[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #438743 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, September 23, 2026 3:47:34 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #438743 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 438743

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  55337100      184457        16.3%   109.205.211.34
  38792700      129309        11.4%   23.206.251.114
  37668000      125560        11.1%    23.218.225.98
  36682200      122274        10.8%   23.206.251.113
  26785500       89285         7.9%   23.218.225.122
  12611700       42039         3.7%   20.209.192.162
   8034000       26780         2.4%   199.232.18.172
   6557700       21859         1.9%   23.218.225.136
   6447300       21491         1.9%   172.67.175.213
   6350100       21167         1.9%    20.60.251.193

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  19374900       64583         5.7%    132.77.35.132
  18981900       63273         5.6%    132.73.124.68
  17490000       58300         5.1%    132.72.23.183
  13491300       44971         4.0%     132.73.124.8
  12344400       41148         3.6%    132.73.124.48
  11301300       37671         3.3%   132.73.124.220
   8628000       28760         2.5%    132.73.124.72
   6586200       21954         1.9%     132.70.60.32
   6550200       21834         1.9%    132.74.74.134
   6106500       20355         1.8%   132.73.124.216

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
  23.206.251.114                                           57163946100
  23.206.251.114        443                                57130823400
   23.218.225.98                                           55414353600
  23.206.251.113                                           53982469200
  23.206.251.113        443                                53952006000
   23.218.225.98        443                                45904415400
  23.218.225.122        443                                39261072900
  23.218.225.122                                           39261072900
                              132.73.124.68                27970770000
                        443   132.73.124.68                27970758000

Metric Info:
1M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate

Start Time: 2026-09-23 00:39:23
End Time: ongoing

First Event Seen: 2026-09-23 00:37:00
Last Event Seen: 2026-09-23 00:46:00

Further Details:
https://primary.nemo.geant.org/alerts/details/438743/