[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242303 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, April 16, 2026 1:21:34 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242303 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242303

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  59215800      197386         6.5%   160.119.76.38
  49914600      166382         5.5%   160.119.76.34
  44805900      149353         4.9%   160.119.76.36
  38923800      129746         4.3%   160.119.76.16
  35995200      119984         4.0%   160.119.76.28
  35145900      117153         3.9%   160.119.76.27
  34049700      113499         3.7%   160.119.76.19
  32421000      108070         3.6%   160.119.76.32
  32170200      107234         3.5%   160.119.76.22
  28981200       96604         3.2%   160.119.76.30

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  28774500       95915         3.2%    132.73.124.194
  13888200       46294         1.5%      192.114.5.10
  10911900       36373         1.2%   128.139.225.242
  10279800       34266         1.1%    192.114.91.248
  10269600       34232         1.1%     128.139.200.4
   9231000       30770         1.0%    192.114.23.221
   8801400       29338         1.0%     128.139.200.5
   6745800       22486         0.7%    192.114.91.249
   6507300       21691         0.7%    192.114.91.245
   6444300       21481         0.7%    192.114.91.244

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                               132.73.124.194                30788799900
                         443   132.73.124.194                28283701500
  199.232.210.172                                            18415471500
                                 192.114.5.10                14461292400
                                128.139.200.4                14216146800
                         443    128.139.200.4                14215181100
      31.13.84.52        443                                 14167418700
      31.13.84.52                                            14167418700
  199.232.214.172                                            12804238200
                         443     192.114.5.10                12202501800

Metric Info:
6M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-16 10:21:02
End Time: ongoing

First Event Seen: 2026-04-16 10:18:00
Last Event Seen: 2026-04-16 10:19:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242303/