Cereal2: TCP connection and session-pool flood variant 1

Shares are counted over the 3000 most recent observations, not the full 30 days.

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.