[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244754 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 24, 2026 6:20:52 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244754 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244754

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  49788000      165960        31.6%   2001:bf8:900:d:2::71
   1914000        6380         1.2%          52.217.94.108
   1869900        6233         1.2%           52.84.151.13
   1811700        6039         1.1%        199.232.214.172
   1691400        5638         1.1%          16.15.228.171
   1652700        5509         1.0%          52.98.243.146
   1590300        5301         1.0%          16.182.39.185
   1584300        5281         1.0%          20.209.242.65
   1508400        5028         1.0%        199.232.210.172
   1426800        4756         0.9%         199.232.82.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  16497600       54992        10.5%   2602:fd0f:0:1001::17
  16393200       54644        10.4%   2602:fd0f:0:1001::19
   8166600       27222         5.2%   2602:fd0f:0:1001::18
   8115600       27052         5.1%   2602:fd0f:0:1001::20
   7547400       25158         4.8%           192.114.5.10
   5195400       17318         3.3%           132.70.60.17
   4668900       15563         3.0%        128.139.225.242
   3348600       11162         2.1%          132.66.253.82
   2898900        9663         1.8%          192.114.3.241
   2511300        8371         1.6%          132.73.124.40

Top-10 Possible Targets by Bytes:
                Src IP   Src Port                 Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------------
  2001:bf8:900:d:2::71       8443                                       74499951600
  2001:bf8:900:d:2::71                                                  74499951600
                             8443   2602:fd0f:0:1001::17                24700410600
                                    2602:fd0f:0:1001::17                24700410600
                             8443   2602:fd0f:0:1001::19                24534339600
                                    2602:fd0f:0:1001::19                24534339600
                             8443   2602:fd0f:0:1001::18                12224971800
                                    2602:fd0f:0:1001::18                12224971800
                             8443   2602:fd0f:0:1001::20                12144717600
                                    2602:fd0f:0:1001::20                12144717600

Metric Info:
901k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-24 03:20:45
End Time: ongoing

First Event Seen: 2026-04-24 03:18:00
Last Event Seen: 2026-04-24 03:19:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244754/