[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244899 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 24, 2026 6:40:07 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244899 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244899

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  72602400      242008        17.1%     160.119.76.32
  41126700      137089         9.7%     160.119.76.36
  35373900      117913         8.3%     160.119.76.37
  34737600      115792         8.2%     160.119.76.35
  31484400      104948         7.4%     160.119.76.38
  30123300      100411         7.1%     160.119.76.34
  21621300       72071         5.1%     160.119.76.30
   6002700       20009         1.4%   142.251.127.207
   4793400       15978         1.1%      58.240.135.7
   4312200       14374         1.0%    57.144.248.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  18079800       60266         4.3%   128.139.225.242
   4938600       16462         1.2%      192.114.5.10
   4758900       15863         1.1%    132.73.124.194
   4577100       15257         1.1%     128.139.200.5
   4453800       14846         1.0%     128.139.200.4
   4109100       13697         1.0%     132.76.223.38
   4085100       13617         1.0%    132.73.124.145
   3585300       11951         0.8%     132.71.146.63
   3176700       10589         0.7%      192.114.52.4
   2085600        6952         0.5%     132.76.223.30

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                               128.139.225.242                21736692300
                         443   128.139.225.242                18730231500
  142.251.127.207        443                                   7805968800
  142.251.127.207                                              7805968800
                         443     132.76.223.38                 5799264900
                                 132.76.223.38                 5799264900
                         443     132.71.146.63                 5358994200
                                 132.71.146.63                 5358994200
                                  192.114.5.10                 4960864800
                         443      192.114.5.10                 4128493200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-24 15:39:47
End Time: ongoing

First Event Seen: 2026-04-24 15:37:00
Last Event Seen: 2026-04-24 15:38:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244899/