[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241493 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, April 13, 2026 3:43:06 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241493 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241493

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  69762000      232540        16.4%     160.119.76.22
  67928100      226427        16.0%     160.119.76.18
  51045900      170153        12.0%     160.119.76.19
  48807900      162693        11.5%     160.119.76.23
  40953000      136510         9.6%     160.119.76.16
  27394500       91315         6.4%     160.119.76.26
   3867900       12893         0.9%   142.251.142.202
   2744400        9148         0.6%     216.58.198.42
   2481900        8273         0.6%    57.144.244.192
   2203800        7346         0.5%    157.240.253.63

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  15983400       53278         3.8%   128.139.225.242
   6248100       20827         1.5%     132.74.74.134
   5571900       18573         1.3%     128.139.200.5
   3500400       11668         0.8%     128.139.200.4
   2201700        7339         0.5%    128.139.18.247
   2169000        7230         0.5%      132.66.52.85
   1861500        6205         0.4%       132.70.19.4
   1771800        5906         0.4%     192.114.52.12
   1656000        5520         0.4%     192.114.52.15
   1533000        5110         0.4%      192.114.52.6

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                               128.139.225.242                20173522500
                         443   128.139.225.242                14226430500
                         443     132.74.74.134                 9005760900
                                 132.74.74.134                 9005760900
                                 128.139.200.5                 6510265500
                         443     128.139.200.5                 6508887000
  142.251.142.202        443                                   5581531500
  142.251.142.202                                              5581531500
                          80   128.139.225.242                 5091636300
                                 128.139.200.4                 4189065300

Metric Info:
991k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-13 00:38:50
End Time: ongoing

First Event Seen: 2026-04-13 00:36:00
Last Event Seen: 2026-04-13 00:41:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241493/