[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244149 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, April 22, 2026 6:21:06 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244149 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244149

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  39396000      131320        13.9%     160.119.76.26
  32889600      109632        11.6%     160.119.76.23
  32885100      109617        11.6%     160.119.76.29
  29010900       96703        10.2%     160.119.76.27
  26974800       89916         9.5%     160.119.76.22
  23166600       77222         8.2%     160.119.76.18
   4613400       15378         1.6%    199.232.82.172
   2333100        7777         0.8%     17.253.57.200
   2143200        7144         0.8%   199.232.210.172
   2087400        6958         0.7%   199.232.214.172

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  4283400       14278         1.5%     132.73.124.40
  3989400       13298         1.4%   128.139.225.242
  2332800        7776         0.8%      132.71.21.96
  1999800        6666         0.7%     128.139.200.4
  1634400        5448         0.6%      132.76.61.51
  1484100        4947         0.5%     128.139.200.5
  1359600        4532         0.5%       132.70.19.4
  1344600        4482         0.5%    128.139.220.90
  1309200        4364         0.5%    199.232.82.172
  1260000        4200         0.4%      132.68.16.47

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  199.232.82.172                                              6513252000
  199.232.82.172         80                                   6481351200
                                132.73.124.40                 5737723200
                         80     132.73.124.40                 5675494500
                              128.139.225.242                 3679166700
   17.253.57.200        443                                   3489884400
   17.253.57.200                                              3489884400
   17.253.57.200                                   64080      3489868800
                        443      132.71.21.96                 3489868800
                                 132.71.21.96      64080      3489868800

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-22 03:20:52
End Time: ongoing

First Event Seen: 2026-04-22 03:18:00
Last Event Seen: 2026-04-22 03:19:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244149/