[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243396 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, April 19, 2026 9:14:10 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243396 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243396

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  65217000      217390        13.4%    160.119.76.16
  50096100      166987        10.3%    160.119.76.27
  30735600      102452         6.3%    160.119.76.28
  27942000       93140         5.7%    160.119.76.19
  20515500       68385         4.2%    160.119.76.25
  19767900       65893         4.0%    160.119.76.18
  11692200       38974         2.4%    20.209.242.65
  10507200       35024         2.2%   159.93.225.228
   8972400       29908         1.8%      31.13.84.52
   7007100       23357         1.4%    18.161.111.57

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  52792500      175975        10.8%   192.114.101.113
  26263500       87545         5.4%       132.66.79.8
  26238900       87463         5.4%   128.139.225.242
  11692200       38974         2.4%       132.70.19.4
   8520300       28401         1.7%      132.76.61.54
   6861000       22870         1.4%     128.139.200.4
   6795600       22652         1.4%     128.139.200.5
   5652600       18842         1.2%    132.73.124.194
   5503200       18344         1.1%      192.114.52.1
   5238000       17460         1.1%      132.76.61.53

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                              192.114.101.113                79183616400
                                  132.66.79.8                38709534300
                        443       132.66.79.8                38709413100
                              128.139.225.242                30491892900
                        443   128.139.225.242                27386344200
  159.93.225.228      23463                                  15760711200
  159.93.225.228                                             15760711200
                      23463   192.114.101.113                15760711200
     31.13.84.52        443                                  11053887300
     31.13.84.52                                             11053887300

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-19 18:13:54
End Time: ongoing

First Event Seen: 2026-04-19 18:11:00
Last Event Seen: 2026-04-19 18:12:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243396/