[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243845 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, April 21, 2026 7:30:10 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243845 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243845

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  39957900      133193        11.2%   160.119.76.29
  29258700       97529         8.2%   160.119.76.27
  25349700       84499         7.1%   160.119.76.28
  22017600       73392         6.2%   160.119.76.19
  19863000       66210         5.6%   160.119.76.25
  14101200       47004         4.0%   160.119.76.18
  13572900       45243         3.8%   160.119.76.16
  10486500       34955         2.9%   132.68.130.55
   9444300       31481         2.7%   16.15.207.102
   9151800       30506         2.6%   52.216.52.217

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  10641300       35471         3.0%      132.70.60.17
  10487100       34957         2.9%       172.64.66.1
   9151800       30506         2.6%     132.76.223.57
   9120600       30402         2.6%     132.76.223.86
   7809900       26033         2.2%     132.76.223.88
   6484200       21614         1.8%     132.66.207.47
   5519100       18397         1.6%   128.139.225.242
   4833600       16112         1.4%    132.76.220.147
   4814400       16048         1.4%    132.76.221.248
   4713300       15711         1.3%      192.114.5.10

Top-10 Possible Targets by Bytes:
         Src IP   Src Port          Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                               172.64.66.1        443     15083214900
                               172.64.66.1                15083214900
  132.68.130.55                                   443     15083190900
  132.68.130.55                                           15083190900
                       443    132.70.60.17                14375416500
                              132.70.60.17                14375416500
  16.15.207.102        443                                13854648600
  16.15.207.102                                           13854648600
                             132.76.223.86                13337262900
                       443   132.76.223.86                13337250900

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-21 04:29:54
End Time: ongoing

First Event Seen: 2026-04-21 04:27:00
Last Event Seen: 2026-04-21 04:28:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243845/