[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #257344 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 25, 2026 12:16:30 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #257344 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 257344

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  74515800      248386        22.0%           159.60.33.21
  59512500      198375        17.6%           159.60.33.32
  33329100      111097         9.8%         194.180.48.207
  15386400       51288         4.5%           159.60.33.37
   5639700       18799         1.7%           198.96.94.26
   4637400       15458         1.4%          132.73.124.72
   4332000       14440         1.3%         57.144.248.192
   4314900       14383         1.3%   2001:bf8:900:d:2::71
   3195300       10651         0.9%         157.240.253.63
   3021600       10072         0.9%          132.73.124.48

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  89902500      299675        26.5%    128.139.220.90
  61001700      203339        18.0%    128.139.220.91
  32178600      107262         9.5%    199.232.82.172
   8238000       27460         2.4%   128.139.225.242
   7562100       25207         2.2%     192.114.88.10
   4141800       13806         1.2%     132.74.74.134
   3948000       13160         1.2%     128.139.200.4
   3846000       12820         1.1%     128.139.200.5
   2640300        8801         0.8%     192.114.3.241
   2403300        8011         0.7%     128.139.221.5

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               115504116300
                            128.139.220.90               115504116300
                            128.139.220.90               115504091100
  159.60.33.21                                           106300710000
  159.60.33.21                                           106300710000
  159.60.33.21                                           106300710000
  159.60.33.32                                            83967903300
  159.60.33.32                                            83967903300
  159.60.33.32                                            83967903300
                            128.139.220.91                83967903300

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-25 09:16:23
End Time: ongoing

First Event Seen: 2026-07-25 09:13:00
Last Event Seen: 2026-07-25 09:14:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/257344/