An Anonymous ‘Entity’ has been Linking Bitcoin Addresses to the User's IP address and Transactions to Sell User Data

The reason behind this activity might be that companies looking to make money by selling data to other firms, law enforcement, or academic researchers.

In this particular case, most probably it's about making revenue by selling user data due to the fact that the IP address ranges and servers cost money, and this activity has to be worth it to the entity.

This has been going on since 2018 and no papers has been published, so most probably it's not for academic researchers, but sold to another company.

(Technical background of the Activity: it does this by using 812 IP addresses to open connections with nodes and ask what Bitcoin software they’re using. When it receives a version number, 82% of the time it ceases contact. However, in the remaining 18% of cases, it listens for inventory messages containing transactions or requests an address. This may be because it’s trying to find out if a node is reachable at a specific IP address.)

Source(1): https://b10c.me/observations/06-linkinglion/?t