[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243169 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, April 19, 2026 7:05:15 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243169 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243169

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  41694600      138982        11.2%    160.119.76.37
  38482500      128275        10.3%    160.119.76.30
  28380900       94603         7.6%    160.119.76.31
  26139900       87133         7.0%    160.119.76.38
  26068500       86895         7.0%    160.119.76.32
  18888900       62963         5.1%    160.119.76.36
  15757200       52524         4.2%    34.104.35.123
   9384300       31281         2.5%    20.209.242.65
   6818400       22728         1.8%    93.123.17.252
   6638100       22127         1.8%   199.232.82.172

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  9384300       31281         2.5%       132.70.19.4
  8020500       26735         2.2%   128.139.225.242
  5064300       16881         1.4%      192.114.5.10
  4658400       15528         1.3%    192.114.23.200
  4261500       14205         1.1%    192.114.23.201
  4067700       13559         1.1%     132.74.74.134
  3028800       10096         0.8%     132.65.128.88
  2354100        7847         0.6%     128.139.200.4
  2273400        7578         0.6%     128.139.200.5
  2181600        7272         0.6%     192.114.3.241

Top-10 Possible Targets by Bytes:
           Src IP   Src Port   Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------
    34.104.35.123                                    23007474900
    34.104.35.123         80                         22923452700
    93.123.17.252                                     9930852000
    93.123.17.252         80                          9930824400
   199.232.82.172                                     9205081200
   199.232.82.172         80                          8525499600
  199.232.214.172                                     8364094500
  199.232.214.172         80                          7929898500
  199.232.210.172                                     7888496700
  199.232.210.172         80                          7869594300

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-19 04:05:01
End Time: ongoing

First Event Seen: 2026-04-19 04:02:00
Last Event Seen: 2026-04-19 04:03:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243169/