~dr|z3d
@RN
@T3s|4
@T3s|4_
@eyedeekay
@orignal
@postman
@zzz
%Liorar
%acetone
%snex
+FreefallHeavens
+Leopold
+Xeha
+ardu
+bak83_
+hk
+profetikla
+qend-irc2p
+r00tobo
+uop23ip
+weko
Arch
BubbRubb1
Danny
DeltaOreo
FreeB
HowardPlayzOfAdmin
Irc2PGuest10761
Irc2PGuest41581
Irc2PGuest5451
Irc2PGuest95056
Meow
Onn4l7h
Onn4|7h
StormyCloud_
T3s|4__
acetone_
anontor
boonst
evasiveStillness
l337
mareki2p_
maylay
not_bob_afk
not_human_
poriori_
r00tobo[2]
shiver_
solidx66_
thetia
u5657
zer0bitz
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.