 3]  136.107.155.173, 136.107.225.110, 136.107.72.87
  34.47.0.0/16         [ 3]  34.47.18.226, 34.47.183.146, 34.47.55.201
  35.244.0.0/16        [ 3]  35.244.75.164, 35.244.75.18, 35.244.89.238
  136.110.0.0/16       [ 2]  136.110.114.84, 136.110.67.212
  34.101.0.0/16        [ 2]  34.101.170.221, 34.101.39.54
  34.128.0.0/16        [ 2]  34.128.68.204, 34.128.81.215
  34.159.0.0/16        [ 2]  34.159.103.181, 34.159.228.34
  34.18.0.0/16         [ 2]  34.18.66.115, 34.18.69.244
  34.19.0.0/16         [ 2]  34.19.148.24, 34.19.234.1
  34.87.0.0/16         [ 2]  34.87.220.132, 34.87.227.41
  34.93.0.0/16         [ 2]  34.93.250.242, 34.93.251.171
  35.200.0.0/16        [ 2]  35.200.169.149, 35.200.205.108
  35.205.0.0/16        [ 2]  35.205.207.213, 35.205.222.207
  34.116.0.0/16        [ 1]  34.116.254.239
  34.118.0.0/16        [ 1]  34.118.1.54
  34.121.0.0/16        [ 1]  34.121.73.82
  34.13.0.0/16         [ 1]  34.13.139.195
  34.133.0.0/16        [ 1]  34.133.127.109
  34.138.0.0/16        [ 1]  34.138.250.15
  34.141.0.0/16        [ 1]  34.141.75.29
  34.153.0.0/16        [ 1]  34.153.192.8
  34.171.0.0/16        [ 1]  34.171.34.8
  34.172.0.0/16        [ 1]  34.172.232.121
  34.173.0.0/16        [ 1]  34.173.233.138
  34.175.0.0/16        [ 1]  34.175.239.109
  34.179.0.0/16        [ 1]  34.179.190.163
  34.21.0.0/16         [ 1]  34.21.56.132
  34.38.0.0/16         [ 1]  34.38.117.239
  34.39.0.0/16         [ 1]  34.39.9.100
  34.40.0.0/16         [ 1]  34.40.149.244
  34.48.0.0/16         [ 1]  34.48.222.31
  34.50.0.0/16         [ 1]  34.50.93.134
  34.64.0.0/16         [ 1]  34.64.177.133
  34.7.0.0/16          [ 1]  34.7.95.198
  34.77.0.0/16         [ 1]  34.77.81.160
  34.84.0.0/16         [ 1]  34.84.171.172
  34.88.0.0/16         [ 1]  34.88.214.4
  34.90.0.0/16         [ 1]  34.90.51.226
  34.94.0.0/16         [ 1]  34.94.210.245
  34.96.0.0/16         [ 1]  34.96.220.189
  35.189.0.0/16        [ 1]  35.189.13.187
  35.190.0.0/16        [ 1]  35.190.233.80
  35.194.0.0/16        [ 1]  35.194.147.142
  35.197.0.0/16        [ 1]  35.197.22.214
  35.198.0.0/16        [ 1]  35.198.35.60
  35.203.0.0/16        [ 1]  35.203.107.152
  35.204.0.0/16        [ 1]  35.204.93.87
  35.221.0.0/16        [ 1]  35.221.221.16
  35.225.0.0/16        [ 1]  35.225.75.62
  35.233.0.0/16        [ 1]  35.233.45.83
  35.238.0.0/16        [ 1]  35.238.228.147
  35.246.0.0/16        [ 1]  35.246.146.80

=== asmap_claude branch (ASN via asmap, /16,/48 fallback) ===
distinct buckets: 1
  AS396982             [79]  136.107.155.173, 136.107.225.110, 136.107.72.87, 136.110.114.84, 136.110.67.212, 34.101.170.221, 34.101.39.54, 34.116.254.239, 34.118.1.54, 34.121.73.82, 34.128.68.204, 34.128.81.215, 34.13.139.195, 34.133.127.109, 34.138.250.15, 34.141.75.29, 34.153.192.8, 34.159.103.181, 34.159.228.34, 34.171.34.8, 34.172.232.121, 34.173.233.138, 34.174.156.170, 34.174.158.243, 34.174.167.84, 34.174.217.104, 34.174.46.235, 34.175.239.109, 34.179.190.163, 34.18.66.115, 34.18.69.244, 34.19.148.24, 34.19.234.1, 34.21.56.132, 34.32.12.235, 34.32.226.149, 34.32.36.131, 34.32.48.252, 34.32.48.56, 34.32.51.209, 34.38.117.239, 34.39.9.100, 34.40.149.244, 34.47.18.226, 34.47.183.146, 34.47.55.201, 34.48.222.31, 34.50.93.134, 34.64.177.133, 34.7.95.198, 34.77.81.160, 34.84.171.172, 34.87.220.132, 34.87.227.41, 34.88.214.4, 34.90.51.226, 34.93.250.242, 34.93.251.171, 34.94.210.245, 34.96.220.189, 35.189.13.187, 35.190.233.80, 35.194.147.142, 35.197.22.214, 35.198.35.60, 35.200.169.149, 35.200.205.108, 35.203.107.152, 35.204.93.87, 35.205.207.213, 35.205.222.207, 35.221.221.16, 35.225.75.62, 35.233.45.83, 35.238.228.147, 35.244.75.164, 35.244.75.18, 35.244.89.238, 35.246.146.80

=== summary ===
master  :  54 buckets, largest bucket = 6 IPs
asmap   :   1 buckets, largest bucket = 79 IPs