[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #244999 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 25, 2026 2:53:00 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #244999 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 244999

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  58059000      193530        20.8%          160.119.76.27
  30155100      100517        10.8%          160.119.76.29
  26867700       89559         9.6%          160.119.76.23
  24180600       80602         8.7%          160.119.76.19
  23574900       78583         8.5%          160.119.76.28
  16424400       54748         5.9%          160.119.76.18
   4743600       15812         1.7%   2001:bf8:900:d:2::71
   2783400        9278         1.0%        172.217.168.155
   2633700        8779         0.9%            31.13.84.52
   2070300        6901         0.7%        199.232.214.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  10492800       34976         3.8%        128.139.225.242
   5351100       17837         1.9%           192.114.5.10
   3423600       11412         1.2%          132.66.42.122
   3351300       11171         1.2%          128.139.200.5
   2782500        9275         1.0%          132.76.82.194
   2674200        8914         1.0%          128.139.200.4
   2226300        7421         0.8%          192.114.3.241
   1748400        5828         0.6%   2602:fd0f:0:1001::17
   1583100        5277         0.6%           132.76.61.52
   1313700        4379         0.5%            132.70.19.4

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
                                    128.139.225.242                11908659300
                              443   128.139.225.242                10868023800
                                       192.114.5.10                 7357261500
  2001:bf8:900:d:2::71       8443                                   7102643400
  2001:bf8:900:d:2::71                                              7102643400
                               80      192.114.5.10                 5474493900
                                      132.66.42.122                 5056404000
                              443     132.66.42.122                 5056392000
                                      128.139.200.5                 4134910500
                              443     128.139.200.5                 4134063000

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-24 23:52:46
End Time: ongoing

First Event Seen: 2026-04-24 23:50:00
Last Event Seen: 2026-04-24 23:51:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/244999/