[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #406567 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, February 16, 2026 6:25:34 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #406567 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

Please find the analysis details for the Alert ID: 406567

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  16056000       53520         4.0%     95.100.181.33
  15511200       51704         3.9%   192.178.203.136
  15504000       51680         3.9%     95.100.181.31
  15455100       51517         3.9%    192.178.203.91
  14600100       48667         3.7%    192.178.203.93
  13931700       46439         3.5%   192.178.203.190
  12081900       40273         3.0%      95.100.181.9
  10537200       35124         2.7%    57.144.248.192
   8412600       28042         2.1%     95.100.181.17
   8385000       27950         2.1%    157.240.253.63

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  21791100       72637         5.5%   128.139.225.242
  11421600       38072         2.9%      132.73.124.8
  10479300       34931         2.6%      132.76.61.53
  10406400       34688         2.6%     132.73.124.68
   9922800       33076         2.5%     128.139.200.4
   9558300       31861         2.4%     128.139.200.5
   8790600       29302         2.2%     132.73.124.72
   8616900       28723         2.2%    132.73.124.168
   7338300       24461         1.8%     132.73.124.32
   7121100       23737         1.8%    132.73.124.194

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                               128.139.225.242                23929047300
    95.100.181.33        443                                  23899056000
    95.100.181.33                                             23899056000
    95.100.181.31                                             23110441200
    95.100.181.31        443                                  22947308100
  192.178.203.136        443                                  22424805600
  192.178.203.136                                             22424805600
   192.178.203.91        443                                  22356321300
   192.178.203.91                                             22356321300
   192.178.203.93        443                                  21118580400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-02-16 16:25:22
End Time: ongoing

First Event Seen: 2026-02-16 16:23:00
Last Event Seen: 2026-02-16 16:24:00

Further Details:
https://primary.nemo.geant.org/alerts/details/406567/