[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244529 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, April 23, 2026 4:38:14 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244529 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244529

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  69092700      230309        11.7%     160.119.76.29
  59112900      197043        10.0%     160.119.76.23
  43112400      143708         7.3%     160.119.76.19
  41105400      137018         6.9%     160.119.76.22
  38045700      126819         6.4%     160.119.76.16
  31268100      104227         5.3%     160.119.76.18
   8759400       29198         1.5%       31.13.84.52
   7219500       24065         1.2%    57.144.248.192
   5467200       18224         0.9%    192.178.183.95
   5174700       17249         0.9%   199.232.210.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  14085600       46952         2.4%     132.66.207.47
  12935700       43119         2.2%   128.139.225.242
  12632400       42108         2.1%      192.114.5.10
   8565900       28553         1.4%     128.139.200.4
   8125500       27085         1.4%     128.139.200.5
   7968600       26562         1.3%    132.73.124.194
   6014400       20048         1.0%    192.114.91.247
   5721900       19073         1.0%       132.70.66.9
   5364300       17881         0.9%    132.65.128.155
   5278200       17594         0.9%    192.114.91.243

Top-10 Possible Targets by Bytes:
       Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                             132.66.207.47                20366283300
                     443     132.66.207.47                20366259300
                           128.139.225.242                14743535700
                              192.114.5.10                13855511700
                     443   128.139.225.242                11763806400
                             128.139.200.4                11198750700
                     443     128.139.200.4                11198019600
  31.13.84.52        443                                  10741998900
  31.13.84.52                                             10741998900
                             128.139.200.5                10680674100

Metric Info:
3M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-23 13:37:50
End Time: ongoing

First Event Seen: 2026-04-23 13:35:00
Last Event Seen: 2026-04-23 13:36:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244529/