[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244844 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 24, 2026 3:28:11 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244844 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244844

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  38031600      126772        12.1%     160.119.76.22
  21683100       72277         6.9%     160.119.76.27
  21677400       72258         6.9%     160.119.76.23
  16331400       54438         5.2%     160.119.76.26
  15484500       51615         4.9%     160.119.76.18
  12451500       41505         4.0%     160.119.76.29
  10155300       33851         3.2%     160.119.76.54
   7512000       25040         2.4%     160.119.76.28
   5274900       17583         1.7%    57.144.248.192
   4562400       15208         1.4%   199.232.210.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  18407700       61359         5.8%   128.139.225.242
   9223200       30744         2.9%     132.66.207.47
   6069600       20232         1.9%    132.76.221.245
   5716800       19056         1.8%    132.73.124.194
   5271900       17573         1.7%     128.139.200.4
   5109900       17033         1.6%     128.139.200.5
   4761900       15873         1.5%      192.114.5.10
   3528900       11763         1.1%     132.73.124.98
   3427200       11424         1.1%    132.76.223.180
   3012000       10040         1.0%     132.66.42.122

Top-10 Possible Targets by Bytes:
  Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------
                      128.139.225.242                22719937200
                443   128.139.225.242                20644804200
                443     132.66.207.47                13291884300
                        132.66.207.47                13291884300
                443    132.76.221.245                 7993548600
                       132.76.221.245                 7993548600
                        128.139.200.4                 6762503700
                443     128.139.200.4                 6761525400
                        128.139.200.5                 6630800400
                443     128.139.200.5                 6630016200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-24 12:27:51
End Time: ongoing

First Event Seen: 2026-04-24 12:25:00
Last Event Seen: 2026-04-24 12:26:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244844/