[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242995 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 18, 2026 8:08:10 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242995 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242995

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  47042100      156807        15.0%    160.119.76.34
  46162800      153876        14.7%    160.119.76.39
  35612700      118709        11.4%    160.119.76.37
  16463100       54877         5.3%    160.119.76.38
  15783300       52611         5.0%    160.119.76.33
  11660400       38868         3.7%    20.209.242.65
   6225300       20751         2.0%      31.13.84.52
   3832800       12776         1.2%   57.144.248.192
   3586800       11956         1.1%   57.144.244.192
   3327000       11090         1.1%      3.160.212.7

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  23614200       78714         7.5%   128.139.225.242
  11660400       38868         3.7%       132.70.19.4
   5295600       17652         1.7%     128.139.200.4
   5057100       16857         1.6%     128.139.200.5
   5008800       16696         1.6%    192.114.23.221
   4793400       15978         1.5%     132.74.74.134
   3327900       11093         1.1%     132.68.39.242
   2682600        8942         0.9%     192.114.52.12
   2559000        8530         0.8%     132.65.128.88
   2299800        7666         0.7%      192.114.52.5

Top-10 Possible Targets by Bytes:
       Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                           128.139.225.242                28345534500
                     443   128.139.225.242                22785182400
  31.13.84.52        443                                   7670501400
  31.13.84.52                                              7670501400
                     443     132.74.74.134                 6857774100
                             132.74.74.134                 6857774100
                             128.139.200.4                 6733636800
                     443     128.139.200.4                 6732887100
                             128.139.200.5                 6578836800
                     443     128.139.200.5                 6578236800

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-18 17:07:54
End Time: ongoing

First Event Seen: 2026-04-18 17:05:00
Last Event Seen: 2026-04-18 17:06:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242995/