[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242398 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 17, 2026 12:24:05 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242398 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242398

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  65965500      219885        15.2%   160.119.76.32
  49560000      165200        11.4%   160.119.76.36
  34314900      114383         7.9%   160.119.76.39
  31384200      104614         7.2%   160.119.76.30
  28271400       94238         6.5%   160.119.76.35
  24671400       82238         5.7%   160.119.76.38
  12212700       40709         2.8%   132.68.130.55
   9271500       30905         2.1%   93.123.17.252
   8689800       28966         2.0%    2.16.168.113
   8412600       28042         1.9%    2.16.168.122

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total              Dst IP
------------------------------------------------------
  18427200       61424         4.2%     128.139.225.242
  12229500       40765         2.8%         172.64.66.1
   8691000       28970         2.0%        132.71.97.16
   8413200       28044         1.9%        132.71.97.34
   5131800       17106         1.2%         132.70.19.4
   4956900       16523         1.1%         132.74.6.58
   4620900       15403         1.1%       132.66.253.82
   4572900       15243         1.1%   2610:1d8:a01:1::7
   4437900       14793         1.0%       128.139.200.4
   4327200       14424         1.0%       128.139.200.5

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             128.139.225.242                22457337000
                                 172.64.66.1        443     17544636900
                                 172.64.66.1                17544636900
  132.68.130.55                                     443     17543795700
  132.68.130.55                                             17543795700
                       443   128.139.225.242                14782175700
  93.123.17.252         80                                  13566767700
  93.123.17.252                                             13566767700
                                132.71.97.16                12975743400
   2.16.168.113        443                                  12975277800

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-16 21:23:49
End Time: ongoing

First Event Seen: 2026-04-16 21:21:00
Last Event Seen: 2026-04-16 21:22:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242398/