[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #246415 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, April 30, 2026 5:42:51 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #246415 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 246415

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  82709100      275697        19.2%          52.85.185.102
  39342600      131142         9.2%           52.85.185.16
  36432900      121443         8.5%           52.85.185.36
  13870200       46234         3.2%          20.209.242.65
  11682900       38943         2.7%           104.26.7.153
   9714600       32382         2.3%          13.107.136.10
   7293300       24311         1.7%          34.104.35.123
   6882600       22942         1.6%           3.174.255.71
   5361600       17872         1.2%           18.161.97.21
   5077200       16924         1.2%   2001:bf8:900:d:2::71

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  53701800      179006        12.5%      132.76.61.52
  45164100      150547        10.5%      132.76.61.51
  42050100      140167         9.8%      132.76.61.54
  40906800      136356         9.5%      132.76.61.53
  13870200       46234         3.2%       132.70.19.4
  11682900       38943         2.7%     132.77.33.152
  10717800       35726         2.5%   128.139.225.242
   8884200       29614         2.1%      132.68.38.57
   8797500       29325         2.0%     128.139.200.4
   8530200       28434         2.0%     128.139.200.5

Top-10 Possible Targets by Bytes:
         Src IP   Src Port         Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
  52.85.185.102        443                              121806391200
  52.85.185.102                                         121806391200
                             132.76.61.52                76322021400
                       443   132.76.61.52                76079765400
                             132.76.61.51                63958796700
                       443   132.76.61.51                63752022300
                             132.76.61.54                58302842400
                       443   132.76.61.54                58302775200
   52.85.185.16        443                               57935988300
   52.85.185.16                                          57935988300

Metric Info:
2M ACK Packets/s

Alert Type:
time_window

Alert Description:
High ACK packet rate.

Start Time: 2026-04-30 14:33:42
End Time: ongoing

First Event Seen: 2026-04-30 14:31:00
Last Event Seen: 2026-04-30 14:41:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/246415/