[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #256631 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 21, 2026 3:44:05 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #256631 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 256631

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  54188700      180629        22.2%    23.218.225.99
  36946200      123154        15.1%   23.218.225.128
  32630700      108769        13.4%   23.218.225.121
  15630600       52102         6.4%   216.239.38.223
   4902600       16342         2.0%   216.239.34.223
   4565400       15218         1.9%   216.239.32.223
   3819900       12733         1.6%    34.104.35.123
   3106500       10355         1.3%    13.107.138.10
   2411100        8037         1.0%   95.101.122.184
   2309700        7699         0.9%   95.101.122.170

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  93939000      313130        38.5%    132.73.124.216
  17059200       56864         7.0%    132.73.124.176
  12543000       41810         5.1%     132.74.56.132
   9412800       31376         3.9%      132.73.124.8
   6993000       23310         2.9%     192.114.3.241
   5925300       19751         2.4%     132.74.74.134
   4844700       16149         2.0%     132.72.23.183
   4262100       14207         1.7%   128.139.225.242
   4161300       13871         1.7%     132.64.81.128
   4119300       13731         1.7%     192.114.88.10

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              132.73.124.216               138420811500
                        443   132.73.124.216               138417834900
   23.218.225.99        443                                 79816558800
   23.218.225.99                                            79816558800
  23.218.225.128        443                                 54435728100
  23.218.225.128                                            54435728100
  23.218.225.121        443                                 48049725300
  23.218.225.121                                            48049725300
                              132.73.124.176                23999612100
                        443   132.73.124.176                23997909300

Metric Info:
967k ACK Packets/s

Alert Type:
time_window

Alert Description:
High ACK packet rate.

Start Time: 2026-07-21 00:35:55
End Time: ongoing

First Event Seen: 2026-07-21 00:33:00
Last Event Seen: 2026-07-21 00:42:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/256631/