~dr|z3d
@RN_
@not_bob
@postman
@zzz
%acetone
%cumlord
%snex
+BeepyBee
+FreefallHeavens
+Onn4l7h
+Onn4|7h
+Over
+dollarthief
+nyaa2pguy
+onon_
+profetikla
+qend-irc2p
Arch
BravoOreo
BubbRubb
Danny
H20
Irc2PGuest41816
Irc2PGuest49393
Irc2PGuest56769
Irc2PGuest65329
Irc2PGuest83366
Irc2PGuest90684
Meow
StormyCloud__
ac9f
anontor
floatyfloatilla
gellegery
halloy13412
ka2
mahlay
makoto
mareki2p_
n1
nZDoYBkF
nilbog
ntty
orignal_
poriori_
r00tobo[2]
r00tobo_BNC
shiver_
simprelay
solidx66_
thetia
u5657
uop23ip_
user1
vivid_reader56
waffles
zer0bitz
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.