[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #270984 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, October 22, 2026 8:32:36 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #270984 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 270984

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
  6298200       20994        11.1%    20.209.242.65
  1820400        6068         3.2%    162.125.69.15
  1805400        6018         3.2%   138.199.14.107
  1281600        4272         2.3%    172.217.116.4
  1114500        3715         2.0%      2.21.22.161
   964800        3216         1.7%    172.217.114.4
   845400        2818         1.5%    79.124.62.218
   804600        2682         1.4%    17.253.57.197
   726900        2423         1.3%     23.40.244.92
   653400        2178         1.2%    17.253.57.195

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
  6298200       20994        11.1%      132.70.19.4
  1904400        6348         3.4%    192.114.52.14
  1820400        6068         3.2%     132.66.52.64
  1194900        3983         2.1%   132.75.176.154
  1041000        3470         1.8%   132.71.139.174
  1003200        3344         1.8%    132.74.68.134
  1002300        3341         1.8%    128.139.200.4
   909300        3031         1.6%   132.66.193.123
   841200        2804         1.5%    192.114.88.55
   808200        2694         1.4%    128.139.200.5

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
   162.125.69.15        443                                 2675695800
   162.125.69.15                                 40370      2675695800
   162.125.69.15                                            2675695800
                        443    132.66.52.64                 2675695800
                               132.66.52.64      40370      2675695800
                               132.66.52.64                 2675695800
                              192.114.52.14                 2573582100
                        443   192.114.52.14                 2573554500
  138.199.14.107        443                                 2562451800
  138.199.14.107                                            2562451800

Metric Info:
1M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate.

Start Time: 2026-10-22 02:07:34
End Time: ongoing

First Event Seen: 2026-10-22 02:05:00
Last Event Seen: 2026-10-22 05:31:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/270984/