[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #238517 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, March 21, 2026 10:14:58 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #238517 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 238517

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  16751700       55839         9.5%    3.171.214.115
  12376200       41254         7.0%    152.42.211.40
   6184500       20615         3.5%     3.171.214.49
   5563200       18544         3.2%     18.66.122.46
   5470500       18235         3.1%     3.171.214.56
   5100600       17002         2.9%    18.66.122.116
   4890000       16300         2.8%   172.217.23.234
   4635900       15453         2.6%    18.66.122.117
   4564500       15215         2.6%     3.171.214.21
   4311600       14372         2.5%     18.66.122.38

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  52584300      175281        29.9%     132.70.60.180
   5908200       19694         3.4%    192.114.23.200
   5071800       16906         2.9%     132.74.74.134
   5051700       16839         2.9%    192.114.23.201
   3684900       12283         2.1%     132.65.180.42
   2996400        9988         1.7%   128.139.225.242
   2476500        8255         1.4%     128.139.200.5
   2073300        6911         1.2%     128.139.200.4
   1839300        6131         1.0%      132.76.61.51
   1517400        5058         0.9%    192.114.50.100

Top-10 Possible Targets by Bytes:
         Src IP   Src Port          Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                       443   132.70.60.180                77696400900
                             132.70.60.180                77696400900
  3.171.214.115        443                                24749535000
  3.171.214.115                                           24749535000
   3.171.214.49        443                                 9139358100
   3.171.214.49                                            9139358100
   18.66.122.46        443                                 8223277500
   18.66.122.46                                            8223277500
   3.171.214.56        443                                 8086175400
   3.171.214.56                                            8086175400

Metric Info:
992k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-03-21 08:14:48
End Time: ongoing

First Event Seen: 2026-03-21 08:12:00
Last Event Seen: 2026-03-21 08:13:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/238517/