[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #256214 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 18, 2026 2:59:00 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #256214 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 256214

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total                 Src IP
----------------------------------------------------------
  491018700     1636729        78.6%           159.60.33.37
   11952600       39842         1.9%         216.239.34.223
    4058100       13527         0.6%           159.60.33.32
    3513600       11712         0.6%           159.60.33.21
    2988300        9961         0.5%         57.144.248.192
    2960100        9867         0.5%          172.217.112.4
    2588100        8627         0.4%            31.13.84.52
    2250300        7501         0.4%          13.107.138.10
    2184000        7280         0.3%         57.144.244.192
    2114400        7048         0.3%   2001:bf8:900:d:2::71

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  494532600     1648442        79.2%    128.139.220.90
   16471200       54904         2.6%     192.114.3.241
    7073400       23578         1.1%   128.139.225.242
    7012200       23374         1.1%     192.114.88.10
    4980300       16601         0.8%    128.139.220.91
    3563400       11878         0.6%     132.74.242.47
    2494800        8316         0.4%     128.139.200.4
    2411700        8039         0.4%      132.66.37.50
    2378700        7929         0.4%     128.139.200.5
    1887300        6291         0.3%      192.114.52.5

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90                83377780800
                              128.139.220.90                83377780800
                              128.139.220.90                83377755600
    159.60.33.37                                            79579195200
    159.60.33.37                                            79579195200
    159.60.33.37                                            79579195200
                               192.114.3.241                18852702000
                        443    192.114.3.241                18852031500
  216.239.34.223        443                                 17335261800
  216.239.34.223                                            17335261800

Metric Info:
6M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-17 23:58:54
End Time: ongoing

First Event Seen: 2026-07-17 23:56:00
Last Event Seen: 2026-07-17 23:57:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/256214/