[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #407797 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, February 24, 2026 2:36:37 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #407797 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

Please find the analysis details for the Alert ID: 407797

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  47065200      156884        18.0%     95.100.181.10
  43620900      145403        16.7%     95.100.181.15
  13190400       43968         5.0%    199.232.82.172
   6774600       22582         2.6%   142.250.181.170
   6040800       20136         2.3%     34.104.35.123
   4672800       15576         1.8%     172.217.23.74
   4396800       14656         1.7%      172.66.0.165
   4239000       14130         1.6%     13.107.138.10
   2936400        9788         1.1%       92.61.235.4
   2506800        8356         1.0%     17.253.57.195

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  15332700       51109         5.9%     192.114.3.241
  13998900       46663         5.4%     132.73.124.48
  13157100       43857         5.0%   128.139.225.242
  13054800       43516         5.0%     132.73.124.72
  12274500       40915         4.7%     132.73.124.68
  10077900       33593         3.9%    132.73.124.236
   6844500       22815         2.6%      132.73.124.8
   6340200       21134         2.4%    132.73.124.220
   5060100       16867         1.9%     128.139.221.5
   4194000       13980         1.6%      132.76.61.52

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
   95.100.181.10                                           70483969200
   95.100.181.10        443                                70483862400
   95.100.181.15        443                                65271375000
   95.100.181.15                                           65271375000
                              132.73.124.48                20203923000
                        443   132.73.124.48                20067143700
  199.232.82.172                                           18786230400
                              132.73.124.72                18527535000
                        443   132.73.124.72                18487876200
                        443   132.73.124.68                18026600400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-02-24 00:36:28
End Time: ongoing

First Event Seen: 2026-02-24 00:34:00
Last Event Seen: 2026-02-24 00:35:00

Further Details:
https://primary.nemo.geant.org/alerts/details/407797/