~dr|z3d
@RN
@RN_
@StormyCloud
@T3s|4
@T3s|4_
@eyedeekay
@postman
@zzz
%Liorar
%acetone
%ardu
%cumlord
%mareki2p
+FreefallHeavens
+HowardPlayzOfAdmin
+Onn4l7h
+Onn4|7h
+Over
+Rogueone
+Xeha
+hk
+profetikla
+qend-irc2p
+r00tobo
+romer
+waffles
+xHarr
Arch
BravoOreo
BubbRubb
C341
Danny
FreeB
Irc2PGuest52770
Irc2PGuest77400
Irc2PGuest95505
Irc2PGuest98773
Meow
Sh0ck_
aisle
anontor
halloy13412
maylay
moe
nilbog
nnm--
not_bob_afk
orignal_
pisslord
poriori_
pory
r00tobo[2]
shiver_
simprelay
solidx66
thetia
u5657
uop23ip
weko_
wew-
zer0bitz_
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.