[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241891 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, April 15, 2026 1:29:09 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241891 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241891

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  83353200      277844        15.1%     160.119.76.22
  67878000      226260        12.3%     160.119.76.29
  65630100      218767        11.9%     160.119.76.27
  35803800      119346         6.5%     160.119.76.28
  27980100       93267         5.1%     93.123.17.252
  19768200       65894         3.6%     160.119.76.18
  18131700       60439         3.3%   199.232.142.172
  15694200       52314         2.8%   199.232.214.172
  15467100       51557         2.8%   199.232.210.172
   8016900       26723         1.4%    146.75.122.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  24005100       80017         4.3%   128.139.225.242
   9453600       31512         1.7%      132.70.2.150
   6436200       21454         1.2%     192.114.52.15
   6296700       20989         1.1%     192.114.52.12
   6238200       20794         1.1%   199.232.210.172
   6199800       20666         1.1%       172.64.66.1
   6198900       20663         1.1%   199.232.214.172
   5150400       17168         0.9%     128.139.200.5
   5059500       16865         0.9%     128.139.200.4
   3477600       11592         0.6%      132.77.89.53

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
    93.123.17.252         80                                  40259811600
    93.123.17.252                                             40259811600
                               128.139.225.242                28324299900
  199.232.142.172         80                                  25678103100
  199.232.142.172                                             25678103100
                         443   128.139.225.242                25329687600
  199.232.214.172                                             22055823300
  199.232.214.172         80                                  22055804100
  199.232.210.172                                             21726346200
  199.232.210.172         80                                  21661894200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-14 22:28:52
End Time: ongoing

First Event Seen: 2026-04-14 22:26:00
Last Event Seen: 2026-04-14 22:27:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241891/