[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243898 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, April 21, 2026 1:57:30 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243898 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243898

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  55487100      184957        12.4%    160.119.76.30
  32819100      109397         7.3%    160.119.76.33
  27985800       93286         6.3%    160.119.76.34
  27777000       92590         6.2%    160.119.76.31
  26685900       88953         6.0%    160.119.76.39
  26191800       87306         5.9%    160.119.76.32
  20588700       68629         4.6%    160.119.76.35
   8636400       28788         1.9%    132.68.130.55
   6179700       20599         1.4%   57.144.248.192
   5957100       19857         1.3%    13.107.138.10

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  18441600       61472         4.1%   128.139.225.242
   8636400       28788         1.9%       172.64.66.1
   7331700       24439         1.6%    132.66.112.183
   5797500       19325         1.3%     128.139.200.5
   5342700       17809         1.2%     128.139.200.4
   4017000       13390         0.9%     132.70.60.123
   3952800       13176         0.9%      132.76.61.51
   3798600       12662         0.8%    192.114.91.245
   3611100       12037         0.8%      132.76.61.53
   3511800       11706         0.8%      132.76.61.54

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             128.139.225.242                22360534800
                       443   128.139.225.242                20165282400
  132.68.130.55                                     443     12403735800
  132.68.130.55                                             12403735800
                                 172.64.66.1        443     12403735800
                                 172.64.66.1                12403735800
                       443    132.66.112.183                10631570700
                              132.66.112.183                10631570700
                               128.139.200.5                 7666438200
                       443     128.139.200.5                 7665785100

Metric Info:
3M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-21 10:57:06
End Time: ongoing

First Event Seen: 2026-04-21 10:54:00
Last Event Seen: 2026-04-21 10:55:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243898/