[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #248664 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, May 18, 2026 11:39:25 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #248664 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 248664

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
  3361200       11204         4.7%    52.98.237.162
  2078400        6928         2.9%    13.107.138.10
  1746900        5823         2.4%   57.144.248.192
  1711500        5705         2.4%    93.123.17.252
  1510500        5035         2.1%    13.107.136.10
  1292400        4308         1.8%    172.217.23.65
  1021200        3404         1.4%     40.99.217.50
   904500        3015         1.3%    52.98.237.146
   892500        2975         1.2%   57.144.244.192
   885900        2953         1.2%    172.217.23.74

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  2760900        9203         3.9%      192.114.2.35
  2254800        7516         3.1%      132.76.61.52
  2135700        7119         3.0%     128.139.200.4
  1999200        6664         2.8%   192.114.105.254
  1968600        6562         2.7%      132.76.61.53
  1556100        5187         2.2%     128.139.200.5
  1455900        4853         2.0%      132.68.80.70
  1418100        4727         2.0%    192.114.91.244
  1350900        4503         1.9%      132.76.10.42
  1328400        4428         1.9%     192.114.3.241

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                        443     128.139.200.4                 2924226000
                                128.139.200.4                 2924226000
   93.123.17.252         80                                   2446665300
   93.123.17.252                                              2446665300
  57.144.248.192        443                                   2323654800
  57.144.248.192                                              2323654800
                        443     128.139.200.5                 2083451100
                                128.139.200.5                 2083451100
                                 132.76.61.53                 1958728200
                              192.114.105.254                 1731415200

Metric Info:
2M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate.

Start Time: 2026-05-18 08:33:52
End Time: ongoing

First Event Seen: 2026-05-18 08:31:00
Last Event Seen: 2026-05-18 08:36:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/248664/