[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #259217 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, August 7, 2026 12:17:22 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #259217 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 259217

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  99933300      333111        29.9%     159.60.33.21
  33014100      110047         9.9%   23.218.225.128
  29131500       97105         8.7%   23.218.225.121
  23567100       78557         7.1%    23.218.225.99
  11776800       39256         3.5%     159.60.33.37
  10263300       34211         3.1%   23.218.225.131
   6450600       21502         1.9%     159.60.33.32
   4015500       13385         1.2%      31.13.84.52
   3157500       10525         0.9%    93.123.17.252
   2674200        8914         0.8%   57.144.248.192

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  111710700      372369        33.4%    128.139.220.90
   14714100       49047         4.4%     132.73.124.72
    9350700       31169         2.8%     132.73.124.48
    7881600       26272         2.4%    128.139.220.91
    7756500       25855         2.3%      132.73.124.8
    6309000       21030         1.9%   128.139.225.242
    6034200       20114         1.8%     132.73.124.96
    5268000       17560         1.6%    132.73.124.112
    4263300       14211         1.3%     192.114.88.10
    3972600       13242         1.2%    132.73.124.216

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               155441826600
                              128.139.220.90               155441801400
                              128.139.220.90               155441801400
    159.60.33.21                                           145914053100
    159.60.33.21                                           145914053100
    159.60.33.21                                           145914053100
  23.218.225.128                                            48468380700
  23.218.225.128        443                                 48451215900
  23.218.225.121        443                                 42179871000
  23.218.225.121                                            42179871000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-07 09:17:11
End Time: ongoing

First Event Seen: 2026-08-07 09:14:00
Last Event Seen: 2026-08-07 09:15:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/259217/