[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242152 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, April 16, 2026 1:56:11 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242152 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242152

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  37827300      126091        11.2%    160.119.76.23
  32298300      107661         9.6%    160.119.76.22
  32185200      107284         9.6%    160.119.76.29
  26203500       87345         7.8%    160.119.76.19
  21253800       70846         6.3%    160.119.76.18
  18035700       60119         5.4%    160.119.76.28
  12910500       43035         3.8%    160.119.76.26
   6553200       21844         1.9%   146.75.122.172
   6100500       20335         1.8%      31.13.84.52
   5225100       17417         1.6%    162.125.69.22

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  18535800       61786         5.5%   128.139.225.242
   5220900       17403         1.6%     132.66.253.82
   4728300       15761         1.4%      132.70.2.150
   4631400       15438         1.4%     128.139.200.5
   4406100       14687         1.3%     128.139.200.4
   4064400       13548         1.2%      192.114.52.1
   3666600       12222         1.1%     132.66.42.122
   2777400        9258         0.8%      132.76.61.51
   2748600        9162         0.8%   192.114.110.190
   2252100        7507         0.7%    192.114.91.247

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                              128.139.225.242                22279694100
                        443   128.139.225.242                20740121100
  146.75.122.172                                              9312016500
  146.75.122.172         80                                   9056706900
   162.125.69.22        443                                   7762095900
   162.125.69.22                                              7762095900
                        443     132.66.253.82                 7673447100
                                132.66.253.82                 7673447100
     31.13.84.52        443                                   7515033000
     31.13.84.52                                              7515033000

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-15 22:55:55
End Time: ongoing

First Event Seen: 2026-04-15 22:53:00
Last Event Seen: 2026-04-15 22:54:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242152/