[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244247 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, April 22, 2026 5:51:09 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244247 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244247

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  98643900      328813        17.3%    160.119.76.29
  67591800      225306        11.9%    160.119.76.18
  57269700      190899        10.1%    160.119.76.22
  53803200      179344         9.5%    160.119.76.23
  34509300      115031         6.1%    160.119.76.28
  30171600      100572         5.3%    160.119.76.26
  14069100       46897         2.5%     65.9.175.125
  13578000       45260         2.4%      65.9.175.44
   7495800       24986         1.3%   57.144.248.192
   6776400       22588         1.2%      65.9.175.17

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  40713000      135710         7.2%     132.70.60.180
  29254500       97515         5.1%   128.139.225.242
   6381900       21273         1.1%     128.139.200.5
   6247800       20826         1.1%     128.139.200.4
   4607400       15358         0.8%      192.114.5.10
   3351600       11172         0.6%    192.114.23.221
   3213000       10710         0.6%    132.73.124.194
   3150300       10501         0.6%      192.114.52.5
   3128400       10428         0.6%     132.64.244.78
   2938500        9795         0.5%    192.114.91.247

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                              132.70.60.180                60202121700
                      443     132.70.60.180                60202109700
                            128.139.225.242                36280138800
                      443   128.139.225.242                33166319700
  65.9.175.125        443                                  20805193500
  65.9.175.125                                             20805193500
   65.9.175.44        443                                  20075736600
   65.9.175.44                                             20075736600
   65.9.175.17        443                                  10020332100
   65.9.175.17                                             10020332100

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-22 14:46:54
End Time: ongoing

First Event Seen: 2026-04-22 14:44:00
Last Event Seen: 2026-04-22 14:49:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244247/