[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243769 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, April 21, 2026 2:59:09 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243769 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243769

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  60903000      203010        15.7%          160.119.76.31
  53365800      177886        13.7%          160.119.76.38
  33032400      110108         8.5%          160.119.76.30
  26215800       87386         6.8%          160.119.76.36
  19729500       65765         5.1%          160.119.76.37
  17760600       59202         4.6%          132.68.130.55
  16135500       53785         4.2%          160.119.76.32
   8036700       26789         2.1%          172.217.23.91
   5592300       18641         1.4%          34.104.35.123
   5373900       17913         1.4%   2001:bf8:900:d:2::71

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  17915400       59718         4.6%       172.64.66.1
  16335900       54453         4.2%     132.76.82.194
  12416700       41389         3.2%   128.139.225.242
   6346800       21156         1.6%    132.76.221.252
   4701300       15671         1.2%    132.76.220.120
   3751800       12506         1.0%     132.65.128.88
   3732600       12442         1.0%      132.76.222.1
   3335700       11119         0.9%     132.66.253.82
   3300300       11001         0.8%     128.139.200.5
   3277800       10926         0.8%      192.114.52.8

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                                 172.64.66.1        443     25556560500
                                 172.64.66.1                25556560500
  132.68.130.55                                     443     25550151300
  132.68.130.55                                             25550151300
                       443     132.76.82.194                21941410500
                               132.76.82.194                21941410500
                             128.139.225.242                14582466000
  172.217.23.91        443                                  10814348100
  172.217.23.91                                             10814348100
                       443   128.139.225.242                10083118800

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-20 23:58:54
End Time: ongoing

First Event Seen: 2026-04-20 23:56:00
Last Event Seen: 2026-04-20 23:57:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243769/