[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #434366 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, August 25, 2026 3:47:45 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #434366 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 434366

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  38032800      126776        14.3%    23.218.225.128
  34188300      113961        12.8%     23.218.225.99
  18271800       60906         6.9%    23.218.225.115
  17716500       59055         6.7%     172.217.116.4
  17256300       57521         6.5%    23.218.225.121
   9186300       30621         3.4%    23.218.225.122
   8993100       29977         3.4%     172.217.117.4
   4965600       16552         1.9%      54.192.35.71
   4692600       15642         1.8%   172.217.168.155
   3127800       10426         1.2%      54.192.35.89

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  30371700      101239        11.4%   132.73.124.236
  26481300       88271         9.9%    132.74.56.157
  16815900       56053         6.3%    132.73.124.68
  13897500       46325         5.2%     132.70.60.33
  11954400       39848         4.5%    132.73.124.48
  11073300       36911         4.2%    132.73.124.94
   9159300       30531         3.4%    132.68.39.200
   5788500       19295         2.2%   132.73.124.220
   5705400       19018         2.1%    132.73.124.40
   4876200       16254         1.8%    132.72.23.183

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
  23.218.225.128        443                                 56068464900
  23.218.225.128                                            56068464900
   23.218.225.99        443                                 50369395800
   23.218.225.99                                            50369395800
                              132.73.124.236                44793387000
                        443   132.73.124.236                44791288500
                        443    132.74.56.157                38335586700
                               132.74.56.157                38335586700
  23.218.225.115        443                                 26919904800
  23.218.225.115                                            26919904800

Metric Info:
1M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate

Start Time: 2026-08-25 00:39:35
End Time: ongoing

First Event Seen: 2026-08-25 00:37:00
Last Event Seen: 2026-08-25 00:46:00

Further Details:
https://primary.nemo.geant.org/alerts/details/434366/