[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242702 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 17, 2026 11:36:07 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242702 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242702

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  45677400      152258        13.8%   160.119.76.22
  34233000      114110        10.3%   160.119.76.29
  25535400       85118         7.7%   160.119.76.19
  25123500       83745         7.6%   160.119.76.27
  23685000       78950         7.1%   160.119.76.23
  20452500       68175         6.2%   160.119.76.28
   8217000       27390         2.5%   23.207.210.70
   6802200       22674         2.0%    2.16.168.112
   4302300       14341         1.3%   20.209.242.65
   3501300       11671         1.1%   216.58.198.10

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  17078100       56927         5.1%   128.139.225.242
   8217300       27391         2.5%     132.71.96.220
   6802800       22676         2.0%    132.71.145.102
   6715500       22385         2.0%       132.74.6.58
   5074200       16914         1.5%     132.74.74.134
   4678800       15596         1.4%     128.139.200.4
   4302600       14342         1.3%       132.70.19.4
   3909300       13031         1.2%     128.139.200.5
   3510600       11702         1.1%     132.64.102.62
   3232500       10775         1.0%     132.65.180.46

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             128.139.225.242                20603497500
                       443   128.139.225.242                18913509300
                               132.71.96.220                12271538700
  23.207.210.70        443                                  12271526700
  23.207.210.70                                   61667     12271526700
  23.207.210.70                                             12271526700
                       443     132.71.96.220                12271526700
                               132.71.96.220      61667     12271526700
                              132.71.145.102                10132515900
                       443    132.71.145.102                10132503900

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-17 20:35:52
End Time: ongoing

First Event Seen: 2026-04-17 20:33:00
Last Event Seen: 2026-04-17 20:34:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242702/