[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243061 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 18, 2026 10:24:14 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243061 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243061

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  44127900      147093        14.9%          160.119.76.23
  43413300      144711        14.6%          160.119.76.29
  34948800      116496        11.8%          160.119.76.22
  23416800       78056         7.9%          160.119.76.27
  17979000       59930         6.1%          160.119.76.16
   8107200       27024         2.7%   2001:bf8:900:d:2::71
   6036000       20120         2.0%          20.209.242.65
   5245500       17485         1.8%            31.13.84.52
   3791400       12638         1.3%          20.150.76.228
   3759300       12531         1.3%         194.147.58.125

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  21319500       71065         7.2%        128.139.225.242
   6036000       20120         2.0%            132.70.19.4
   4341900       14473         1.5%          128.139.200.4
   4103700       13679         1.4%          128.139.200.5
   3793500       12645         1.3%             132.68.0.1
   3714000       12380         1.3%          132.74.74.134
   3117300       10391         1.1%          192.114.52.13
   2856900        9523         1.0%          132.65.128.88
   2776200        9254         0.9%         192.114.91.245
   2742900        9143         0.9%   2602:fd0f:0:1001::20

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
                                    128.139.225.242                25906495500
                              443   128.139.225.242                21946533900
  2001:bf8:900:d:2::71       8443                                  12133444800
  2001:bf8:900:d:2::71                                             12133444800
           31.13.84.52        443                                   6432590700
           31.13.84.52                                              6432590700
                              443        132.68.0.1                 5672522400
                                         132.68.0.1                 5672522400
         20.150.76.228        443                                   5672488200
         20.150.76.228                                              5672488200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-18 19:24:00
End Time: ongoing

First Event Seen: 2026-04-18 19:21:00
Last Event Seen: 2026-04-18 19:22:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243061/