[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #249118 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, May 21, 2026 7:42:05 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #249118 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 249118

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  37599300      125331        12.9%   146.75.122.172
  15626700       52089         5.4%    23.32.238.155
   8884500       29615         3.1%     92.223.97.79
   8334300       27781         2.9%    23.32.238.107
   7760100       25867         2.7%      2.19.198.48
   6937800       23126         2.4%   17.253.122.197
   6794700       22649         2.3%      2.19.198.56
   4890600       16302         1.7%      23.48.23.39
   4368000       14560         1.5%      2.19.198.59
   3814200       12714         1.3%    23.32.238.115

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  11723100       39077         4.0%      132.76.61.53
   8324700       27749         2.9%      132.76.61.51
   7034100       23447         2.4%   128.139.225.242
   6100800       20336         2.1%    128.139.220.91
   5371500       17905         1.8%     132.74.74.134
   4495800       14986         1.5%      92.223.97.79
   4437300       14791         1.5%    132.71.138.168
   4353900       14513         1.5%     132.71.124.39
   4064100       13547         1.4%    132.71.138.175
   3908400       13028         1.3%      192.114.5.10

Top-10 Possible Targets by Bytes:
          Src IP   Src Port         Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
  146.75.122.172                                          52564716600
  146.75.122.172        443                               43427586900
   23.32.238.155        443                               23398361400
   23.32.238.155                                          23398361400
                              132.76.61.53                15803162700
                        443   132.76.61.53                15802875900
    92.223.97.79         80                               13101730200
    92.223.97.79                                          13101730200
                              132.76.61.51                10455104100
                        443   132.76.61.51                10447016100

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-05-21 04:41:55
End Time: ongoing

First Event Seen: 2026-05-21 04:39:00
Last Event Seen: 2026-05-21 04:40:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/249118/