Cristopher,
Ip addresses that are not currently in use, and IP addresses that is currently used for CGNAT for end users
I'm 100% sure that those words mean something to you.. but not
operating your network they don't mean anything to me.
You asked what is being attacked
IP addresses that are currently not assigned to end users
And ip addresses assigned to end users
End user= Home broadband customers
We are not hosting any significant servers
I'm being unclear or you are being overly pedantic.. neither is helping.
"what ip address can I look in netflow for traffic destined to which
is part of this attack?"
Anyone trying to help you is going to want to know what destination
address in your network is receiving this traffic... not providing
same after ~15 emails is going to make your situation not get better.
I'd suggest you post the addresses to the list though... so other folk
can go looking as well.