~dr|z3d
@RN
@RN_
@StormyCloud
@T3s|4
@T3s|4_
@eyedeekay
@not_bob_afk
@orignal
@postman
@zzz
%Liorar
%cumlord
%snex
+FreefallHeavens
+Xeha
+ardu
+bak83_
+mareki2p
+poriori
+profetikla
+qend-irc2p
+r00tobo
+segfault
+uop23ip
Arch
BubbRubb
Danny
DeltaOreo
FreeB
Irc2PGuest24477
Irc2PGuest53616
Irc2PGuest58427
Irc2PGuest96694
Leopold_
Meow
Onn4l7h
Onn4|7h
acetone_
anontor
b4dab00m
boonst
maylay
not_human_
onon_1
pisslord
r3med1tz-
shiver_
simprelay
solidx66
thetia
thirtyseven
u5657
usr002
weko_
zer0bitz_
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.