~dr|z3d
@RN
@RN_
@Stormycloud
@T3s|4
@eyedeekay
@orignal
@postman
@zzz
%acetone
%ardu
%cumlord
%snex
+FreefallHeavens
+Onn4l7h
+Onn4|7h
+Xeha
+bak83
+poriori
+profetikla
+qend-irc2p
+r00tobo
+uop23ip
+weko
+wew
Arch
BubbRubb
C341
Danny
DeltaOreo
FreeRider
Irc2PGuest12542
Irc2PGuest50385
Irc2PGuest57893
Irc2PGuest5939
Irc2PGuest94314
Liorar_
Meow
anontor
b4dab00m
halloy13412
maylay
moe
not_bob_afk
pisslord
r00tobo[2]
shaye
shiver_
simprelay
solidx66
thetia
u5657
woodwose
zer0bitz
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.