~dr|z3d
@RN
@RN_
@Stormycloud
@T3s|4_
@eyedeekay
@orignal
@postman
%Liorar
%cumlord
%mareki2p
+FreefallHeavens
+Onn4l7h
+Over
+Sh0ck
+Xeha
+bak83
+leopold
+marek22k
+poriori
+profetikla
+qend-irc2p
+r00tobo_BNC
+romer
+uop23ip
+waffles
+xHarr
Arch
BubbRubb1
Danny
DeltaOreo
Irc2PGuest12689
Irc2PGuest43227
Irc2PGuest66043
Maylay
Meow
ac9f
acetone_
anon
anontor2
combed_tree328
duck
john231
makoto
nZDoYBkF_
nilbog
not_bob_afk
ntty`
r00tobo[2]
shiver_1
simprelay
solidx66
thetia
u5657
vivid_reader56
zer0bitz_
zzz2
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.