[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #251308 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, June 9, 2026 9:05:39 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #251308 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 251308

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  5127600       17092         7.7%    192.178.194.95
  3702000       12340         5.6%     34.104.35.123
  1848900        6163         2.8%   199.232.214.172
  1615800        5386         2.4%    23.218.225.105
  1550400        5168         2.3%   162.159.140.167
  1321200        4404         2.0%    199.232.82.172
  1301400        4338         2.0%     16.15.253.241
  1294800        4316         2.0%   199.232.210.172
  1080000        3600         1.6%     162.125.69.12
   979800        3266         1.5%    23.218.225.120

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  8496600       28322        12.8%      132.76.61.53
  3070800       10236         4.6%     132.74.74.134
  2100600        7002         3.2%      132.76.61.52
  1845900        6153         2.8%   128.139.225.242
  1580700        5269         2.4%     128.139.200.4
  1553100        5177         2.3%     128.139.221.5
  1301400        4338         2.0%     132.66.42.122
  1258500        4195         1.9%      132.66.42.22
  1134900        3783         1.7%      192.114.1.65
  1133100        3777         1.7%     128.139.200.5

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                               132.76.61.53                11965414500
                        443    132.76.61.53                11828067600
  192.178.194.95        443                                 6669270900
  192.178.194.95                                            6669270900
   34.104.35.123                                            5327551800
   34.104.35.123         80                                 5102925000
                        443   132.74.74.134                 4404550500
                              132.74.74.134                 4404550500
                               132.76.61.52                 2626582200
                        443    132.76.61.52                 2618070300

Metric Info:
1M ACK Packets/s

Alert Type:
time_window

Alert Description:
High ACK packet rate.

Start Time: 2026-06-09 03:46:13
End Time: ongoing

First Event Seen: 2026-06-09 03:44:00
Last Event Seen: 2026-06-09 06:03:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/251308/