~dr|z3d
@RN
@RN_
@T3s|4_
@orignal
@postman
@zzz
%Liorar
%RTP
%cumlord
%snex
+FreefallHeavens
+Onn4l7h
+Sh0ck
+leopold
+nyaa2pguy
+onon_
+profetikla
+qend-irc2p
+r00tobo_BNC
+uop23ip
+waffles
Arch
Danny
H20
Irc2PGuest18755
Irc2PGuest31013
Irc2PGuest31149
Irc2PGuest36717
Irc2PGuest47681
Irc2PGuest57061
Irc2PGuest62007
Irc2PGuest96878
Meow
Over1
T3s|4
acetone_
anontor
duck
floatyfloatilla
halloy13412
mahlay
makoto
mareki2p_
nZDoYBkF__
not_bob_afk2
null911
poriori_
quack
r00tobo[2]
shaye
shiver_
solidx66
thetia
u5657
user1
vivid_reader56
zer0bitz
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.