[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244599 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, April 23, 2026 8:44:06 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244599 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244599

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  31883400      106278         8.5%          160.119.76.37
  30514800      101716         8.1%          160.119.76.38
  26241900       87473         7.0%          160.119.76.36
  24471600       81572         6.5%          160.119.76.31
  23104500       77015         6.1%          160.119.76.33
  21919200       73064         5.8%          160.119.76.32
  21713700       72379         5.8%   2001:bf8:900:d:2::71
  21432300       71441         5.7%         142.251.209.59
  20381100       67937         5.4%          160.119.76.30
   4745400       15818         1.3%           52.84.151.30

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  21495600       71652         5.7%          132.73.124.21
  13123200       43744         3.5%        128.139.225.242
   9313800       31046         2.5%          132.66.253.82
   8940900       29803         2.4%   2602:fd0f:0:1001::17
   6982200       23274         1.9%          128.139.200.5
   6835800       22786         1.8%   2602:fd0f:0:1001::18
   5834100       19447         1.6%           192.114.5.10
   4311600       14372         1.1%          128.139.200.4
   3931500       13105         1.0%         192.114.23.221
   3537900       11793         0.9%         132.73.124.194

Top-10 Possible Targets by Bytes:
                Src IP   Src Port                 Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------------
  2001:bf8:900:d:2::71       8443                                       32541928200
  2001:bf8:900:d:2::71                                                  32541928200
        142.251.209.59        443                                       31098799500
        142.251.209.59                                                  31098799500
                              443          132.73.124.21                31090491000
                                           132.73.124.21                31090491000
                              443          132.66.253.82                13561993200
                                           132.66.253.82                13561993200
                             8443   2602:fd0f:0:1001::17                13401716400
                                    2602:fd0f:0:1001::17                13401716400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-23 17:43:50
End Time: ongoing

First Event Seen: 2026-04-23 17:41:00
Last Event Seen: 2026-04-23 17:42:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244599/