[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242819 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 18, 2026 9:12:12 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242819 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242819

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  56873400      189578        15.1%    160.119.76.30
  32364300      107881         8.6%    160.119.76.32
  29006400       96688         7.7%    160.119.76.39
  26666700       88889         7.1%    160.119.76.36
  25429800       84766         6.7%    160.119.76.34
  24429000       81430         6.5%    160.119.76.31
  19276200       64254         5.1%    160.119.76.37
  10433100       34777         2.8%   40.183.227.230
  10382700       34609         2.8%    20.209.242.65
   8277900       27593         2.2%     2.16.168.100

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  10382700       34609         2.8%       132.70.19.4
   8278500       27595         2.2%    132.71.145.102
   8050800       26836         2.1%     132.71.96.220
   6868500       22895         1.8%   128.139.225.242
   4855800       16186         1.3%     132.74.74.134
   3942300       13141         1.0%     132.65.128.88
   3284700       10949         0.9%     132.66.42.122
   3163500       10545         0.8%     132.65.180.47
   3015300       10051         0.8%      192.114.5.10
   2872800        9576         0.8%     128.139.200.5

Top-10 Possible Targets by Bytes:
         Src IP   Src Port           Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                       443   132.71.145.102                12363731700
                             132.71.145.102                12363731700
   2.16.168.100        443                                 12363615900
   2.16.168.100                                  51319     12363615900
   2.16.168.100                                            12363615900
                             132.71.145.102      51319     12363615900
                              132.71.96.220                12015854400
  23.207.210.70        443                                 12015830400
  23.207.210.70                                  61667     12015830400
  23.207.210.70                                            12015830400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-18 06:11:56
End Time: ongoing

First Event Seen: 2026-04-18 06:09:00
Last Event Seen: 2026-04-18 06:10:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242819/