[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #255341 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, July 10, 2026 9:41:01 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #255341 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 255341

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
  8426100       28087         0.7%    51.198.245.19
  8091000       26970         0.7%   210.195.70.111
  7780800       25936         0.6%   217.196.163.66
  7732200       25774         0.6%    213.230.87.99
  7727400       25758         0.6%     88.184.84.24
  7454100       24847         0.6%   99.232.141.100
  7401000       24670         0.6%   188.130.177.80
  7334100       24447         0.6%   185.222.138.27
  7120200       23734         0.6%    176.181.49.95
  7067100       23557         0.6%   88.187.160.173

Top-10 Dst IPs by Packets:
     Packets   Est. Rate   % of Total            Dst IP
------------------------------------------------------
  3419155200    11397184       275.0%    132.74.189.243
    13515000       45050         1.1%   128.139.225.242
     1578000        5260         0.1%      192.114.52.1
     1123200        3744         0.1%     192.114.52.13
     1010700        3369         0.1%     192.114.52.10
      905100        3017         0.1%     192.114.52.12
      867600        2892         0.1%      192.114.52.6
      851400        2838         0.1%      192.114.52.2
      833700        2779         0.1%      192.114.52.7
      802200        2674         0.1%     192.114.52.11

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                               132.74.189.243              1239178902000
                               132.74.189.243        443   1238774336400
                              128.139.225.242                14411444400
                        443   128.139.225.242                12627018300
     31.13.84.52        443                                   6894420000
     31.13.84.52                                              6894420000
  57.144.248.192        443                                   5071846500
  57.144.248.192                                              5071846500
  57.144.244.192        443                                   5013410400
  57.144.244.192                                              5013410400

Metric Info:
18M UDP Packets/s

Alert Type:
time_window

Alert Description:
High UDP packet rate.

Start Time: 2026-07-10 18:32:53
End Time: ongoing

First Event Seen: 2026-07-10 18:30:00
Last Event Seen: 2026-07-10 18:39:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/255341/