[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #240857 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 10, 2026 2:31:12 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #240857 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 240857

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  89257800      297526        35.7%      172.64.66.1
   5540400       18468         2.2%     132.76.61.51
   4944600       16482         2.0%     132.76.61.53
   3852600       12842         1.5%   57.144.248.192
   3397800       11326         1.4%      52.107.3.41
   3061800       10206         1.2%   57.144.244.192
   3021000       10070         1.2%   142.250.75.193
   2963100        9877         1.2%   157.240.253.63
   2842200        9474         1.1%   104.17.254.239
   2733300        9111         1.1%   52.222.136.125

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  47616000      158720        19.1%      132.76.61.51
  36670500      122235        14.7%      132.76.61.53
  11448600       38162         4.6%       172.64.66.1
  10746900       35823         4.3%   128.139.225.242
  10126800       33756         4.1%     132.70.60.180
   7538400       25128         3.0%      132.76.61.54
   5514900       18383         2.2%      132.76.61.52
   5229000       17430         2.1%     128.139.200.5
   4296000       14320         1.7%     128.139.200.4
   3335400       11118         1.3%     132.73.124.98

Top-10 Possible Targets by Bytes:
       Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
  172.64.66.1        443                                 133179640800
  172.64.66.1                                            133179640800
                              132.76.61.51                69753546300
                     443      132.76.61.51                69747826500
                              132.76.61.53                53602305900
                     443      132.76.61.53                53586180300
                     443     132.70.60.180                14738055300
                             132.70.60.180                14738055300
                           128.139.225.242                11175037200
                     443   128.139.225.242                10337034300

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-10 11:26:53
End Time: ongoing

First Event Seen: 2026-04-10 11:24:00
Last Event Seen: 2026-04-10 11:29:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/240857/