[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #245420 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, April 26, 2026 3:33:04 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #245420 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 245420

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  73058700      243529        20.3%    160.119.76.31
  41330400      137768        11.5%    160.119.76.36
  37468500      124895        10.4%    160.119.76.30
  33216900      110723         9.2%    160.119.76.33
  29529600       98432         8.2%    160.119.76.37
  28033800       93446         7.8%    160.119.76.39
  20627100       68757         5.7%    160.119.76.34
   2562000        8540         0.7%   157.240.253.63
   2418600        8062         0.7%   40.101.113.128
   2343900        7813         0.7%    17.253.57.197

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  11120100       37067         3.1%   128.139.225.242
   8247600       27492         2.3%    132.70.226.128
   4178400       13928         1.2%     128.139.200.5
   3187500       10625         0.9%      132.76.61.54
   3183900       10613         0.9%     128.139.200.4
   2343600        7812         0.7%      132.71.21.96
   1812600        6042         0.5%     192.114.3.241
   1318200        4394         0.4%      192.114.52.3
   1185000        3950         0.3%     192.114.52.14
   1171200        3904         0.3%   128.139.225.228

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             128.139.225.242                12842743800
                       443    132.70.226.128                12202685400
                              132.70.226.128                12202685400
                       443   128.139.225.242                12038721900
                       443     128.139.200.5                 5505820800
                               128.139.200.5                 5401531800
                               128.139.200.4                 4014465900
                       443     128.139.200.4                 4013257500
  17.253.57.197        443                                   3505599900
  17.253.57.197                                              3505599900

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-26 00:32:48
End Time: ongoing

First Event Seen: 2026-04-26 00:30:00
Last Event Seen: 2026-04-26 00:31:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/245420/