[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #257414 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, July 26, 2026 1:11:18 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #257414 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 257414

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  33871500      112905        14.7%         194.180.48.207
   8183100       27277         3.5%           159.60.33.37
   7320600       24402         3.2%            13.37.65.55
   6034200       20114         2.6%         57.144.248.192
   5883300       19611         2.5%   2001:bf8:900:d:2::71
   5637000       18790         2.4%         15.237.164.118
   5409000       18030         2.3%             13.37.0.65
   5230800       17436         2.3%          35.181.67.163
   4853700       16179         2.1%         57.144.244.192
   4752300       15841         2.1%         157.240.253.63

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  28034400       93448        12.1%      132.70.60.10
  16279200       54264         7.1%      132.68.38.35
  12573600       41912         5.4%    128.139.220.90
   9980100       33267         4.3%     192.114.88.10
   9213000       30710         4.0%   128.139.225.242
   7916700       26389         3.4%    132.64.145.132
   3816900       12723         1.7%     128.139.200.5
   3618600       12062         1.6%    128.139.220.91
   3468300       11561         1.5%      192.114.52.9
   3324000       11080         1.4%     132.64.24.157

Top-10 Possible Targets by Bytes:
       Src IP   Src Port           Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
                     443     132.70.60.10                41861545500
                             132.70.60.10                41861545500
                     443     132.68.38.35                24010558500
                             132.68.38.35                24010558500
                           128.139.220.90                13156337100
                           128.139.220.90                13156337100
                           128.139.220.90                13156311900
                     443   132.64.145.132                11377283400
                           132.64.145.132                11377283400
  13.37.65.55        443                                 10845871800

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-25 22:11:10
End Time: ongoing

First Event Seen: 2026-07-25 22:08:00
Last Event Seen: 2026-07-25 22:09:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/257414/