[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #251192 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, June 8, 2026 5:52:36 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #251192 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 251192

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  7777800       25926         5.0%      159.60.33.32
  6094200       20314         3.9%   144.126.227.167
  5949300       19831         3.8%    165.227.234.27
  5924400       19748         3.8%     138.68.131.11
  5442600       18142         3.5%   144.126.226.237
  5392800       17976         3.5%      159.60.33.21
  4707600       15692         3.0%    104.255.152.18
  4671000       15570         3.0%    104.255.152.19
  4630800       15436         3.0%    199.21.149.124
  4607100       15357         3.0%    104.255.152.29

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  7777800       25926         5.0%    128.139.220.91
  6479100       21597         4.2%      132.76.61.53
  5599800       18666         3.6%    128.139.220.90
  4576800       15256         2.9%   128.139.225.242
  3699900       12333         2.4%     192.114.3.241
  3012600       10042         1.9%     132.74.74.134
  2253000        7510         1.4%     128.139.200.4
  1945500        6485         1.2%     128.139.221.5
  1546200        5154         1.0%     128.139.200.5
  1068000        3560         0.7%    192.114.23.221

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                              132.76.61.53                 8991171000
                      443     132.76.61.53                 8990994300
  159.60.33.32                                             8149329000
  159.60.33.32                                             8149329000
  159.60.33.32                                             8149329000
                            128.139.220.91                 8149329000
                            128.139.220.91                 8149329000
                            128.139.220.91                 8149329000
                            128.139.220.90                 5835624600
                            128.139.220.90                 5835603300

Metric Info:
1012k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-06-08 02:48:19
End Time: ongoing

First Event Seen: 2026-06-08 02:46:00
Last Event Seen: 2026-06-08 02:51:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/251192/