Sybil is more related to your addresses and wallets use for on chain transactions. One wallet can have many addresses and if you use many addresses in a same wallet for your retroactive airdrop, it can affect your chance to be eligible for claiming airdrop reward from the team distribution.
There would be special pattern to detect it. Any blockchain analyzation has different patterns in detecting the sybil attack. I remember when someone posted if he has detected someone who owned more than 21k wallet used for zksync retro.
How can we identify person to person transcation as a sybil attack? It's caused by the main purpose of blockchain is to sending your money to others.
This is why specific criterias are needed in determining the sybil attack.
IP address does not make sense.
That's true.