[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #256226 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 18, 2026 5:23:00 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #256226 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 256226

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total                 Src IP
----------------------------------------------------------
  623308500     2077695        84.2%           159.60.33.37
    4086600       13622         0.6%           159.60.33.32
    3056700       10189         0.4%           159.60.33.21
    2371800        7906         0.3%          93.123.17.252
    2287500        7625         0.3%   2001:bf8:900:d:2::71
    2248500        7495         0.3%         17.253.122.201
    2247000        7490         0.3%         199.232.82.172
    2034900        6783         0.3%         168.144.163.35
    1359300        4531         0.2%          85.11.167.109
    1351500        4505         0.2%         57.144.248.192

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  626365500     2087885        84.6%    128.139.220.90
    5197500       17325         0.7%      192.114.5.10
    5079000       16930         0.7%    128.139.220.91
    4054200       13514         0.5%     192.114.88.10
    3282900       10943         0.4%     192.114.3.241
    3143100       10477         0.4%   128.139.225.242
    2258100        7527         0.3%    132.68.176.122
    2015100        6717         0.3%     132.64.81.128
    2001600        6672         0.3%     192.114.88.61
    1852800        6176         0.3%      132.74.76.99

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               106165432800
                            128.139.220.90               106165432800
                            128.139.220.90               106165412400
  159.60.33.37                                           102915495000
  159.60.33.37                                           102915495000
  159.60.33.37                                           102915495000
                              192.114.5.10                 5772226200
                            128.139.220.91                 5215473000
                            128.139.220.91                 5215421400
                            128.139.220.91                 5215421400

Metric Info:
6M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-18 02:22:53
End Time: ongoing

First Event Seen: 2026-07-18 02:20:00
Last Event Seen: 2026-07-18 02:21:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/256226/