[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #258319 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, August 1, 2026 12:19:08 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #258319 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 258319

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  145449000      484830        29.4%     159.60.33.21
   63744300      212481        12.9%   23.218.225.128
   57101700      190339        11.5%    23.218.225.99
   26194500       87315         5.3%   23.218.225.121
   12066300       40221         2.4%     159.60.33.37
   11856600       39522         2.4%     159.60.33.32
    6635400       22118         1.3%      31.13.84.52
    6173100       20577         1.2%    172.217.118.4
    3960000       13200         0.8%   57.144.248.192
    3386100       11287         0.7%   17.253.122.201

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  157516500      525055        31.8%    128.139.220.90
   19638900       65463         4.0%     132.73.124.72
   19601100       65337         4.0%     132.69.204.87
   15205800       50686         3.1%     132.66.102.40
   14678100       48927         3.0%     132.73.124.48
   14312100       47707         2.9%    128.139.220.91
   11670900       38903         2.4%      132.73.124.8
   10719000       35730         2.2%     132.73.124.68
    7129200       23764         1.4%     192.114.88.10
    7097100       23657         1.4%   128.139.225.242

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               221609991900
                              128.139.220.90               221609933700
                              128.139.220.90               221609913300
    159.60.33.21                                           213445880100
    159.60.33.21                                           213445880100
    159.60.33.21                                           213445880100
  23.218.225.128        443                                 93800856300
  23.218.225.128                                            93800856300
   23.218.225.99        443                                 83953782000
   23.218.225.99                                            83953782000

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-01 09:15:09
End Time: ongoing

First Event Seen: 2026-08-01 09:12:00
Last Event Seen: 2026-08-01 09:17:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/258319/