[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #427357 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, July 6, 2026 6:41:33 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #427357 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 427357

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  71141400      237138        34.2%          23.215.16.149
  10508100       35027         5.0%           159.60.33.37
   6953700       23179         3.3%           159.60.33.32
   5822100       19407         2.8%           159.60.33.21
   4381500       14605         2.1%         142.251.39.138
   4356900       14523         2.1%          142.251.27.95
   3626400       12088         1.7%         199.232.82.172
   2718000        9060         1.3%   2001:bf8:900:d:2::71
   2263500        7545         1.1%         23.218.225.131
   2064600        6882         1.0%         192.178.194.95

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  53974800      179916        25.9%      132.70.60.10
  18675900       62253         9.0%     132.70.60.180
  16330500       54435         7.8%    128.139.220.90
   8376000       27920         4.0%    128.139.220.91
   7092900       23643         3.4%     132.77.39.173
   5339100       17797         2.6%     132.74.74.134
   4562400       15208         2.2%     192.114.88.10
   3297900       10993         1.6%   128.139.225.242
   2475000        8250         1.2%     128.139.200.5
   2466300        8221         1.2%      132.74.70.84

Top-10 Possible Targets by Bytes:
         Src IP   Src Port           Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
  23.215.16.149        443                                106572693000
  23.215.16.149                                           106572693000
                       443     132.70.60.10                80858856000
                               132.70.60.10                80858856000
                       443    132.70.60.180                27952121400
                              132.70.60.180                27952121400
                             128.139.220.90                16082373000
                             128.139.220.90                16082373000
                             128.139.220.90                16082347800
                       443    132.77.39.173                10239247500

Metric Info:
1021k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-07-06 03:41:24
End Time: ongoing

First Event Seen: 2026-07-06 03:39:00
Last Event Seen: 2026-07-06 03:40:00

Further Details:
https://primary.nemo.geant.org/alerts/details/427357/