[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #245749 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, April 27, 2026 1:28:06 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #245749 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 245749

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  66130200      220434        14.3%    160.119.76.36
  50515200      168384        10.9%    160.119.76.34
  43099200      143664         9.3%    160.119.76.31
  38047800      126826         8.2%    160.119.76.39
  35037900      116793         7.6%    160.119.76.38
  33591600      111972         7.3%    160.119.76.33
  11460900       38203         2.5%    20.209.242.65
   6627000       22090         1.4%     159.60.33.37
   5756100       19187         1.2%     159.60.33.33
   5510100       18367         1.2%   57.144.244.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  38926200      129754         8.4%   192.114.101.113
  22608300       75361         4.9%   128.139.225.242
  11460900       38203         2.5%       132.70.19.4
   6627000       22090         1.4%    128.139.220.90
   6222000       20740         1.3%     132.65.180.30
   5756100       19187         1.2%    128.139.220.91
   4899000       16330         1.1%      132.70.60.26
   4654800       15516         1.0%     128.139.200.5
   4268700       14229         0.9%     128.139.200.4
   3627600       12092         0.8%     132.74.242.47

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                            192.114.101.113                58261769400
                            128.139.225.242                26935335900
                      443   128.139.225.242                24979423200
                      443     132.65.180.30                 8726879400
                              132.65.180.30                 8726879400
  159.60.33.37                                              7929252300
  159.60.33.37                                              7929252300
  159.60.33.37                                              7929252300
                             128.139.220.90                 7929252300
                             128.139.220.90                 7929252300

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-26 22:27:49
End Time: ongoing

First Event Seen: 2026-04-26 22:25:00
Last Event Seen: 2026-04-26 22:26:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/245749/