[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #245173 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 25, 2026 2:18:09 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #245173 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 245173

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  55753500      185845        17.6%          160.119.76.16
  29415300       98051         9.3%          160.119.76.22
  21119400       70398         6.7%          160.119.76.25
  19245000       64150         6.1%          160.119.76.23
  15692100       52307         5.0%          160.119.76.27
  10409700       34699         3.3%          172.217.23.65
   8103600       27012         2.6%          160.119.76.19
   5223300       17411         1.7%   2001:bf8:900:d:2::71
   5023800       16746         1.6%          162.125.69.12
   4945800       16486         1.6%            31.13.84.52

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  16989000       56630         5.4%   128.139.225.242
  10400400       34668         3.3%      132.64.67.55
   5147700       17159         1.6%     128.139.200.5
   5027100       16757         1.6%     128.139.200.4
   5024700       16749         1.6%     132.73.124.98
   4715400       15718         1.5%      132.70.60.26
   4595700       15319         1.5%     132.66.193.21
   4425600       14752         1.4%    132.73.124.194
   3788700       12629         1.2%      192.114.5.10
   3041700       10139         1.0%    192.114.49.250

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
                                    128.139.225.242                20727510600
                              443   128.139.225.242                17096349600
         172.217.23.65        443                                  13188753900
         172.217.23.65                                             13188753900
                              443      132.64.67.55                13182095700
                                       132.64.67.55                13182095700
         172.217.23.65                                   51923     13181412900
                                       132.64.67.55      51923     13181412900
  2001:bf8:900:d:2::71       8443                                   7823034600
  2001:bf8:900:d:2::71                                              7823034600

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-25 11:17:52
End Time: ongoing

First Event Seen: 2026-04-25 11:15:00
Last Event Seen: 2026-04-25 11:16:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/245173/