[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243488 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, April 20, 2026 4:54:48 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243488 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243488

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  19694700       65649        10.7%       65.9.175.44
  18440400       61468        10.0%       65.9.175.17
  17076300       56921         9.2%      65.9.175.125
  15704700       52349         8.5%       65.9.175.95
   8906400       29688         4.8%    142.251.209.42
   5473800       18246         3.0%     160.119.76.35
   4625400       15418         2.5%     20.209.242.65
   3554400       11848         1.9%   142.251.141.234
   2932500        9775         1.6%     160.119.76.30
   2836200        9454         1.5%    172.217.23.170

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  61390500      204635        33.2%     132.70.60.180
   9525600       31752         5.2%      132.70.60.26
   8748300       29161         4.7%     132.74.56.132
   5094300       16981         2.8%   128.139.225.242
   5084700       16949         2.8%     132.74.74.134
   4625400       15418         2.5%       132.70.19.4
   3035100       10117         1.6%     132.65.128.88
   3026400       10088         1.6%     132.66.42.122
   3015900       10053         1.6%     192.114.3.241
   2454900        8183         1.3%     128.139.200.4

Top-10 Possible Targets by Bytes:
        Src IP   Src Port          Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
                      443   132.70.60.180                90790762800
                            132.70.60.180                90790762800
   65.9.175.44        443                                29102877000
   65.9.175.44                                           29102877000
   65.9.175.17        443                                27248017800
   65.9.175.17                                           27248017800
  65.9.175.125        443                                25238696400
  65.9.175.125                                           25238696400
   65.9.175.95        443                                23206562400
   65.9.175.95                                           23206562400

Metric Info:
985k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-20 01:54:40
End Time: ongoing

First Event Seen: 2026-04-20 01:52:00
Last Event Seen: 2026-04-20 01:53:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243488/