[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #245365 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, April 26, 2026 1:43:09 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #245365 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 245365

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  51421800      171406        15.1%     160.119.76.27
  46102800      153676        13.5%     160.119.76.25
  33077100      110257         9.7%     160.119.76.28
  28244700       94149         8.3%     160.119.76.16
  25404000       84680         7.4%     160.119.76.22
  24237000       80790         7.1%     160.119.76.29
   5187000       17290         1.5%    57.144.248.192
   4936200       16454         1.4%    157.240.253.63
   4787100       15957         1.4%    57.144.244.192
   3272400       10908         1.0%   172.217.168.138

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  21634200       72114         6.3%   128.139.225.242
   9812100       32707         2.9%    132.70.226.128
   4728900       15763         1.4%      132.70.60.26
   4536900       15123         1.3%     128.139.200.5
   4014600       13382         1.2%     128.139.200.4
   2717400        9058         0.8%    132.76.223.178
   2325300        7751         0.7%    192.114.49.250
   2292600        7642         0.7%     132.74.242.36
   2264100        7547         0.7%      132.71.20.27
   1941300        6471         0.6%      192.114.52.7

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                              128.139.225.242                26798263200
                        443   128.139.225.242                24841626000
                        443    132.70.226.128                14508568500
                               132.70.226.128                14508568500
                        443      132.70.60.26                 6957683400
                                 132.70.60.26                 6957683400
  57.144.248.192        443                                   6419385300
  57.144.248.192                                              6419385300
  157.240.253.63        443                                   6057283200
  157.240.253.63                                              6057283200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-25 22:42:55
End Time: ongoing

First Event Seen: 2026-04-25 22:40:00
Last Event Seen: 2026-04-25 22:41:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/245365/