~dr|z3d
@RN
@StormyCloud
@T3s|4
@eyedeekay
@postman
@zzz
%Liorar
%acetone
%cumlord
+DirtyHarry
+ardu
+bak83_
+mareki2p
+onon_
+profetikla
+r00tobo
+radakayot
+uop23ip
AHON1
Arch2
Danny
DeltaOreo
FreeB
FreefallHeavens
Irc2PGuest53192
Irc2PGuest59581
Irc2PGuest64993
Irc2PGuest70134
Irc2PGuest96449
Meow
Onn4l7h
Onn4|7h
T3s|4_
Xeha
b4dab00m
boonst
duck
enoxa
maylay
not_bob_afk
orignal
phobos_
pisslord
poriori_
qend-irc2p
segfault
shiver_1
simprelay
solidx66
u5657
zer0bitz_
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.