[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #256630 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 21, 2026 3:42:04 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #256630 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 256630

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  54188700      180629        19.9%    23.218.225.99
  36946200      123154        13.6%   23.218.225.128
  32630700      108769        12.0%   23.218.225.121
  15630900       52103         5.7%   216.239.38.223
   4902900       16343         1.8%   216.239.34.223
   4566000       15220         1.7%   216.239.32.223
   3786900       12623         1.4%    34.104.35.123
   3106500       10355         1.1%    13.107.138.10
   2411100        8037         0.9%   95.101.122.184
   2309700        7699         0.8%   95.101.122.170

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  93939000      313130        34.5%    132.73.124.216
  17059200       56864         6.3%    132.73.124.176
  12543000       41810         4.6%     132.74.56.132
   9412800       31376         3.5%      132.73.124.8
   6993900       23313         2.6%     192.114.3.241
   5925600       19752         2.2%     132.74.74.134
   4844700       16149         1.8%     132.72.23.183
   4265400       14218         1.6%   128.139.225.242
   4161300       13871         1.5%     132.64.81.128
   4124100       13747         1.5%     192.114.88.10

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              132.73.124.216               138420811500
                        443   132.73.124.216               138417834900
   23.218.225.99        443                                 79816558800
   23.218.225.99                                            79816558800
  23.218.225.128        443                                 54435728100
  23.218.225.128                                            54435728100
  23.218.225.121        443                                 48049725300
  23.218.225.121                                            48049725300
                              132.73.124.176                23999612100
                        443   132.73.124.176                23997909300

Metric Info:
1M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate.

Start Time: 2026-07-21 00:35:55
End Time: ongoing

First Event Seen: 2026-07-21 00:33:00
Last Event Seen: 2026-07-21 00:40:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/256630/