[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243661 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, April 20, 2026 8:06:01 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243661 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243661

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  68331300      227771        16.5%    160.119.76.22
  64130400      213768        15.5%    160.119.76.28
  34508100      115027         8.3%    160.119.76.29
  34386900      114623         8.3%    160.119.76.27
  24483600       81612         5.9%    160.119.76.19
  16668900       55563         4.0%    160.119.76.18
   6819900       22733         1.6%   57.144.248.192
   5770200       19234         1.4%   157.240.253.63
   5535000       18450         1.3%    132.68.130.55
   5363100       17877         1.3%   57.144.244.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  23773800       79246         5.7%   128.139.225.242
   5613600       18712         1.4%     128.139.200.4
   5547600       18492         1.3%       172.64.66.1
   5411700       18039         1.3%     128.139.200.5
   4997400       16658         1.2%     192.114.52.11
   4774800       15916         1.2%      132.70.60.26
   4704900       15683         1.1%    132.64.104.217
   3570000       11900         0.9%       132.70.19.4
   3517200       11724         0.8%      192.114.5.10
   3268200       10894         0.8%      132.76.61.53

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                              128.139.225.242                28722876000
                        443   128.139.225.242                24453492000
  57.144.248.192        443                                   8504569500
  57.144.248.192                                              8504569500
                                  172.64.66.1        443      7928749800
                                  172.64.66.1                 7928749800
   132.68.130.55                                     443      7927771800
   132.68.130.55                                              7927771800
  157.240.253.63        443                                   7094078400
  157.240.253.63                                              7094078400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-20 17:05:44
End Time: ongoing

First Event Seen: 2026-04-20 17:03:00
Last Event Seen: 2026-04-20 17:04:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243661/