[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241714 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, April 14, 2026 2:30:13 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241714 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241714

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  79150500      263835        18.5%     160.119.76.19
  61462200      204874        14.3%     160.119.76.29
  50280300      167601        11.7%     160.119.76.26
  42559500      141865         9.9%     160.119.76.28
  38878500      129595         9.1%     160.119.76.22
   7267500       24225         1.7%     34.104.35.123
   4786200       15954         1.1%   142.251.140.106
   4254300       14181         1.0%     16.15.236.229
   3857700       12859         0.9%    57.144.244.192
   3795900       12653         0.9%    157.240.253.63

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  15133200       50444         3.5%   128.139.225.242
   5479500       18265         1.3%     192.114.52.12
   5027700       16759         1.2%     128.139.200.5
   5024100       16747         1.2%     132.74.74.134
   4862700       16209         1.1%     128.139.200.4
   4421700       14739         1.0%      192.114.0.89
   3380700       11269         0.8%      132.76.61.51
   3156300       10521         0.7%    134.93.168.101
   2825400        9418         0.7%     132.66.253.82
   2441700        8139         0.6%     128.139.221.5

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                               128.139.225.242                18068055000
                         443   128.139.225.242                16765874700
    34.104.35.123                                             10478990400
    34.104.35.123         80                                  10235379300
                                 132.74.74.134                 7199578500
                         443     132.74.74.134                 7143053700
  142.251.140.106        443                                   6695264400
  142.251.140.106                                              6695264400
                                 128.139.200.5                 6396021900
                         443     128.139.200.5                 6395235300

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-13 23:29:57
End Time: ongoing

First Event Seen: 2026-04-13 23:27:00
Last Event Seen: 2026-04-13 23:28:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241714/