[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241493 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, April 13, 2026 3:39:05 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241493 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241493

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  46438500      154795        15.7%     160.119.76.18
  39480300      131601        13.4%     160.119.76.22
  36335700      121119        12.3%     160.119.76.19
  30561900      101873        10.3%     160.119.76.23
  24394200       81314         8.3%     160.119.76.16
  17400600       58002         5.9%     160.119.76.26
   2744400        9148         0.9%     216.58.198.42
   2740200        9134         0.9%   142.251.142.202
   2096700        6989         0.7%    57.144.244.192
   1944000        6480         0.7%    157.240.253.63

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  13399800       44666         4.5%   128.139.225.242
   5163600       17212         1.7%     132.74.74.134
   4613400       15378         1.6%     128.139.200.5
   3042300       10141         1.0%     128.139.200.4
   1888200        6294         0.6%      132.66.52.85
   1599600        5332         0.5%       132.70.19.4
   1483200        4944         0.5%    128.139.18.247
   1470000        4900         0.5%     192.114.52.12
   1416900        4723         0.5%     192.114.52.15
   1395300        4651         0.5%      192.114.52.6

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                               128.139.225.242                16867400700
                         443   128.139.225.242                11914042500
                         443     132.74.74.134                 7443832500
                                 132.74.74.134                 7443832500
                                 128.139.200.5                 5358821700
                         443     128.139.200.5                 5357708700
                          80   128.139.225.242                 4230418800
  142.251.142.202        443                                   3957112200
  142.251.142.202                                              3957112200
    216.58.198.42        443                                   3938640900

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-13 00:38:50
End Time: ongoing

First Event Seen: 2026-04-13 00:36:00
Last Event Seen: 2026-04-13 00:37:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241493/