[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #256629 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 21, 2026 3:40:04 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #256629 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 256629

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  86562900      288543        17.8%     159.60.33.32
  80040600      266802        16.4%     159.60.33.21
  54188700      180629        11.1%    23.218.225.99
  36946200      123154         7.6%   23.218.225.128
  32630700      108769         6.7%   23.218.225.121
  23266500       77555         4.8%     159.60.33.37
  15643800       52146         3.2%   216.239.38.223
   4910400       16368         1.0%   216.239.34.223
   4577100       15257         0.9%   216.239.32.223
   3790800       12636         0.8%    34.104.35.123

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  103307700      344359        21.2%    128.139.220.90
   93939300      313131        19.3%    132.73.124.216
   87472200      291574        17.9%    128.139.220.91
   17059200       56864         3.5%    132.73.124.176
   12543000       41810         2.6%     132.74.56.132
    9412800       31376         1.9%      132.73.124.8
    8254500       27515         1.7%   128.139.225.242
    8061600       26872         1.7%     192.114.88.10
    7295700       24319         1.5%     192.114.3.241
    5925600       19752         1.2%     132.74.74.134

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               142602664200
                            128.139.220.90               142602642000
                            128.139.220.90               142602616800
                            132.73.124.216               138420840900
                      443   132.73.124.216               138417864300
  159.60.33.32                                           126035721000
  159.60.33.32                                           126035721000
  159.60.33.32                                           126035721000
                            128.139.220.91               126035721000
                            128.139.220.91               126035721000

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-21 00:35:55
End Time: ongoing

First Event Seen: 2026-07-21 00:33:00
Last Event Seen: 2026-07-21 00:38:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/256629/