[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241093 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 11, 2026 5:05:14 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241093 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241093

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  81660300      272201        17.8%          160.119.76.16
  57733200      192444        12.6%          160.119.76.26
  43092000      143640         9.4%          160.119.76.28
  36625800      122086         8.0%          160.119.76.27
  33673200      112244         7.3%   2001:bf8:900:d:2::71
  32453700      108179         7.1%          160.119.76.25
  28157100       93857         6.1%          160.119.76.19
   8609100       28697         1.9%        142.251.127.132
   4354200       14514         0.9%        142.251.209.234
   3301800       11006         0.7%         57.144.248.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  12900900       43003         2.8%        128.139.225.242
  11321100       37737         2.5%   2602:fd0f:0:1001::20
   8809200       29364         1.9%   2602:fd0f:0:1001::17
   8611200       28704         1.9%          132.64.58.144
   6792300       22641         1.5%   2602:fd0f:0:1001::19
   6724800       22416         1.5%   2602:fd0f:0:1001::18
   5087100       16957         1.1%           192.114.52.2
   4969200       16564         1.1%          132.74.74.134
   4667700       15559         1.0%          128.139.200.4
   4011600       13372         0.9%          128.139.200.5

Top-10 Possible Targets by Bytes:
                Src IP   Src Port                 Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------------
  2001:bf8:900:d:2::71       8443                                       50409478800
  2001:bf8:900:d:2::71                                                  50409478800
                             8443   2602:fd0f:0:1001::20                16948407000
                                    2602:fd0f:0:1001::20                16948407000
                                         128.139.225.242                14264310300
                             8443   2602:fd0f:0:1001::17                13185045600
                                    2602:fd0f:0:1001::17                13185045600
                              443        128.139.225.242                13052054100
       142.251.127.132        443                                       10935599100
       142.251.127.132                                        58769     10935599100

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-11 14:04:58
End Time: ongoing

First Event Seen: 2026-04-11 14:02:00
Last Event Seen: 2026-04-11 14:03:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241093/