[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #255433 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 11, 2026 12:15:51 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #255433 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 255433

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  76965300      256551        23.6%     159.60.33.21
  32801100      109337        10.0%     159.60.33.32
  12767100       42557         3.9%     159.60.33.37
  10769100       35897         3.3%   216.239.38.223
  10205700       34019         3.1%    20.209.242.65
   5316000       17720         1.6%      31.13.84.52
   4603200       15344         1.4%    162.125.69.15
   4509300       15031         1.4%   57.144.248.192
   4390500       14635         1.3%   57.144.244.192
   4248600       14162         1.3%    132.73.124.72

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  89732700      299109        27.5%    128.139.220.90
  33823800      112746        10.4%    128.139.220.91
  21485400       71618         6.6%    199.232.82.172
  20239500       67465         6.2%   128.139.225.242
  12534600       41782         3.8%      132.64.27.12
  10206000       34020         3.1%       132.70.19.4
   8821800       29406         2.7%     132.77.39.173
   6030300       20101         1.8%     128.139.200.5
   4554000       15180         1.4%     132.74.74.134
   4469700       14899         1.4%     192.114.52.11

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               121713953700
                            128.139.220.90               121713953700
                            128.139.220.90               121713935400
  159.60.33.21                                           109321164600
  159.60.33.21                                           109321164600
  159.60.33.21                                           109321164600
  159.60.33.32                                            44318606100
  159.60.33.32                                            44318606100
  159.60.33.32                                            44318606100
                            128.139.220.91                44318606100

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-11 09:15:44
End Time: ongoing

First Event Seen: 2026-07-11 09:13:00
Last Event Seen: 2026-07-11 09:14:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/255433/