Why would running a full node on amazons service be any problem if its legit? Unless I am missing something?
None of them are full nodes, they all run on some "bitcoinj" version.
-snip-
I've updated my graph once more, and it seems that the problem is gone (for now).
Thanks, I have a working script that automatically scans for these connections, adds the IP to a log file and bans them for a day now.