So basically full node in your definition is a node/wallet with public IP address, "listen=1" set in the spreadcoin.conf, and port 41678 open in firewall.
I don't think your definitions of 'full node' and 'leech' (this term comes from torrents afaik), are commonly used/accepted ones, but anyway, got it, thanks.
this definition is pretty standard.
Look, if no one opened port 41678 there wouldn't be a network,
because a normal wallet with closed port can only initiate connections TO A FULL NODE (because it will allow that).
If we only had normal wallets no blocks would ever get distributed.
Why do you think the russian IP is a GPU farm? It might be a wallet behind a symmetric nat/firewall, which is just changing ports often, without properly closing old connections.
that's a pretty weird explanation
, I like mine better, because it fits with what I have observed for quite some time now.
Also, getpeerinfo shows that packages are distributed to this IP on all connections all the time (blocksrequested, lastrecv, lastsend, etc), which would make sense if this was a GPU farm.
And yes, it DOES fit the definition of "leech" that one IP is responsible for half the bandwidth of the full node.