[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243968 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, April 21, 2026 6:58:18 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243968 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243968

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  72256200      240854        17.1%    160.119.76.26
  64069500      213565        15.1%    160.119.76.25
  49141800      163806        11.6%    160.119.76.18
  38040000      126800         9.0%    160.119.76.23
   7884300       26281         1.9%   57.144.248.192
   7497000       24990         1.8%      172.64.66.1
   6909300       23031         1.6%    132.68.130.55
   6819300       22731         1.6%   57.144.244.192
   6171900       20573         1.5%   157.240.253.63
   3336300       11121         0.8%     157.240.0.63

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  25255500       84185         6.0%   128.139.225.242
   7534200       25114         1.8%     128.139.200.4
   7123500       23745         1.7%       172.64.66.1
   7065300       23551         1.7%     128.139.200.5
   7004700       23349         1.7%      132.68.38.78
   5542500       18475         1.3%    132.73.124.194
   4646700       15489         1.1%     132.73.124.98
   3904500       13015         0.9%      192.114.5.10
   2977800        9926         0.7%    192.114.23.221
   2928300        9761         0.7%    132.67.247.191

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             128.139.225.242                29977440900
                       443   128.139.225.242                26950526700
    172.64.66.1        443                                  10446385800
    172.64.66.1                                             10446385800
                       443      132.68.38.78                10438686600
                                132.68.38.78                10438686600
                                 172.64.66.1        443      9935628600
                                 172.64.66.1                 9935628600
  132.68.130.55                                     443      9924375000
  132.68.130.55                                              9924375000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-21 15:53:55
End Time: ongoing

First Event Seen: 2026-04-21 15:51:00
Last Event Seen: 2026-04-21 15:56:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243968/