[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #270983 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, October 22, 2026 8:32:42 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #270983 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 270983

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  6298200       20994        14.7%     20.209.242.65
  1820400        6068         4.3%     162.125.69.15
  1805400        6018         4.2%    138.199.14.107
  1281300        4271         3.0%     172.217.116.4
  1114500        3715         2.6%       2.21.22.161
   964500        3215         2.3%     172.217.114.4
   818400        2728         1.9%     17.253.57.197
   726900        2423         1.7%      23.40.244.92
   662100        2207         1.5%     17.253.57.195
   633300        2111         1.5%   199.232.214.172

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
  6298200       20994        14.7%      132.70.19.4
  1904400        6348         4.4%    192.114.52.14
  1820400        6068         4.3%     132.66.52.64
  1194900        3983         2.8%   132.75.176.154
  1041000        3470         2.4%   132.71.139.174
  1003200        3344         2.3%    132.74.68.134
  1002300        3341         2.3%    128.139.200.4
   909300        3031         2.1%   132.66.193.123
   841500        2805         2.0%    192.114.88.55
   808200        2694         1.9%    128.139.200.5

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
   162.125.69.15        443                                 2675695800
   162.125.69.15                                 40370      2675695800
   162.125.69.15                                            2675695800
                        443    132.66.52.64                 2675695800
                               132.66.52.64      40370      2675695800
                               132.66.52.64                 2675695800
                              192.114.52.14                 2573582100
                        443   192.114.52.14                 2573554500
  138.199.14.107        443                                 2562451800
  138.199.14.107                                            2562451800

Metric Info:
1M ACK Packets/s

Alert Type:
time_window

Alert Description:
High ACK packet rate.

Start Time: 2026-10-22 02:07:34
End Time: ongoing

First Event Seen: 2026-10-22 02:05:00
Last Event Seen: 2026-10-22 05:31:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/270983/