[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #256496 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, July 20, 2026 4:37:07 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #256496 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 256496

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  11600400       38668         6.4%         216.239.36.223
   9111000       30370         5.0%         216.239.38.223
   6971700       23239         3.8%           159.60.33.37
   4670400       15568         2.6%   2001:bf8:900:d:2::71
   3768000       12560         2.1%           159.60.33.32
   3192000       10640         1.8%           159.60.33.21
   2280000        7600         1.3%         216.239.34.223
   2114100        7047         1.2%            31.13.84.52
   1936800        6456         1.1%         57.144.248.192
   1867800        6226         1.0%           35.190.46.17

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  20555400       68518        11.3%          132.74.56.157
  10164300       33881         5.6%         128.139.220.90
   5993100       19977         3.3%          192.114.3.241
   5681400       18938         3.1%          192.114.88.10
   5650500       18835         3.1%        128.139.225.242
   5421900       18073         3.0%         128.139.220.91
   3835200       12784         2.1%   2602:fd0f:0:1001::20
   3286800       10956         1.8%          128.139.200.4
   2706600        9022         1.5%          132.64.81.128
   2631900        8773         1.4%          128.139.200.5

Top-10 Possible Targets by Bytes:
                Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------
                              443    132.74.56.157                29787031500
                                     132.74.56.157                29787031500
        216.239.36.223        443                                 16652097300
        216.239.36.223                                            16652097300
        216.239.38.223        443                                 13196504400
        216.239.38.223                                            13196504400
                                    128.139.220.90                 7927143900
                                    128.139.220.90                 7927143900
                                    128.139.220.90                 7927143900
  2001:bf8:900:d:2::71       8443                                  7003960200

Metric Info:
931k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-20 01:36:59
End Time: ongoing

First Event Seen: 2026-07-20 01:34:00
Last Event Seen: 2026-07-20 01:35:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/256496/