[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #258319 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, August 1, 2026 12:15:13 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #258319 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 258319

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  67502400      225008        24.4%     159.60.33.21
  31939200      106464        11.5%   23.218.225.128
  29292600       97642        10.6%    23.218.225.99
  10441800       34806         3.8%   23.218.225.121
   7885800       26286         2.8%     159.60.33.37
   6240000       20800         2.3%     159.60.33.32
   4356600       14522         1.6%      31.13.84.52
   4113900       13713         1.5%    172.217.118.4
   2432700        8109         0.9%   154.61.149.102
   2373000        7910         0.9%   57.144.248.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  75388800      251296        27.2%   128.139.220.90
  15011400       50038         5.4%    132.66.102.40
  13542600       45142         4.9%    132.69.204.87
  10683900       35613         3.9%    132.73.124.72
   8272500       27575         3.0%    132.73.124.48
   7935000       26450         2.9%   128.139.220.91
   6022200       20074         2.2%     132.73.124.8
   5753100       19177         2.1%    132.73.124.68
   4835700       16119         1.7%    192.114.88.10
   4616400       15388         1.7%   132.73.124.220

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               104088073200
                              128.139.220.90               104088073200
                              128.139.220.90               104088073200
    159.60.33.21                                            98422572600
    159.60.33.21                                            98422572600
    159.60.33.21                                            98422572600
  23.218.225.128        443                                 47069924400
  23.218.225.128                                            47069924400
   23.218.225.99        443                                 43112348100
   23.218.225.99                                            43112348100

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-01 09:15:09
End Time: ongoing

First Event Seen: 2026-08-01 09:12:00
Last Event Seen: 2026-08-01 09:13:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/258319/