[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244247 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, April 22, 2026 5:47:15 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244247 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244247

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  72212100      240707        16.9%   160.119.76.29
  44569500      148565        10.4%   160.119.76.18
  39140100      130467         9.1%   160.119.76.23
  38027700      126759         8.9%   160.119.76.22
  21711900       72373         5.1%   160.119.76.28
  18869400       62898         4.4%   160.119.76.26
  14069100       46897         3.3%    65.9.175.125
  13578000       45260         3.2%     65.9.175.44
   6776400       22588         1.6%     65.9.175.17
   6287700       20959         1.5%     65.9.175.95

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  40713000      135710         9.5%     132.70.60.180
  24363300       81211         5.7%   128.139.225.242
   5312100       17707         1.2%     128.139.200.5
   5157600       17192         1.2%     128.139.200.4
   4288800       14296         1.0%      192.114.5.10
   2839800        9466         0.7%    192.114.23.221
   2786700        9289         0.7%      192.114.52.5
   2586300        8621         0.6%     132.64.244.78
   2380500        7935         0.6%    132.73.124.194
   2304600        7682         0.5%    192.114.91.247

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                              132.70.60.180                60202121700
                      443     132.70.60.180                60202109700
                            128.139.225.242                30237045300
                      443   128.139.225.242                27694246200
  65.9.175.125        443                                  20805193500
  65.9.175.125                                             20805193500
   65.9.175.44        443                                  20075736600
   65.9.175.44                                             20075736600
   65.9.175.17        443                                  10020332100
   65.9.175.17                                             10020332100

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-22 14:46:54
End Time: ongoing

First Event Seen: 2026-04-22 14:44:00
Last Event Seen: 2026-04-22 14:45:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244247/