[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242660 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 17, 2026 10:16:05 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242660 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242660

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  48251100      160837        14.1%   160.119.76.35
  41338200      137794        12.1%   160.119.76.37
  25599000       85330         7.5%   160.119.76.36
  24630600       82102         7.2%   160.119.76.31
  15508200       51694         4.5%   160.119.76.34
  13921200       46404         4.1%   160.119.76.33
  10257900       34193         3.0%   20.209.242.65
   8286900       27623         2.4%    2.16.168.101
   7963800       26546         2.3%     184.24.77.7
   7103700       23679         2.1%    2.16.168.112

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  17773500       59245         5.2%   128.139.225.242
  10257900       34193         3.0%       132.70.19.4
   8287200       27624         2.4%    132.71.109.101
   7963800       26546         2.3%     132.71.96.220
   7103700       23679         2.1%    132.71.145.102
   4867500       16225         1.4%        132.68.0.1
   4368600       14562         1.3%     128.139.200.5
   3928800       13096         1.1%     128.139.200.4
   3579000       11930         1.0%     132.66.102.40
   3330000       11100         1.0%      132.76.61.52

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                            128.139.225.242                20964366000
                      443   128.139.225.242                19313100300
                      443    132.71.109.101                12346384500
                             132.71.109.101                12346384500
  2.16.168.101        443                                  12346001100
  2.16.168.101                                   52613     12346001100
  2.16.168.101                                             12346001100
                             132.71.109.101      52613     12346001100
   184.24.77.7        443                                  11865625500
   184.24.77.7                                   62740     11865625500

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-17 19:15:50
End Time: ongoing

First Event Seen: 2026-04-17 19:13:00
Last Event Seen: 2026-04-17 19:14:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242660/