[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #240857 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 10, 2026 2:27:08 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #240857 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 240857

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  54313800      181046        29.0%      172.64.66.1
   4221900       14073         2.3%     132.76.61.51
   3302700       11009         1.8%   57.144.248.192
   2842200        9474         1.5%   104.17.254.239
   2733300        9111         1.5%   52.222.136.125
   2730900        9103         1.5%     132.76.61.53
   2688300        8961         1.4%      52.107.3.41
   2598900        8663         1.4%    52.222.136.15
   2517600        8392         1.3%   57.144.244.192
   2496300        8321         1.3%   142.250.75.193

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  35220900      117403        18.8%      132.76.61.51
  20429400       68098        10.9%      132.76.61.53
  10103400       33678         5.4%     132.70.60.180
   9071100       30237         4.8%   128.139.225.242
   7230900       24103         3.9%       172.64.66.1
   4338300       14461         2.3%     128.139.200.5
   3417900       11393         1.8%     128.139.200.4
   3228600       10762         1.7%      132.76.61.52
   2879400        9598         1.5%     132.73.124.80
   2824500        9415         1.5%     132.73.124.98

Top-10 Possible Targets by Bytes:
       Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
  172.64.66.1        443                                  81027246600
  172.64.66.1                                             81027246600
                              132.76.61.51                51397991100
                     443      132.76.61.51                51392271300
                              132.76.61.53                29487225300
                     443      132.76.61.53                29471099700
                     443     132.70.60.180                14738055300
                             132.70.60.180                14738055300
                           128.139.225.242                 9578977500
                     443   128.139.225.242                 8849829000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-10 11:26:53
End Time: ongoing

First Event Seen: 2026-04-10 11:24:00
Last Event Seen: 2026-04-10 11:25:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/240857/