[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #245068 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 25, 2026 5:39:58 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #245068 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 245068

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  62871600      209572        15.2%     160.119.76.31
  41350800      137836        10.0%     160.119.76.30
  36717000      122390         8.9%     160.119.76.37
  36304800      121016         8.8%     160.119.76.38
  35184000      117280         8.5%     160.119.76.35
  34854000      116180         8.4%     160.119.76.36
  26587500       88625         6.4%     160.119.76.34
  20255100       67517         4.9%     160.119.76.16
   7015200       23384         1.7%   173.194.188.105
   4738500       15795         1.1%     160.119.76.28

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                Dst IP
--------------------------------------------------------
  13284600       44282         3.2%         128.139.200.4
   6100800       20336         1.5%       128.139.225.242
   3453000       11510         0.8%          192.114.5.10
   2492700        8309         0.6%         128.139.200.5
   2364300        7881         0.6%           132.70.19.4
   2003100        6677         0.5%        132.76.220.232
   1902300        6341         0.5%          132.74.76.83
   1759500        5865         0.4%          132.76.61.53
   1688700        5629         0.4%          132.76.61.54
   1574700        5249         0.4%   2001:12d0:8120::104

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                                 128.139.200.4                18115683900
                         443     128.139.200.4                18114519900
  173.194.188.105        443                                  10102535700
  173.194.188.105                                             10102535700
                               128.139.225.242                 7084361700
                         443   128.139.225.242                 6462582900
    74.125.162.40        443                                   5529942000
    74.125.162.40                                              5529942000
                                  192.114.5.10                 4393453200
   17.253.122.201                                              3671245800

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-25 02:35:51
End Time: ongoing

First Event Seen: 2026-04-25 02:33:00
Last Event Seen: 2026-04-25 02:38:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/245068/