What exactly is suspicious_hosts.txt ?

[BlackHatCoiner]

https://github.com/bitcoin/bitcoin/blob/master/contrib/seeds/suspicious_hosts.txt

Are they people who tried to fool the blockchain?

[1715389296]

1715389296

[cryptomaniac_xxx]

If you looked closely:

# These are hosts that have been observed to be behaving strangely (e.g.
# aggressively connecting to every node).

https://github.com/bitcoin/bitcoin/commit/e1c582cbaa4c094d204da34c3b1fdd0d4c557519

[BlackHatCoiner]

If you looked closely:

# These are hosts that have been observed to be behaving strangely (e.g.
# aggressively connecting to every node).

https://github.com/bitcoin/bitcoin/commit/e1c582cbaa4c094d204da34c3b1fdd0d4c557519

Yes but what stops them? They can simply change ip.

[20kevin20]

Well, even if a suspicious host changes their IP and tries to attack again, the most logical idea is that their new try of an attack gets rejected again and added to the file. Once the first attack gets blocked, no matter what other IP they switch to, the block will occur for the second, third (and so on) try too..

Someone with a more advanced technical knowledge about BTC could correct me if I'm wrong. I'm just going for the common sense.

[nc50lc]

That looks like a part of the 'DNS Seed' that Core uses to "jump-start" the connection to the network.
The purpose must be to minimize the risk of new nodes connecting to those node instead of the proper ones, but that's quite a small list compared to an active node's own banlist.dat.

Yes but what stops them? They can simply change ip.

As I've said above, your node have its own "banlist" and will automatically ban the IP of misbehaving peers for 24hrs (default) if it detected a malicious activity.