~dr|z3d
@RN
@RN_
@StormyCloud
@T3s|4
@T3s|4_
@eyedeekay
@orignal
@postman
@zzz
%Liorar
+FreefallHeavens_
+Snowflakes
+Xeha
+bak83_
+cumlord
+profetikla
+r00tobo
+uop23ip
+weko
Arch
DeltaOreo
Irc2PGuest52978
Irc2PGuest99152
Meow
Nausicaa
Onn4l7h
Onn4|7h
Over1
acetone_
anon2
anu
boonst
dickless
mareki2p_
mareki2pb
not_bob_afk
poriori_
qend-irc2p
r3med1tz
radakayot_
segfault
shiver_
simprelay
solidx66
thetia
u5657
woodwose
dr|z3d
so, yeah, orignal, you probably want to track routers with rapidly cycling ips and block them, if you don't have an explicit blocklist.
dr|z3d
regarding the router earlier, if it's communicating with a botnet, it may require a ton of tunnels, each of which probably isn't using much if any traffic.