[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #255340 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, July 10, 2026 9:33:01 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #255340 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 255340

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
  7165200       23884         0.8%     159.60.33.37
  6797100       22657         0.7%     159.60.33.32
  5604600       18682         0.6%    51.198.245.19
  5485500       18285         0.6%     159.60.33.21
  5239500       17465         0.6%   210.195.70.111
  5211900       17373         0.5%     88.184.84.24
  5194800       17316         0.5%   217.196.163.66
  5115900       17053         0.5%    213.230.87.99
  5000100       16667         0.5%   88.187.160.173
  4972200       16574         0.5%      31.13.84.52

Top-10 Dst IPs by Packets:
     Packets   Est. Rate   % of Total            Dst IP
------------------------------------------------------
  2291647800     7638826       241.2%    132.74.189.243
    20904000       69680         2.2%   128.139.225.242
    14620500       48735         1.5%    128.139.220.90
     7998600       26662         0.8%     132.77.39.173
     7503900       25013         0.8%    128.139.220.91
     6197400       20658         0.7%     192.114.3.241
     4723200       15744         0.5%     128.139.200.5
     4344600       14482         0.5%    132.65.128.101
     3907200       13024         0.4%     128.139.200.4
     2649000        8830         0.3%     132.66.140.18

Top-10 Possible Targets by Bytes:
  Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------
                       132.74.189.243               815065198500
                       132.74.189.243        443    814803999300
                      128.139.225.242                24959955300
                443   128.139.225.242                20806996800
                       128.139.220.90                13695610200
                       128.139.220.90                13695597000
                       128.139.220.90                13695571800
                443     132.77.39.173                11538760800
                        132.77.39.173                11538760800
                       128.139.220.91                 7657430400

Metric Info:
19M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-10 18:32:53
End Time: ongoing

First Event Seen: 2026-07-10 18:30:00
Last Event Seen: 2026-07-10 18:31:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/255340/