[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242879 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 18, 2026 11:01:14 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242879 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242879

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  70630500      235435        17.7%   160.119.76.29
  30502500      101675         7.6%   160.119.76.16
  30376500      101255         7.6%   160.119.76.25
  29235600       97452         7.3%   160.119.76.18
  28113600       93712         7.0%   160.119.76.28
  26214300       87381         6.6%   160.119.76.22
  17237400       57458         4.3%   160.119.76.26
  11220900       37403         2.8%   143.14.125.48
   8897700       29659         2.2%    2.16.168.124
   8847000       29490         2.2%   20.209.242.65

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  12527700       41759         3.1%        128.139.225.242
   8898000       29660         2.2%         132.71.145.228
   8848200       29494         2.2%            132.70.19.4
   8281500       27605         2.1%         132.71.145.102
   6864900       22883         1.7%          132.66.114.24
   6225900       20753         1.6%          132.65.128.88
   5501700       18339         1.4%   2602:fd0f:0:1001::17
   4887900       16293         1.2%          132.74.74.134
   4135200       13784         1.0%          128.139.200.5
   3640500       12135         0.9%          128.139.200.4

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                            128.139.225.242                15076783500
                      443   128.139.225.242                13780775100
                             132.71.145.228                13272243300
  2.16.168.124        443                                  13272231300
  2.16.168.124                                   56066     13272231300
  2.16.168.124                                             13272231300
                      443    132.71.145.228                13272231300
                             132.71.145.228      56066     13272231300
  2.16.168.100        443                                  12368863800
  2.16.168.100                                             12368863800

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-18 08:00:59
End Time: ongoing

First Event Seen: 2026-04-18 07:58:00
Last Event Seen: 2026-04-18 07:59:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242879/