[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #250910 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, June 6, 2026 12:07:38 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #250910 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 250910

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  71621700      238739        24.7%           159.60.33.32
  21116100       70387         7.3%           159.60.33.21
  15315300       51051         5.3%          138.68.131.11
  12722400       42408         4.4%         165.227.234.27
  10990200       36634         3.8%        144.126.227.167
   9330900       31103         3.2%        144.126.226.237
   3986700       13289         1.4%   2001:bf8:900:d:2::71
   3816600       12722         1.3%         57.144.248.192
   3378900       11263         1.2%         157.240.253.63
   3327600       11092         1.1%         57.144.244.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  71622000      238740        24.7%    128.139.220.91
  21116100       70387         7.3%    128.139.220.90
  15081600       50272         5.2%   128.139.225.242
  11860500       39535         4.1%      132.76.61.53
   7008300       23361         2.4%    132.68.176.251
   5108400       17028         1.8%    199.232.82.172
   4159800       13866         1.4%     192.114.3.241
   3957900       13193         1.4%     128.139.200.4
   3096000       10320         1.1%     132.71.146.63
   3007200       10024         1.0%     128.139.200.5

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.91               103229677800
                            128.139.220.91               103229677800
                            128.139.220.91               103229677800
  159.60.33.32                                           103229647800
  159.60.33.32                                           103229647800
  159.60.33.32                                           103229647800
  159.60.33.21                                            28675484100
  159.60.33.21                                            28675484100
  159.60.33.21                                            28675484100
                            128.139.220.90                28675484100

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-06-06 09:07:26
End Time: ongoing

First Event Seen: 2026-06-06 09:05:00
Last Event Seen: 2026-06-06 09:06:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/250910/