Not that I can see (refuse browsing, report 1.5GB), but there isn't really a good way of checking it.

They connect quite aggressively e.g. if I remove them, they (or neighbouring nodes within the same range, same Vendor-string, same port) connect back in 10 seconds. They send/receive a lot of data compared to any other leaf (more in line of what you expect from an very active UP) and come from 3 or 4 neighbouring /24-blocks. Without blocking them, they always seem to find me.

On G2, I see similar behaviour (e.g. nodes in datacenters with /24 blocks at their disposal) and they do spam.

It's quite difficult to extract spammy leafs/UP with the current range of options available in Phex. E.g. if I open up the search monitor, I see dozens of what appear to be non-legitimate search queries, but there aren't any filtering options (UPs/Leafs/TTL/Hops) or ways to extract the data. I'm also not sure how to get a good glimpse of results, as I can only see results by a filter. I tried to set only one UP connection (while being an UP) for a better/easier view but this only seemed to work once.