[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244324 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, April 22, 2026 10:51:14 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244324 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244324

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  83243700      277479        21.3%    160.119.76.31
  34930500      116435         8.9%    160.119.76.32
  31782000      105940         8.1%    160.119.76.33
  27753000       92510         7.1%    160.119.76.37
  26328000       87760         6.7%    160.119.76.30
  25311600       84372         6.5%    160.119.76.35
   5904300       19681         1.5%      31.13.84.52
   5190600       17302         1.3%   57.144.248.192
   5175000       17250         1.3%    172.217.23.74
   4700700       15669         1.2%   57.144.244.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  28593000       95310         7.3%   128.139.225.242
   6401100       21337         1.6%     128.139.200.5
   5655000       18850         1.4%      132.64.56.40
   4683000       15610         1.2%     128.139.200.4
   4388700       14629         1.1%     192.114.52.10
   3817500       12725         1.0%    132.76.237.173
   3152700       10509         0.8%      132.70.60.17
   2919600        9732         0.7%    192.114.23.221
   2510400        8368         0.6%     192.114.3.241
   2419800        8066         0.6%     132.64.244.78

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                              128.139.225.242                32451453600
                        443   128.139.225.242                26697743100
                                128.139.200.5                 8126235900
                        443     128.139.200.5                 8125604700
     31.13.84.52        443                                   7283528700
     31.13.84.52                                              7283528700
  57.144.248.192        443                                   6400184100
  57.144.248.192                                              6400184100
                                128.139.200.4                 5945304000
                        443     128.139.200.4                 5944449000

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-22 19:50:57
End Time: ongoing

First Event Seen: 2026-04-22 19:48:00
Last Event Seen: 2026-04-22 19:49:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244324/