@RN
@RN_
@StormyCloud
@orignal
@postman
@zzz
%acetone
%mareki2p
%snex
+Atticfire
+Onn4l7h
+Onn4|7h
+Over
+fa
+leopold
+onon_
+poriori
+profetikla
+qend-irc2p
+uberius
+uop23ip
Arch
Danny
Holmes
Irc2PGuest13697
Irc2PGuest28384
Irc2PGuest29227
Irc2PGuest44044
Irc2PGuest45204
Irc2PGuest59582
Irc2PGuest65829
Irc2PGuest9338
Meow
RTP_
T3s|4
T3s|4_
ahiru
anontor
cims
entity
i2potus
interesting
justaperson
maylay
n2_
nilbog
nnm--
not_bob_afk
pinotto
r00tobo[2]
red
sexy
user1
user_ygg2
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.