[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #427094 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 4, 2026 12:16:33 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #427094 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 427094

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  122700300      409001        27.9%     159.60.33.21
   43832400      146108        10.0%    23.218.225.99
   34227600      114092         7.8%   23.218.225.128
   30024000      100080         6.8%   136.66.199.166
   20175600       67252         4.6%     159.60.33.32
   18978900       63263         4.3%    8.231.172.231
   11454900       38183         2.6%     159.60.33.37
   10557000       35190         2.4%     35.192.7.178
    6242100       20807         1.4%   57.144.248.192
    4546500       15155         1.0%   157.240.253.63

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  134155200      447184        30.5%    128.139.220.90
   20175600       67252         4.6%    128.139.220.91
   13885800       46286         3.2%     132.73.124.72
   12486300       41621         2.8%   128.139.225.242
   11514300       38381         2.6%     192.114.88.10
    8680200       28934         2.0%      132.73.124.8
    6282300       20941         1.4%     132.73.124.60
    5813400       19378         1.3%    199.232.82.172
    5352600       17842         1.2%     132.73.124.96
    5259000       17530         1.2%     128.139.200.4

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               187450249200
                              128.139.220.90               187450249200
                              128.139.220.90               187450249200
    159.60.33.21                                           177773856900
    159.60.33.21                                           177773856900
    159.60.33.21                                           177773856900
   23.218.225.99        443                                 64440235500
   23.218.225.99                                            64440235500
  23.218.225.128        443                                 50406536400
  23.218.225.128                                            50406536400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-07-04 09:16:22
End Time: ongoing

First Event Seen: 2026-07-04 09:14:00
Last Event Seen: 2026-07-04 09:15:00

Further Details:
https://primary.nemo.geant.org/alerts/details/427094/