[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244844 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 24, 2026 3:32:17 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244844 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244844

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  67278000      224260        14.2%    160.119.76.22
  36897000      122990         7.8%    160.119.76.23
  33777000      112590         7.1%    160.119.76.27
  29486400       98288         6.2%    160.119.76.29
  28404000       94680         6.0%    160.119.76.26
  27203700       90679         5.8%    160.119.76.18
  22371300       74571         4.7%    160.119.76.28
  16417800       54726         3.5%    160.119.76.54
   6388800       21296         1.4%   57.144.248.192
   5460000       18200         1.2%    142.251.20.95

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  22161000       73870         4.7%   128.139.225.242
  12719400       42398         2.7%     132.66.207.47
   7802400       26008         1.6%    132.76.221.245
   6922800       23076         1.5%    132.73.124.194
   6243000       20810         1.3%     128.139.200.4
   6120300       20401         1.3%     128.139.200.5
   5273400       17578         1.1%      192.114.5.10
   4123500       13745         0.9%     132.73.124.98
   3760500       12535         0.8%     132.66.42.122
   3427200       11424         0.7%    132.76.223.180

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                               128.139.225.242                27325935300
                         443   128.139.225.242                24834946800
                         443     132.66.207.47                18342929100
                                 132.66.207.47                18342929100
                         443    132.76.221.245                10528535100
                                132.76.221.245                10528535100
    142.251.20.95        443                                   7393575600
    142.251.20.95                                              7393575600
  199.232.210.172                                              7365769200
                                 128.139.200.4                 6762503700

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-24 12:27:51
End Time: ongoing

First Event Seen: 2026-04-24 12:25:00
Last Event Seen: 2026-04-24 12:30:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244844/