[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #259786 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, August 11, 2026 3:09:07 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #259786 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 259786

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  99989700      333299        46.1%           159.60.33.32
  11487000       38290         5.3%           159.60.33.37
  10860900       36203         5.0%           159.60.33.21
   3783000       12610         1.7%          52.216.52.208
   3604500       12015         1.7%          52.216.35.128
   3588600       11962         1.7%          16.182.42.232
   3031500       10105         1.4%            31.13.84.52
   2580900        8603         1.2%         23.218.225.120
   1880400        6268         0.9%           89.44.86.234
   1402500        4675         0.6%   2001:bf8:900:d:2::71

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  100941000      336470        46.5%    128.139.220.91
   22347900       74493        10.3%    128.139.220.90
    3943200       13144         1.8%     192.114.88.10
    3928500       13095         1.8%     132.65.180.12
    3783000       12610         1.7%     132.65.180.18
    3604500       12015         1.7%     132.65.180.21
    3077400       10258         1.4%   128.139.225.242
    2348700        7829         1.1%     128.139.200.5
    1743600        5812         0.8%     132.64.82.171
    1555500        5185         0.7%     128.139.200.4

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
  159.60.33.32                                           146441047500
  159.60.33.32                                           146441047500
  159.60.33.32                                           146441047500
                            128.139.220.91               146441047500
                            128.139.220.91               146441047500
                            128.139.220.91               146441047500
                            128.139.220.90                24452151900
                            128.139.220.90                24452151900
                            128.139.220.90                24452151900
  159.60.33.21                                            12972583500

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-11 00:09:01
End Time: ongoing

First Event Seen: 2026-08-11 00:06:00
Last Event Seen: 2026-08-11 00:07:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/259786/