@RN
@postman
@zzz
%RTP
+Gully
+NiceBoat
+Onn4l7h
+Over
+bpb
+f00b4r
+leopold
+marek22k
+poriori
+profetikla
+r00tobo_BNC
+uop23ip
Arch
Danny
Irc2PGuest31672
Irc2PGuest44883
Irc2PGuest45203
Irc2PGuest76721
Irc2PGuest93219
Irc2PGuest97705
Meow
Teeed
U1F642
acetone
ahiru_
altec
anontor
mahlay
makoto
n2
nilbog
noidea_
not_bob_afk2
ntty
orignal
qend-irc2p_
r00tobo[2]
shiver_
solidx66
user45
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.