[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #245068 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 25, 2026 5:36:06 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #245068 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 245068

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  33590400      111968        12.4%     160.119.76.31
  26259000       87530         9.7%     160.119.76.30
  21897600       72992         8.1%     160.119.76.37
  20895000       69650         7.7%     160.119.76.38
  19695300       65651         7.3%     160.119.76.36
  17974800       59916         6.6%     160.119.76.16
  17837400       59458         6.6%     160.119.76.35
  12482400       41608         4.6%     160.119.76.34
   5481000       18270         2.0%   173.194.188.105
   4118700       13729         1.5%     160.119.76.28

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                Dst IP
--------------------------------------------------------
  11443500       38145         4.2%         128.139.200.4
   5298600       17662         2.0%       128.139.225.242
   2553600        8512         0.9%          192.114.5.10
   2143800        7146         0.8%         128.139.200.5
   1972800        6576         0.7%           132.70.19.4
   1623600        5412         0.6%        132.76.220.232
   1574700        5249         0.6%   2001:12d0:8120::104
   1459200        4864         0.5%          132.76.61.54
   1433700        4779         0.5%          132.76.61.53
   1069800        3566         0.4%          132.76.61.52

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
                                      128.139.200.4                15613594800
                              443     128.139.200.4                15612528300
       173.194.188.105        443                                   7895926200
       173.194.188.105                                              7895926200
                                    128.139.225.242                 6180888300
                              443   128.139.225.242                 5660103900
         74.125.162.40        443                                   5529942000
         74.125.162.40                                              5529942000
                                       192.114.5.10                 3140116800
  2001:bf8:900:d:2::71       8443                                   2488884600

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-25 02:35:51
End Time: ongoing

First Event Seen: 2026-04-25 02:33:00
Last Event Seen: 2026-04-25 02:34:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/245068/