[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #406760 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, February 18, 2026 8:51:44 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #406760 WARN: IUCC (AS378) - [Email_Analysis] [Customer] [IUCC]

Please find the analysis details for the Alert ID: 406760

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  98743500      329145        22.3%          82.147.84.134
  41267700      137559         9.3%           82.147.84.53
  39618600      132062         9.0%          82.147.85.167
  25313100       84377         5.7%          82.147.85.190
   7450500       24835         1.7%           23.50.131.72
   6223500       20745         1.4%   2001:bf8:900:d:2::71
   6190500       20635         1.4%            31.13.84.52
   5254800       17516         1.2%         57.144.248.192
   4505700       15019         1.0%         157.240.253.63
   3449700       11499         0.8%          34.104.35.123

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  19987200       66624         4.5%        128.139.225.242
   8505000       28350         1.9%          128.139.200.4
   8058000       26860         1.8%          132.66.152.16
   7450500       24835         1.7%         132.71.100.148
   6840600       22802         1.5%          128.139.200.5
   6806400       22688         1.5%           132.76.61.53
   6120600       20402         1.4%           132.76.61.52
   4779900       15933         1.1%          132.66.253.82
   4391700       14639         1.0%   2602:fd0f:0:1001::19
   4246800       14156         1.0%           192.114.5.10

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                            128.139.225.242                22659873300
                      443   128.139.225.242                18793456800
                              132.66.152.16                11895355500
  23.50.131.72        443                                  10999939200
  23.50.131.72                                   61037     10999939200
  23.50.131.72                                             10999939200
                      443    132.71.100.148                10999939200
                             132.71.100.148      61037     10999939200
                             132.71.100.148                10999939200
                              128.139.200.4                10869768000

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-02-18 18:51:32
End Time: ongoing

First Event Seen: 2026-02-18 18:49:00
Last Event Seen: 2026-02-18 18:50:00

Further Details:
https://primary.nemo.geant.org/alerts/details/406760/