[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #251192 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, June 8, 2026 5:48:30 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #251192 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 251192

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  6311100       21037         6.0%      159.60.33.32
  4125900       13753         3.9%      159.60.33.21
  3882900       12943         3.7%   144.126.227.167
  3822600       12742         3.6%    165.227.234.27
  3802500       12675         3.6%     138.68.131.11
  3539400       11798         3.4%   144.126.226.237
  3009600       10032         2.9%    104.255.152.18
  3008100       10027         2.9%    104.255.152.19
  2973600        9912         2.8%    199.21.149.124
  2963700        9879         2.8%    104.255.152.29

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  6311100       21037         6.0%    128.139.220.91
  4259100       14197         4.1%      132.76.61.53
  4248900       14163         4.1%    128.139.220.90
  3110400       10368         3.0%   128.139.225.242
  2619900        8733         2.5%     192.114.3.241
  1929600        6432         1.8%     128.139.221.5
  1905900        6353         1.8%     132.74.74.134
  1438500        4795         1.4%     128.139.200.4
  1011300        3371         1.0%    192.114.23.221
   996600        3322         1.0%     128.139.200.5

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
  159.60.33.32                                             6686928600
  159.60.33.32                                             6686928600
  159.60.33.32                                             6686928600
                            128.139.220.91                 6686928600
                            128.139.220.91                 6686928600
                            128.139.220.91                 6686928600
                              132.76.61.53                 5903933100
                      443     132.76.61.53                 5903827200
                            128.139.220.90                 4587737100
                            128.139.220.90                 4587715800

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-06-08 02:48:19
End Time: ongoing

First Event Seen: 2026-06-08 02:46:00
Last Event Seen: 2026-06-08 02:47:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/251192/