[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #255841 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 14, 2026 8:09:08 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #255841 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 255841

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  56257200      187524         9.3%          79.124.60.194
  44094300      146981         7.3%           159.60.33.37
  36278100      120927         6.0%   2001:bf8:900:d:2::71
  30579300      101931         5.0%         199.232.82.172
  24730500       82435         4.1%           159.60.33.32
  21320400       71068         3.5%        199.232.214.172
  19655100       65517         3.2%        199.232.210.172
  18240000       60800         3.0%           159.60.33.21
  13731300       45771         2.3%          93.123.17.252
  12138600       40462         2.0%            31.13.84.52

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  62334600      207782        10.3%    128.139.220.90
  28232100       94107         4.6%    128.139.220.91
  16861800       56206         2.8%    132.68.176.122
  15676800       52256         2.6%   128.139.225.242
  14988300       49961         2.5%     192.114.88.10
  14143200       47144         2.3%    199.232.82.172
   9229200       30764         1.5%     192.114.3.241
   8607900       28693         1.4%      192.114.5.10
   7619400       25398         1.3%    192.114.23.221
   6807300       22691         1.1%     132.64.81.128

Top-10 Possible Targets by Bytes:
                Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------
                                    128.139.220.90                73985320200
                                    128.139.220.90                73985299800
                                    128.139.220.90                73985299800
  2001:bf8:900:d:2::71       8443                                 54266755800
  2001:bf8:900:d:2::71                                            54266755800
          159.60.33.37                                            52349164800
          159.60.33.37                                            52349164800
          159.60.33.37                                            52349164800
        199.232.82.172                                            42809143500
                                    128.139.220.91                31658537400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-14 17:08:59
End Time: ongoing

First Event Seen: 2026-07-14 17:06:00
Last Event Seen: 2026-07-14 17:07:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/255841/