[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242575 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 17, 2026 12:15:15 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242575 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242575

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  67891200      226304        12.8%   160.119.76.23
  40457400      134858         7.6%   160.119.76.19
  37971000      126570         7.2%   160.119.76.16
  37906200      126354         7.2%   160.119.76.28
  37829400      126098         7.1%   160.119.76.22
  33630000      112100         6.4%   160.119.76.25
  31914300      106381         6.0%   160.119.76.18
  16616700       55389         3.1%    2.16.168.112
   8354400       27848         1.6%    2.16.168.101
   8180700       27269         1.5%    2.16.168.122

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  18778500       62595         3.5%   128.139.225.242
  14599800       48666         2.8%      192.114.5.10
   8841900       29473         1.7%     132.71.101.25
   8354700       27849         1.6%    132.71.109.101
   8181300       27271         1.5%      132.71.97.34
   7775700       25919         1.5%    132.71.145.102
   6877200       22924         1.3%     132.71.96.220
   5757000       19190         1.1%     128.139.200.5
   5019000       16730         0.9%     128.139.200.4
   4700100       15667         0.9%      132.70.2.150

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
  2.16.168.112        443                                  24684783000
  2.16.168.112                                             24684783000
                            128.139.225.242                22156728300
                      443   128.139.225.242                17321426400
                               192.114.5.10                15928389600
                      443      192.114.5.10                14133577800
                              132.71.101.25                13141783500
                      443     132.71.101.25                13141771500
  2.16.168.112                                   61382     13141759500
                              132.71.101.25      61382     13141759500

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-17 09:14:48
End Time: ongoing

First Event Seen: 2026-04-17 09:12:00
Last Event Seen: 2026-04-17 09:13:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242575/