Ran some analysis: • kind 1 note containing base64-encoded binary • magic bytes: PARS (0x50415253), version 1 (LE uint32) • 9-byte header, 660 bytes of opaque payload Whatever this "PARS" is, these headers are now being blocked from my relay until I have more evidence that this isn't nefarious or spammy behaviour.

could be some form of novel custom encryption first note by that npub is this string, could be a public key for the encryption. Maybe worth looking into that one

Yes indeed! I noticed that from all accounts sending these payloads, and also blocked those headers from publishing on my relay. I feel like it could be a botnet coordinating on nostr or something like that.