[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242167 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, April 16, 2026 2:24:10 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242167 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242167

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  60788100      202627        15.9%     160.119.76.30
  53631900      178773        14.0%     160.119.76.31
  27540900       91803         7.2%     160.119.76.39
  27238800       90796         7.1%     160.119.76.36
  24785400       82618         6.5%     160.119.76.33
  18025200       60084         4.7%     160.119.76.35
   5634900       18783         1.5%     162.125.69.22
   5159400       17198         1.3%       31.13.84.52
   4617600       15392         1.2%   128.139.225.242
   4138800       13796         1.1%     93.123.17.252

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  17561400       58538         4.6%   128.139.225.242
   6772800       22576         1.8%     132.65.180.14
   5729400       19098         1.5%     132.65.180.25
   5142000       17140         1.3%     128.139.200.4
   4141800       13806         1.1%      192.114.52.8
   3867000       12890         1.0%      192.114.52.1
   3733200       12444         1.0%     128.139.200.5
   3565500       11885         0.9%      132.70.2.150
   3561300       11871         0.9%     132.66.253.82
   3402900       11343         0.9%     132.66.42.122

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             128.139.225.242                20063335200
                       443   128.139.225.242                17092730400
                       443     132.65.180.14                 9851941500
                               132.65.180.14                 9851941500
                       443     132.65.180.25                 8348543700
                               132.65.180.25                 8348543700
  162.125.69.22        443                                   8339382600
  162.125.69.22                                              8339382600
    31.13.84.52        443                                   6354505200
    31.13.84.52                                              6354505200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-15 23:23:56
End Time: ongoing

First Event Seen: 2026-04-15 23:21:00
Last Event Seen: 2026-04-15 23:22:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242167/