[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #406321 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, February 14, 2026 12:50:38 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #406321 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

Please find the analysis details for the Alert ID: 406321

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  82590600      275302        22.7%     82.147.84.134
  44536500      148455        12.2%      82.147.84.53
  37168500      123895        10.2%     82.147.85.167
  17680800       58936         4.9%     82.147.84.129
  17668200       58894         4.8%     162.125.69.14
   6480300       21601         1.8%      172.66.0.165
   6275100       20917         1.7%       31.13.84.52
   4568400       15228         1.3%    57.144.248.192
   4071900       13573         1.1%    57.144.244.192
   3242100       10807         0.9%   199.232.214.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  23131800       77106         6.3%   128.139.225.242
  14132700       47109         3.9%      132.76.61.53
   7018500       23395         1.9%     128.139.200.5
   6542700       21809         1.8%     128.139.221.5
   5759700       19199         1.6%    132.73.124.194
   5169600       17232         1.4%     132.74.74.134
   4755000       15850         1.3%     128.139.200.4
   4621500       15405         1.3%    132.73.124.180
   3114900       10383         0.9%    132.64.244.105
   2806500        9355         0.8%      132.76.61.51

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             128.139.225.242                27922318500
  162.125.69.14        443                                  25677413400
  162.125.69.14                                             25677413400
                       443   128.139.225.242                24741199800
                                132.76.61.53                19772397600
                       443      132.76.61.53                19766421600
                       443     128.139.221.5                 9308239800
                               128.139.221.5                 9308239800
                               128.139.200.5                 9264492900
                       443     128.139.200.5                 9263427000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-02-14 10:50:26
End Time: ongoing

First Event Seen: 2026-02-14 10:48:00
Last Event Seen: 2026-02-14 10:49:00

Further Details:
https://primary.nemo.geant.org/alerts/details/406321/