[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #270726 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, October 20, 2026 8:09:23 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #270726 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 270726

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  1170000        3900         4.5%   168.144.243.182
  1169400        3898         4.5%    168.144.131.56
  1151100        3837         4.4%    167.71.202.182
  1146000        3820         4.4%   168.144.245.138
  1135200        3784         4.3%     165.232.181.4
  1131300        3771         4.3%     167.71.229.59
  1130400        3768         4.3%    168.144.248.98
  1122600        3742         4.3%    178.128.31.204
  1122300        3741         4.3%   168.144.255.147
  1119900        3733         4.3%    64.227.134.197

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total          Dst IP
-------------------------------------------------
    26400          88         0.1%   17.248.213.66
    22500          75         0.1%   17.248.213.71
    21900          73         0.1%   17.248.213.64
    21900          73         0.1%   17.248.213.68
    20700          69         0.1%   128.139.233.2
    20100          67         0.1%   17.248.213.70
    19800          66         0.1%   17.248.213.67
    19200          64         0.1%   17.248.213.69
    18600          62         0.1%   17.248.213.65
    16800          56         0.1%   128.139.230.2

Top-10 Possible Targets by Bytes:
          Src IP   Src Port   Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------
   165.232.181.4                                       40867200
   165.232.181.4                           2048        40867200
   165.232.181.4                                       40867200
   167.71.229.59                                       40726800
   167.71.229.59                           2048        40726800
   167.71.229.59                                       40726800
  168.144.248.98                                       40694400
  168.144.248.98                           2048        40694400
  168.144.248.98                                       40694400
  178.128.31.204                                       40413600

Metric Info:
102k ICMP Packets/s

Alert Type:
time_window

Alert Description:
High ICMP packet rate.

Start Time: 2026-10-20 11:08:00
End Time: ongoing

First Event Seen: 2026-10-20 11:05:00
Last Event Seen: 2026-10-20 11:09:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/270726/