[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #240968 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 11, 2026 2:32:14 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #240968 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 240968

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  53621100      178737        22.7%          160.119.76.29
  34222800      114076        14.5%          160.119.76.22
  30003600      100012        12.7%          160.119.76.16
  29645400       98818        12.5%          160.119.76.19
   9056100       30187         3.8%   2001:bf8:900:d:2::71
   4133700       13779         1.7%          160.119.76.26
   2784000        9280         1.2%         142.250.180.10
   1735800        5786         0.7%        142.251.209.234
   1729500        5765         0.7%          80.250.101.43
   1687500        5625         0.7%           43.109.97.37

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total                 Dst IP
--------------------------------------------------------
  6448200       21494         2.7%        128.139.225.242
  5115300       17051         2.2%   2602:fd0f:0:1001::20
  4174200       13914         1.8%          132.74.74.134
  2102100        7007         0.9%          128.139.200.5
  1824900        6083         0.8%   2602:fd0f:0:1001::17
  1738800        5796         0.7%           132.66.52.85
  1732500        5775         0.7%          128.139.200.4
  1730100        5767         0.7%          132.64.244.95
  1720500        5735         0.7%   2602:fd0f:0:1001::19
  1692900        5643         0.7%          132.66.64.130

Top-10 Possible Targets by Bytes:
                Src IP   Src Port                 Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------------
  2001:bf8:900:d:2::71       8443                                       13568872200
  2001:bf8:900:d:2::71                                                  13568872200
                             8443   2602:fd0f:0:1001::20                 7664155800
                                    2602:fd0f:0:1001::20                 7664155800
                                         128.139.225.242                 7337808900
                              443        128.139.225.242                 7063117500
                              443          132.74.74.134                 6021793500
                                           132.74.74.134                 6021793500
        142.250.180.10        443                                        4013685300
        142.250.180.10                                                   4013685300

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-10 23:32:00
End Time: ongoing

First Event Seen: 2026-04-10 23:29:00
Last Event Seen: 2026-04-10 23:30:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/240968/