[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #257710 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 28, 2026 7:35:10 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #257710 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 257710

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  20493600       68312         7.5%      159.60.33.37
  20237400       67458         7.4%   185.199.108.133
  19556100       65187         7.2%   185.199.111.133
  19227600       64092         7.1%   185.199.109.133
  16746000       55820         6.1%   185.199.110.133
  10329300       34431         3.8%      159.60.33.21
   7535100       25117         2.8%      159.60.33.32
   4436400       14788         1.6%     66.207.197.41
   4086900       13623         1.5%   151.101.242.172
   3008700       10029         1.1%      159.60.33.33

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  30823500      102745        11.3%    128.139.220.90
  10544400       35148         3.9%    128.139.220.91
   4770900       15903         1.8%   185.199.108.133
   4665600       15552         1.7%   128.139.225.242
   4556100       15187         1.7%   185.199.109.133
   4441500       14805         1.6%    132.66.156.125
   4382400       14608         1.6%   185.199.110.133
   4206600       14022         1.5%     132.76.105.72
   4176900       13923         1.5%   185.199.111.133
   3778200       12594         1.4%     192.114.88.10

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                               128.139.220.90                37017017700
                               128.139.220.90                37017017700
                               128.139.220.90                37016967300
  185.199.108.133        443                                 27376665900
  185.199.108.133                                            27376665900
  185.199.111.133        443                                 26487612300
  185.199.111.133                                            26487612300
  185.199.109.133        443                                 25943141100
  185.199.109.133                                            25943141100
     159.60.33.37                                            23527740300

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-28 04:35:04
End Time: ongoing

First Event Seen: 2026-07-28 04:32:00
Last Event Seen: 2026-07-28 04:33:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/257710/