Check the IPs on your list against
https://getaddr.bitnodes.io/ to see if they are actual Bitcoin XT nodes.
I think this is the same Russian source that is behind DDoS attacks against XT nodes.
see:
https://www.reddit.com/r/bitcoinxt/comments/3j7577/udp_flood_ddos_attacks_packet_analysis_and_attack/There are also some hexcodes in that response, which are apparently a Cyrillic UTF-8 text: " Пoкaзaнo 730 XT нoд зa пocлeдниe 1200 ceкyнд " which google translated as "Displaying 730 XT nodes in the last seconds of 1200".
So it looks like a specific tool to find XT nodes.
and:
https://www.reddit.com/r/bitcoinxt/comments/3iumsr/udp_flood_ddos_attacks_against_xt_nodes/cukjn86[–]ivan31337 -3 points 4 days ago
I have long use r/Bitcoins and I like it very much.
I watch the fight fork XT and I like it all stopped. because my savings can depreciate.
Since there is a link between coinwallet.eu (DDoS attack on the Bitcoin network) and XT, as well as hirkom and Andersen, I decided to contribute to the fight for a just cause
Well, what do you want? if I do mess (r/Bitcoin network attacks and planned attacks in September) then be prepared for a retaliatory lawlessness.
For clean and free future!
Looks like a Russian Bitcoin Core supporter (I'm sure no one wants this kind of support) is trying to knock down XT nodes from the network. So far he has been quite succesful and many people running XT nodes have been forced to quit doing so as their internet connection went down due to these UDP flood attacks (which are still ongoing). My node was under attack too, which caused my ISP supplied ADSL modem to crash.
Someone also started a DDoS attack against Slush's voting port for BIP 101, which made them to disable voting.
https://mining.bitcoin.cz/news/