[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #271551 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, October 25, 2026 8:47:44 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #271551 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 271551

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  6546000       21820        12.1%   157.119.188.210
  3743700       12479         6.9%     172.217.116.4
  1992000        6640         3.7%     13.140.177.81
   963900        3213         1.8%   216.180.246.204
   910200        3034         1.7%     132.64.24.250
   896700        2989         1.7%     79.124.62.218
   885600        2952         1.6%   192.178.194.207
   863700        2879         1.6%    199.232.82.172
   833400        2778         1.5%     23.32.238.130
   810300        2701         1.5%      23.32.238.98

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
  6546000       21820        12.1%    132.77.222.76
  3128700       10429         5.8%    132.74.74.134
  1443300        4811         2.7%     132.68.7.253
   935100        3117         1.7%   192.114.49.250
   909900        3033         1.7%   17.248.172.236
   870600        2902         1.6%    128.139.200.5
   759600        2532         1.4%    132.71.79.153
   665100        2217         1.2%    132.66.160.99
   628800        2096         1.2%    128.139.200.4
   597300        1991         1.1%    132.74.68.134

Top-10 Possible Targets by Bytes:
           Src IP   Src Port          Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
  157.119.188.210        443                                 7108956000
  157.119.188.210                                 54391      7108956000
  157.119.188.210                                            7108956000
                         443   132.77.222.76                 7108956000
                               132.77.222.76      54391      7108956000
                               132.77.222.76                 7108956000
    172.217.116.4        443                                 5218727400
    172.217.116.4                                            5218727400
                         443   132.74.74.134                 4478489100
                               132.74.74.134                 4478489100

Metric Info:
1M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate.

Start Time: 2026-10-25 02:07:46
End Time: ongoing

First Event Seen: 2026-10-25 02:05:00
Last Event Seen: 2026-10-25 06:45:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/271551/