[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #434364 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, August 25, 2026 4:04:43 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #434364 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 434364

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  38032800      126776        15.6%    23.218.225.128
  34188300      113961        14.0%     23.218.225.99
  18271800       60906         7.5%    23.218.225.115
  17716500       59055         7.3%     172.217.116.4
  17256300       57521         7.1%    23.218.225.121
   9186300       30621         3.8%    23.218.225.122
   8991900       29973         3.7%     172.217.117.4
   4965600       16552         2.0%      54.192.35.71
   4692600       15642         1.9%   172.217.168.155
   3127800       10426         1.3%      54.192.35.89

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  30371700      101239        12.5%   132.73.124.236
  26481300       88271        10.9%    132.74.56.157
  16815900       56053         6.9%    132.73.124.68
  13897500       46325         5.7%     132.70.60.33
  11954400       39848         4.9%    132.73.124.48
  11073300       36911         4.5%    132.73.124.94
   9159300       30531         3.8%    132.68.39.200
   5788500       19295         2.4%   132.73.124.220
   5705400       19018         2.3%    132.73.124.40
   4876200       16254         2.0%    132.72.23.183

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
  23.218.225.128        443                                 56068464900
  23.218.225.128                                            56068464900
   23.218.225.99        443                                 50369395800
   23.218.225.99                                            50369395800
                              132.73.124.236                44793387000
                        443   132.73.124.236                44791288500
                        443    132.74.56.157                38335586700
                               132.74.56.157                38335586700
  23.218.225.115        443                                 26919904800
  23.218.225.115                                            26919904800

Metric Info:
852k ACK Packets/s

Alert Type:
time_window

Alert Description:
High ACK packet rate

Start Time: 2026-08-25 00:39:35
End Time: ongoing

First Event Seen: 2026-08-25 00:37:00
Last Event Seen: 2026-08-25 01:02:00

Further Details:
https://primary.nemo.geant.org/alerts/details/434364/