[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243488 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, April 20, 2026 5:05:53 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243488 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243488

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  24361200       81204        10.7%       65.9.175.44
  22365000       74550         9.9%       65.9.175.17
  22147800       73826         9.8%      65.9.175.125
  19730400       65768         8.7%       65.9.175.95
   9852900       32843         4.3%    142.251.209.42
   5473800       18246         2.4%     160.119.76.35
   5472300       18241         2.4%     20.209.242.65
   3994500       13315         1.8%    172.217.23.170
   3593100       11977         1.6%   142.251.141.234
   2932500        9775         1.3%     160.119.76.30

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  79080300      263601        34.8%     132.70.60.180
  10847400       36158         4.8%     132.74.56.132
   9525600       31752         4.2%      132.70.60.26
   6162900       20543         2.7%     132.74.74.134
   6117000       20390         2.7%   128.139.225.242
   5959800       19866         2.6%     192.114.3.241
   5472300       18241         2.4%       132.70.19.4
   3715500       12385         1.6%     132.65.128.88
   3582600       11942         1.6%     132.66.42.122
   2872500        9575         1.3%     128.139.200.4

Top-10 Possible Targets by Bytes:
        Src IP   Src Port          Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
                      443   132.70.60.180               116931586500
                            132.70.60.180               116931586500
   65.9.175.44        443                                36003176700
   65.9.175.44                                           36003176700
   65.9.175.17        443                                33052299300
   65.9.175.17                                           33052299300
  65.9.175.125        443                                32721213000
  65.9.175.125                                           32721213000
   65.9.175.95        443                                29158038300
   65.9.175.95                                           29158038300

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-20 01:54:40
End Time: ongoing

First Event Seen: 2026-04-20 01:52:00
Last Event Seen: 2026-04-20 02:04:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243488/