[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242545 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 17, 2026 11:22:25 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242545 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242545

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  82741200      275804        16.3%     160.119.76.34
  44923800      149746         8.9%     160.119.76.37
  42075600      140252         8.3%     160.119.76.39
  37323900      124413         7.4%     160.119.76.30
  34919100      116397         6.9%     160.119.76.33
  32165700      107219         6.4%     160.119.76.38
  21880800       72936         4.3%     160.119.76.35
  16038900       53463         3.2%      2.16.168.112
   7417800       24726         1.5%   142.251.140.106
   7031400       23438         1.4%       184.24.77.7

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  16096200       53654         3.2%   128.139.225.242
   9734100       32447         1.9%      192.114.5.10
   8603700       28679         1.7%     132.71.101.25
   7834500       26115         1.5%     128.139.25.49
   7436100       24787         1.5%    132.71.145.102
   7032300       23441         1.4%     132.71.96.220
   6741000       22470         1.3%      132.71.97.34
   5009100       16697         1.0%     128.139.200.5
   4860000       16200         1.0%     128.139.200.4
   4479000       14930         0.9%     132.74.74.134

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
  2.16.168.112        443                                  23809966200
  2.16.168.112                                             23809966200
                            128.139.225.242                18913191000
                      443   128.139.225.242                17597073000
                              132.71.101.25                12771690900
                      443     132.71.101.25                12771666900
  2.16.168.112                                   61382     12771329400
                              132.71.101.25      61382     12771329400
                             132.71.145.102                11038224600
  2.16.168.112                                   53863     11038212600

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-17 08:21:57
End Time: ongoing

First Event Seen: 2026-04-17 08:19:00
Last Event Seen: 2026-04-17 08:20:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242545/