[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #256225 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 18, 2026 4:48:07 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #256225 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 256225

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  618081300     2060271        83.4%      159.60.33.37
    4193700       13979         0.6%      159.60.33.32
    3100200       10334         0.4%    199.232.82.172
    3002400       10008         0.4%      159.60.33.21
    2092800        6976         0.3%    168.144.163.35
    2079600        6932         0.3%     38.127.147.67
    1861800        6206         0.3%    23.218.225.137
    1645800        5486         0.2%   199.232.210.172
    1638000        5460         0.2%     13.107.138.10
    1632300        5441         0.2%    57.144.248.192

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  621083700     2070279        83.8%    128.139.220.90
    6286500       20955         0.8%     192.114.3.241
    4964400       16548         0.7%    128.139.220.91
    4278600       14262         0.6%   128.139.225.242
    3359100       11197         0.5%     192.114.88.10
    2522700        8409         0.3%      132.68.3.245
    2356200        7854         0.3%    132.68.176.122
    2142600        7142         0.3%     128.139.200.4
    1793400        5978         0.2%     128.139.200.5
    1368300        4561         0.2%     192.114.0.189

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                             128.139.220.90               134354543100
                             128.139.220.90               134354543100
                             128.139.220.90               134354543100
  159.60.33.37                                            131338395000
  159.60.33.37                                            131338395000
  159.60.33.37                                            131338395000
                             128.139.220.91                 5384396700
                             128.139.220.91                 4985187300
                             128.139.220.91                 4985187300
                            128.139.225.242                 4880336700

Metric Info:
5M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-18 01:47:59
End Time: ongoing

First Event Seen: 2026-07-18 01:45:00
Last Event Seen: 2026-07-18 01:46:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/256225/