[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #245173 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 25, 2026 2:22:01 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #245173 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 245173

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  84806100      282687        17.9%          160.119.76.16
  46420200      154734         9.8%          160.119.76.22
  45416400      151388         9.6%          160.119.76.25
  36270600      120902         7.7%          160.119.76.23
  31892400      106308         6.7%          160.119.76.27
  24130800       80436         5.1%          160.119.76.19
  12560400       41868         2.7%          172.217.23.65
   8051100       26837         1.7%          162.125.69.12
   5766000       19220         1.2%            31.13.84.52
   5628900       18763         1.2%   2001:bf8:900:d:2::71

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  20048700       66829         4.2%   128.139.225.242
  14241900       47473         3.0%      132.70.60.26
  12549000       41830         2.6%      132.64.67.55
   7572600       25242         1.6%     132.66.193.21
   6345600       21152         1.3%     128.139.200.5
   5932500       19775         1.3%     128.139.200.4
   5484000       18280         1.2%     132.73.124.98
   4965600       16552         1.0%    132.73.124.194
   4139700       13799         0.9%      192.114.5.10
   3082800       10276         0.7%    192.114.49.250

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             128.139.225.242                24466710300
                                132.70.60.26                20976942600
                       443      132.70.60.26                20976918600
                       443   128.139.225.242                20270419800
  172.217.23.65        443                                  15912450000
  172.217.23.65                                             15912450000
                       443      132.64.67.55                15903660600
                                132.64.67.55                15903660600
  172.217.23.65                                   51923     15902952300
                                132.64.67.55      51923     15902952300

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-25 11:17:52
End Time: ongoing

First Event Seen: 2026-04-25 11:15:00
Last Event Seen: 2026-04-25 11:20:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/245173/