[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #255340 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, July 10, 2026 9:37:02 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #255340 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 255340

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
  9527400       31758         0.7%     159.60.33.32
  8426100       28087         0.6%    51.198.245.19
  8091000       26970         0.6%   210.195.70.111
  7780800       25936         0.6%   217.196.163.66
  7732200       25774         0.6%    213.230.87.99
  7727400       25758         0.6%     88.184.84.24
  7454100       24847         0.5%   99.232.141.100
  7401000       24670         0.5%   188.130.177.80
  7334100       24447         0.5%   185.222.138.27
  7165200       23884         0.5%     159.60.33.37

Top-10 Dst IPs by Packets:
     Packets   Est. Rate   % of Total            Dst IP
------------------------------------------------------
  3467826000    11559420       252.5%    132.74.189.243
    24726000       82420         1.8%   128.139.225.242
    15055500       50185         1.1%    128.139.220.90
    10428000       34760         0.8%    128.139.220.91
     7998600       26662         0.6%     132.77.39.173
     7475700       24919         0.5%     192.114.3.241
     5649600       18832         0.4%     128.139.200.5
     4587600       15292         0.3%     128.139.200.4
     4344600       14482         0.3%    132.65.128.101
     3138300       10461         0.2%     132.66.140.18

Top-10 Possible Targets by Bytes:
  Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------
                       132.74.189.243              1265658154500
                       132.74.189.243        443   1265253165300
                      128.139.225.242                29437208700
                443   128.139.225.242                24697209900
                       128.139.220.90                13695610200
                       128.139.220.90                13695597000
                       128.139.220.90                13695571800
                443     132.77.39.173                11538760800
                        132.77.39.173                11538760800
                       128.139.220.91                10411236000

Metric Info:
3M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-10 18:32:53
End Time: ongoing

First Event Seen: 2026-07-10 18:30:00
Last Event Seen: 2026-07-10 18:35:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/255340/