[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241218 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, April 12, 2026 4:48:19 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241218 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241218

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  47446800      158156        21.1%     160.119.76.16
  35975400      119918        16.0%     160.119.76.28
  19535100       65117         8.7%     160.119.76.19
  18917400       63058         8.4%     160.119.76.18
  13669500       45565         6.1%     160.119.76.29
  10809300       36031         4.8%     160.119.76.26
   4578000       15260         2.0%   142.251.140.106
   3113100       10377         1.4%    185.242.226.61
   1762500        5875         0.8%     192.114.52.14
   1497000        4990         0.7%     20.209.177.33

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  6937500       23125         3.1%   128.139.225.242
  4077900       13593         1.8%     132.74.74.134
  2383500        7945         1.1%     128.139.200.5
  1898100        6327         0.8%       17.250.90.2
  1497300        4991         0.7%       132.70.19.4
  1463400        4878         0.7%     128.139.200.4
  1332300        4441         0.6%      132.76.80.87
  1269300        4231         0.6%     132.68.58.134
  1175700        3919         0.5%      132.76.61.53
  1010700        3369         0.4%      132.76.61.52

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                               128.139.225.242                 8669073000
  142.251.140.106        443                                   6242835000
  142.251.140.106                                              6242835000
                         443     132.74.74.134                 5843301300
                                 132.74.74.134                 5843301300
                         443   128.139.225.242                 5358071400
                                 128.139.200.5                 3029010000
                         443     128.139.200.5                 3028426500
                          80   128.139.225.242                 2852338200
                                   17.250.90.2        443      2683333500

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-12 01:48:05
End Time: ongoing

First Event Seen: 2026-04-12 01:45:00
Last Event Seen: 2026-04-12 01:46:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241218/