~dr|z3d
@RN
@StormyCloud
@T3s|4
@orignal
@postman
@zzz
%Liorar
%cumlord
%mareki2p
%snex
+FreefallHeavens
+Irc2PGuest18116
+Onn4l7h
+Onn4|7h
+Over
+dollarthief
+profetikla
+qend-irc2p
+r00tobo
+uop23ip
+waffles
Arch
BubbRubb
Dann
DeltaOreo
H20
Irc2PGuest25054
Irc2PGuest37630
Irc2PGuest59851
Irc2PGuest69651
Irc2PGuest74254
Irc2PGuest84883
Meow
Stormycloud_
T3s|4_
Uncrushed
Uncrushed-otr
ac9f_
acetone_
anontor
b4dab00m
floatyfloatilla
fus3r1
gellegery
mahlay
makoto
n1
nZDoYBkF
nilbog
onon_
poriori_
r00tobo[2]
shaye
shiver_
simprelay
solidx66
thetia
u5657
vivid_reader56
wtfman
zer0bitz
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.