[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #256629 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 21, 2026 3:36:00 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #256629 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 256629

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  65480700      218269        17.6%     159.60.33.21
  55105800      183686        14.8%     159.60.33.32
  36845400      122818         9.9%    23.218.225.99
  23819400       79398         6.4%   23.218.225.128
  22306500       74355         6.0%   23.218.225.121
  20034600       66782         5.4%     159.60.33.37
  15171300       50571         4.1%   216.239.38.223
   3948000       13160         1.1%   216.239.32.223
   3756300       12521         1.0%   216.239.34.223
   3151500       10505         0.8%    34.104.35.123

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  85515900      285053        22.9%    128.139.220.90
  63528300      211761        17.0%    132.73.124.216
  55900800      186336        15.0%    128.139.220.91
  12699000       42330         3.4%    132.73.124.176
  12324000       41080         3.3%     132.74.56.132
   7050900       23503         1.9%   128.139.225.242
   6922800       23076         1.9%     192.114.88.10
   6640800       22136         1.8%     192.114.3.241
   5221200       17404         1.4%      132.73.124.8
   4982100       16607         1.3%     132.74.74.134

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               117725398200
                            128.139.220.90               117725376000
                            128.139.220.90               117725350800
  159.60.33.21                                            94898953800
  159.60.33.21                                            94898953800
  159.60.33.21                                            94898953800
                            132.73.124.216                93598718100
                      443   132.73.124.216                93595741500
  159.60.33.32                                            79488777000
  159.60.33.32                                            79488777000

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-21 00:35:55
End Time: ongoing

First Event Seen: 2026-07-21 00:33:00
Last Event Seen: 2026-07-21 00:34:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/256629/