[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244212 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, April 22, 2026 11:54:24 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244212 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244212

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  77207700      257359        16.7%    160.119.76.33
  43219500      144065         9.3%    160.119.76.31
  40827600      136092         8.8%    160.119.76.38
  35722800      119076         7.7%    160.119.76.30
  35299800      117666         7.6%    160.119.76.36
  34703700      115679         7.5%    160.119.76.35
  25410600       84702         5.5%    160.119.76.34
   6293100       20977         1.4%   57.144.248.192
   5903400       19678         1.3%   57.144.244.192
   4724700       15749         1.0%   199.232.82.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  18846300       62821         4.1%   128.139.225.242
   4793100       15977         1.0%     128.139.200.4
   4239600       14132         0.9%     128.139.200.5
   3870600       12902         0.8%     132.73.124.98
   3538200       11794         0.8%      132.70.60.17
   3439500       11465         0.7%      132.76.61.51
   3161700       10539         0.7%    192.114.23.221
   3094800       10316         0.7%     132.64.244.19
   2998200        9994         0.6%    192.114.91.244
   2582400        8608         0.6%      132.64.72.94

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                              128.139.225.242                22573021800
                        443   128.139.225.242                20179463700
  57.144.248.192        443                                   7856360400
  57.144.248.192                                              7856360400
  57.144.244.192        443                                   7332439500
  57.144.244.192                                              7332439500
  199.232.82.172                                              6655979400
  199.232.82.172         80                                   6612591600
                                128.139.200.4                 5917296600
                        443     128.139.200.4                 5916342600

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-22 08:53:54
End Time: ongoing

First Event Seen: 2026-04-22 08:51:00
Last Event Seen: 2026-04-22 08:52:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244212/