[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #246414 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, April 30, 2026 5:43:07 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #246414 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 246414

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  82709100      275697        18.4%          52.85.185.102
  39342600      131142         8.8%           52.85.185.16
  36432900      121443         8.1%           52.85.185.36
  13870200       46234         3.1%          20.209.242.65
  11682900       38943         2.6%           104.26.7.153
   9714600       32382         2.2%          13.107.136.10
   7293300       24311         1.6%          34.104.35.123
   6882600       22942         1.5%           3.174.255.71
   5361600       17872         1.2%           18.161.97.21
   5077200       16924         1.1%   2001:bf8:900:d:2::71

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  53706000      179020        12.0%      132.76.61.52
  45165300      150551        10.1%      132.76.61.51
  42051600      140172         9.4%      132.76.61.54
  40909500      136365         9.1%      132.76.61.53
  13870500       46235         3.1%       132.70.19.4
  11682900       38943         2.6%     132.77.33.152
  10725300       35751         2.4%   128.139.225.242
   8884200       29614         2.0%      132.68.38.57
   8797500       29325         2.0%     128.139.200.4
   8530500       28435         1.9%     128.139.200.5

Top-10 Possible Targets by Bytes:
         Src IP   Src Port         Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
  52.85.185.102        443                              121806391200
  52.85.185.102                                         121806391200
                             132.76.61.52                76322177400
                       443   132.76.61.52                76079921400
                             132.76.61.51                63958808700
                       443   132.76.61.51                63752034300
                             132.76.61.54                58302842400
                       443   132.76.61.54                58302775200
   52.85.185.16        443                               57935988300
   52.85.185.16                                          57935988300

Metric Info:
2M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate.

Start Time: 2026-04-30 14:33:40
End Time: ongoing

First Event Seen: 2026-04-30 14:31:00
Last Event Seen: 2026-04-30 14:41:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/246414/