[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #258318 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, August 1, 2026 12:19:00 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #258318 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 258318

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  63744300      212481        21.5%   23.218.225.128
  57110400      190368        19.3%    23.218.225.99
  26194500       87315         8.8%   23.218.225.121
   6148200       20494         2.1%    172.217.118.4
   3386100       11287         1.1%   17.253.122.201
   2477700        8259         0.8%    20.209.242.65
   2432700        8109         0.8%   154.61.149.102
   2162400        7208         0.7%      192.114.7.2
   1815000        6050         0.6%   23.218.225.120
   1614900        5383         0.5%   155.133.226.39

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  19637400       65458         6.6%    132.73.124.72
  19601100       65337         6.6%    132.69.204.87
  15205800       50686         5.1%    132.66.102.40
  14678100       48927         5.0%    132.73.124.48
  11664900       38883         3.9%     132.73.124.8
  10719000       35730         3.6%    132.73.124.68
   7079700       23599         2.4%   132.73.124.220
   6358200       21194         2.1%   132.73.124.216
   6290400       20968         2.1%   132.73.124.112
   6087600       20292         2.1%    132.74.74.134

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
  23.218.225.128        443                                93800856300
  23.218.225.128                                           93800856300
   23.218.225.99        443                                83953782000
   23.218.225.99                                           83953782000
  23.218.225.121        443                                38497864500
  23.218.225.121                                           38497864500
                              132.69.204.87                28870134000
                              132.73.124.72                28857152400
                        443   132.73.124.72                28856220900
                        443   132.69.204.87                25765623300

Metric Info:
1M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate.

Start Time: 2026-08-01 09:15:08
End Time: ongoing

First Event Seen: 2026-08-01 09:12:00
Last Event Seen: 2026-08-01 09:16:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/258318/