[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #257020 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, July 23, 2026 7:42:08 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #257020 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 257020

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total                 Src IP
----------------------------------------------------------
  139639200      465464        32.8%         146.75.122.172
   47029500      156765        11.1%           159.60.33.21
   43031100      143437        10.1%         194.180.48.207
   19812900       66043         4.7%   2001:bf8:900:d:2::71
   17383800       57946         4.1%           159.60.33.37
   11735400       39118         2.8%         134.122.96.249
    7196700       23989         1.7%           159.60.33.32
    4487100       14957         1.1%        199.232.210.172
    4112700       13709         1.0%        199.232.214.172
    3539400       11798         0.8%         17.253.122.202

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total               Dst IP
-------------------------------------------------------
  64414500      214715        15.1%       128.139.220.90
   9888600       32962         2.3%       128.139.220.91
   7031400       23438         1.7%        132.71.124.43
   5891400       19638         1.4%         132.68.161.6
   5712600       19042         1.3%        132.71.124.38
   5673600       18912         1.3%       132.71.124.146
   5164500       17215         1.2%       132.71.124.156
   5087400       16958         1.2%        132.71.124.40
   4848600       16162         1.1%        192.114.3.241
   4827000       16090         1.1%   2607:f8f0:660:4::8

Top-10 Possible Targets by Bytes:
                Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------
        146.75.122.172                                           199735988700
        146.75.122.172        443                                169552653000
                                    128.139.220.90                86627193300
                                    128.139.220.90                86627171100
                                    128.139.220.90                86627141400
          159.60.33.21                                            68114135700
          159.60.33.21                                            68114135700
          159.60.33.21                                            68114135700
  2001:bf8:900:d:2::71       8443                                 29600487000
  2001:bf8:900:d:2::71                                            29600487000

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-23 04:41:59
End Time: ongoing

First Event Seen: 2026-07-23 04:39:00
Last Event Seen: 2026-07-23 04:40:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/257020/