@RN_
@StormyCloud
@T3s|4
@T3s|4_
@orignal
@postman
@zzz
%Liorar
%RTP
+FreefallHeavens
+Gully
+NiceBoat
+Onn4l7h
+Onn4|7h
+Over
+altec
+leopold_
+nyaa2pguy
+poriori
+profetikla
+qend-irc2p
+quack
+r00tobo
+uop23ip
+waffles
Arch
Danny
Irc2PGuest15273
Irc2PGuest3774
Irc2PGuest56290
Irc2PGuest71529
Irc2PGuest77921
MatrixBot
Meow
U1F642
WaAmH__
acetone_
ahiru_
anontor2
floatyfloatilla
mahlay
makoto
n2_
nZDoYBkF_
nilbog
not_bob_afk
o3d3_
r00tobo[2]
rednode
solidx66
stormycloud[m]
vivid_reader56
waffles_
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.