[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243323 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, April 19, 2026 6:04:14 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243323 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243323

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  56190300      187301         9.0%     160.119.76.37
  51002700      170009         8.1%     160.119.76.30
  38353500      127845         6.1%     160.119.76.45
  27570900       91903         4.4%     160.119.76.36
  26687700       88959         4.3%     160.119.76.34
  19996500       66655         3.2%     160.119.76.35
  16131300       53771         2.6%   142.250.181.170
  14286600       47622         2.3%     160.119.76.38
  13699800       45666         2.2%     162.125.69.12
  12242700       40809         2.0%     20.209.242.65

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  27212400       90708         4.3%       132.66.79.8
  20182200       67274         3.2%   192.114.101.113
  18118200       60394         2.9%    132.73.124.194
  17915100       59717         2.9%   128.139.225.242
  15251400       50838         2.4%      132.64.244.5
  12694800       42316         2.0%     132.66.164.52
  12243000       40810         2.0%       132.70.19.4
  11232900       37443         1.8%      192.114.5.10
   9681600       32272         1.5%      132.64.67.55
   8295600       27652         1.3%     128.139.200.5

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                                   132.66.79.8                40097163300
                         443       132.66.79.8                40097045700
                               192.114.101.113                30266186400
                                  132.64.244.5                22121705700
                         443      132.64.244.5                22121541300
  142.250.181.170        443                                  21995055600
  142.250.181.170                                             21995055600
                               128.139.225.242                20735686500
    162.125.69.12        443                                  20197584600
    162.125.69.12                                             20197584600

Metric Info:
3M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-19 15:03:58
End Time: ongoing

First Event Seen: 2026-04-19 15:01:00
Last Event Seen: 2026-04-19 15:02:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243323/