[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #427142 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 4, 2026 4:35:35 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #427142 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 427142

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  30824400      102748        10.5%      159.60.33.21
  21540000       71800         7.3%       65.9.175.17
  20816700       69389         7.1%       65.9.175.95
  20331300       67771         6.9%      65.9.175.125
  18508800       61696         6.3%       65.9.175.44
  15257400       50858         5.2%      159.60.33.37
   9129000       30430         3.1%      159.60.33.32
   7149000       23830         2.4%    57.144.248.192
   6062700       20209         2.1%   199.232.210.172
   4478400       14928         1.5%    57.144.244.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  81206700      270689        27.6%      132.70.60.10
  46081800      153606        15.7%    128.139.220.90
  11217600       37392         3.8%   128.139.225.242
  10382700       34609         3.5%     192.114.88.10
   9129000       30430         3.1%    128.139.220.91
   7109700       23699         2.4%     132.77.39.173
   6401700       21339         2.2%     192.114.3.241
   5506500       18355         1.9%      192.114.5.10
   4545900       15153         1.5%     128.139.200.4
   4531800       15106         1.5%     128.139.200.5

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                      443     132.70.60.10               119880183300
                              132.70.60.10               119880183300
                            128.139.220.90                57293712000
                            128.139.220.90                57293712000
                            128.139.220.90                57293712000
  159.60.33.21                                            41480396700
  159.60.33.21                                            41480396700
  159.60.33.21                                            41480396700
   65.9.175.17        443                                 31838254200
   65.9.175.17                                            31838254200

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-07-04 13:35:24
End Time: ongoing

First Event Seen: 2026-07-04 13:33:00
Last Event Seen: 2026-07-04 13:34:00

Further Details:
https://primary.nemo.geant.org/alerts/details/427142/