[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #239959 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 3, 2026 7:51:05 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #239959 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 239959

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  42378000      141260        14.7%          184.25.50.192
  23578200       78594         8.2%         146.75.122.172
  20535300       68451         7.1%          184.25.50.178
  17446200       58154         6.1%          104.21.83.123
  13464000       44880         4.7%         172.67.175.213
   8353200       27844         2.9%   2001:bf8:900:d:2::71
   8233500       27445         2.9%            23.48.23.56
   6615600       22052         2.3%            23.48.23.67
   6079500       20265         2.1%            23.48.23.29
   5947800       19826         2.1%            23.48.23.21

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  30910200      103034        10.7%   132.67.130.202
   7941300       26471         2.8%   132.71.124.123
   6715500       22385         2.3%   132.71.124.139
   6167400       20558         2.1%   132.71.124.121
   6020700       20069         2.1%    132.74.74.134
   5987100       19957         2.1%   132.71.124.148
   5962200       19874         2.1%   132.71.124.118
   5652900       18843         2.0%   132.71.124.134
   5082000       16940         1.8%   132.71.124.117
   4694100       15647         1.6%   132.71.124.129

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
   184.25.50.192        443                                 63437958900
   184.25.50.192                                            63437958900
                         80   132.67.130.202                46322700900
                              132.67.130.202                46322700900
  146.75.122.172                                            30846238800
   184.25.50.178        443                                 30757020600
   184.25.50.178                                            30757020600
  146.75.122.172        443                                 30358476900
   104.21.83.123         80                                 26154105600
   104.21.83.123                                            26154105600

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-03 04:46:53
End Time: ongoing

First Event Seen: 2026-04-03 04:44:00
Last Event Seen: 2026-04-03 04:49:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/239959/