[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #406582 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, February 16, 2026 7:51:37 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #406582 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

Please find the analysis details for the Alert ID: 406582

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
  8744100       29147         2.4%    134.76.97.126
  8413800       28046         2.4%   142.251.140.97
  8356200       27854         2.3%   57.144.248.192
  7828200       26094         2.2%    149.156.5.205
  7267500       24225         2.0%   192.178.203.95
  6895800       22986         1.9%   157.240.253.63
  6645900       22153         1.9%    149.156.5.217
  6477000       21590         1.8%   57.144.244.192
  6336600       21122         1.8%    162.125.69.14
  5151300       17171         1.4%    52.98.237.146

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  117426300      391421        32.9%   192.114.101.113
   22977000       76590         6.4%   128.139.225.242
   10100400       33668         2.8%     128.139.200.5
   10027800       33426         2.8%      132.64.81.65
    9867300       32891         2.8%     128.139.200.4
    8417700       28059         2.4%      132.76.61.53
    8374200       27914         2.3%    132.64.196.237
    7238100       24127         2.0%    132.73.124.194
    5955600       19852         1.7%      132.76.61.51
    5790600       19302         1.6%      192.114.5.10

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             192.114.101.113               175684493400
                     11000   192.114.101.113                31001002800
                             128.139.225.242                26890375200
                      1094   192.114.101.113                20515435500
                       443   128.139.225.242                20050515300
                      8443   192.114.101.113                16854284400
                       443      132.64.81.65                14450374800
                                132.64.81.65                14450374800
  134.76.97.126                                             13110241800
                               128.139.200.5                13015569000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-02-16 17:51:27
End Time: ongoing

First Event Seen: 2026-02-16 17:49:00
Last Event Seen: 2026-02-16 17:50:00

Further Details:
https://primary.nemo.geant.org/alerts/details/406582/