[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #259217 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, August 7, 2026 12:21:21 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #259217 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 259217

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  178191600      593972        31.9%     159.60.33.21
   61841700      206139        11.1%   23.218.225.128
   53629800      178766         9.6%   23.218.225.121
   36979800      123266         6.6%    23.218.225.99
   21542400       71808         3.9%   23.218.225.131
   16746300       55821         3.0%     159.60.33.37
   10291200       34304         1.8%     159.60.33.32
    6074400       20248         1.1%      31.13.84.52
    4365300       14551         0.8%    93.123.17.252
    4165200       13884         0.7%   57.144.248.192

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  194938500      649795        34.9%    128.139.220.90
   23199600       77332         4.1%     132.73.124.72
   14384700       47949         2.6%     132.73.124.48
   12929400       43098         2.3%      132.73.124.8
   12264300       40881         2.2%    128.139.220.91
    9806700       32689         1.8%   128.139.225.242
    8992200       29974         1.6%    132.73.124.236
    8340300       27801         1.5%     132.73.124.96
    7462200       24874         1.3%    132.73.124.112
    6862800       22876         1.2%     132.73.124.68

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               274067435100
                              128.139.220.90               274067409900
                              128.139.220.90               274067409900
    159.60.33.21                                           261263996100
    159.60.33.21                                           261263996100
    159.60.33.21                                           261263996100
  23.218.225.128                                            90791668500
  23.218.225.128        443                                 90754220100
  23.218.225.121        443                                 78165495300
  23.218.225.121                                            78165495300

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-07 09:17:11
End Time: ongoing

First Event Seen: 2026-08-07 09:14:00
Last Event Seen: 2026-08-07 09:19:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/259217/