user24556: I'd like to know what's the probability of a sybil attack and if there are mechanisms built in to prevent this kind of attack?

user47827: It is impossible to say what the probability of a sybil attack is as (as far as I'm aware) there are no public data sources on how many users/nodes have been subject to sybil attacks and no reliable reporting when occurrences happen.
However, I think it is safe to say the probability of a normal user being subject to a sybil attack is pretty low as it is hard for the attacker to prevent you connecting to a single honest node and there is very little for an attacker to gain unless they have significant hash power and can compete in the mining of blocks. Without significant hash power all they can do is prevent you from receiving the latest blocks and latest transactions. There is more to gain from sybil attacking mining pools as in theory the attacker could prevent mined blocks from being propagated across the network and prevent them from receiving block reward(s).
With regards to mechanisms in say Bitcoin Core, it is impossible to identify ahead of time which peers are malicious and controlled by the same party. All nodes are treated the same on the network unless and until they start misbehaving (e.g. propagate invalid transactions, blocks). There is some ongoing work (asmap) to ensure greater diversification of peer selection through stronger bucketing. There are also various things you can do proactively as a user. If there is a node you trust you can connect to this peer manually. If you haven't been receiving blocks for a number of hours (and you have peers) you can check a block explorer (mempool.space, blockstream.info etc) to see if there have been blocks mined in this time. Although you generally shouldn't need to, doing out of band checks can give you the assurance that your node isn't subject to a sybil attack.

24556: <p>I'd like to know what's the probability of a sybil attack and if there are mechanisms built in to prevent this kind of attack?</p>
 47827: <p>It is impossible to say what the probability of a sybil attack is as (as far as I'm aware) there are no public data sources on how many users/nodes have been subject to sybil attacks and no reliable reporting when occurrences happen.</p>
<p>However, I think it is safe to say the probability of a normal user being subject to a sybil attack is pretty low as it is hard for the attacker to prevent you connecting to a single honest node and there is very little for an attacker to gain unless they have significant hash power and can compete in the mining of blocks. Without significant hash power all they can do is prevent you from receiving the latest blocks and latest transactions. There is more to gain from sybil attacking mining pools as in theory the attacker could prevent mined blocks from being propagated across the network and prevent them from receiving block reward(s).</p>
<p>With regards to mechanisms in say Bitcoin Core, it is impossible to identify ahead of time which peers are malicious and controlled by the same party. All nodes are treated the same on the network unless and until they start misbehaving (e.g. propagate invalid transactions, blocks). There is some ongoing work (<a href="https://blog.bitmex.com/call-to-action-testing-and-improving-asmap/" rel="nofollow noreferrer">asmap</a>) to ensure greater diversification of peer selection through stronger bucketing. There are also various things you can do proactively as a user. If there is a node you trust you can <a href="https://bitcoin.stackexchange.com/questions/41426/how-do-i-configure-bitcoin-core-to-connect-always-to-a-particular-node">connect</a> to this peer manually. If you haven't been receiving blocks for a number of hours (and you have peers) you can check a block explorer (<a href="https://mempool.space/" rel="nofollow noreferrer">mempool.space</a>, <a href="https://blockstream.info/" rel="nofollow noreferrer">blockstream.info</a> etc) to see if there have been blocks mined in this time. Although you generally shouldn't need to, doing out of band checks can give you the assurance that your node isn't subject to a sybil attack.</p>
