~dr|z3d
@RN_
@StormyCloud
@orignal
@postman
@zzz
%Liorar
%acetone
%cumlord
%snex
+FreefallHeavens
+H20
+HowardPlayzOfAdmin
+Irc2PGuest8966
+Onn4l7h
+Sh0ck
+bak83
+leopold_
+qend-irc2p
+r00tobo_BNC
+uop23ip
Arch
BubbRubb
Dann
DeltaOreo
Irc2PGuest10122
Irc2PGuest16546
Irc2PGuest82658
Maylay
Meow
ac9f
anontor
coolbuddy799
duck
halloy13412
makoto
mareki2p_
nZDoYBkF_
nilbog-
not_bob_afk
poriori_
profetik1
r00tobo[2]
shiver_1
simprelay
solidx66
thetia
u5657
vivid_reader56
wtfman
zer0bitz
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.