[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #245224 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, April 25, 2026 4:35:01 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #245224 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 245224

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  87792300      292641        23.8%     160.119.76.37
  33320400      111068         9.0%     160.119.76.30
  31393200      104644         8.5%     160.119.76.33
  30622800      102076         8.3%     160.119.76.39
  30345300      101151         8.2%     160.119.76.36
  17151900       57173         4.7%     160.119.76.32
   4111500       13705         1.1%    57.144.248.192
   3413100       11377         0.9%       31.13.84.52
   3354600       11182         0.9%    57.144.244.192
   3003900       10013         0.8%   142.251.127.207

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  19399800       64666         5.3%   128.139.225.242
   5704500       19015         1.5%     128.139.200.4
   5501400       18338         1.5%    132.73.124.194
   4719900       15733         1.3%      132.70.60.26
   4581600       15272         1.2%     128.139.200.5
   4188900       13963         1.1%      192.114.5.10
   2092200        6974         0.6%    192.114.91.243
   2016900        6723         0.5%     132.73.124.72
   1913100        6377         0.5%      132.76.61.51
   1845600        6152         0.5%    192.114.23.221

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                              128.139.225.242                23715741000
                        443   128.139.225.242                19631976000
                                128.139.200.4                 7610198100
                        443     128.139.200.4                 7609381800
                        443      132.70.60.26                 6946143300
                                 132.70.60.26                 6946143300
                                128.139.200.5                 5959583400
                        443     128.139.200.5                 5958705900
                               132.73.124.194                 5767341600
  57.144.248.192        443                                   5186792700

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-25 13:34:46
End Time: ongoing

First Event Seen: 2026-04-25 13:32:00
Last Event Seen: 2026-04-25 13:33:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/245224/