[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #251328 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, June 9, 2026 6:46:33 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #251328 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 251328

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  4109700       13699         3.4%   144.126.227.167
  3966000       13220         3.3%     138.68.131.11
  3779400       12598         3.1%      159.60.33.21
  3734100       12447         3.1%   144.126.226.237
  3704400       12348         3.1%      159.60.33.32
  3556200       11854         2.9%    192.178.194.95
  3353100       11177         2.8%    104.255.152.19
  3290400       10968         2.7%    199.167.138.45
  3283500       10945         2.7%    104.255.152.29
  3281400       10938         2.7%    199.21.149.124

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  5706000       19020         4.7%      132.76.61.53
  3779400       12598         3.1%    128.139.220.90
  3704400       12348         3.1%    128.139.220.91
  2738400        9128         2.3%   128.139.225.242
  2072100        6907         1.7%     132.74.74.134
  1320600        4402         1.1%      132.76.61.52
  1246200        4154         1.0%      132.66.42.22
  1087500        3625         0.9%     128.139.200.4
  1071600        3572         0.9%      192.114.1.65
   906300        3021         0.8%      192.114.52.3

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                                132.76.61.53                 8055762600
                        443     132.76.61.53                 7975914000
    159.60.33.21                                             4568503200
    159.60.33.21                                             4568503200
    159.60.33.21                                             4568503200
                              128.139.220.90                 4568503200
                              128.139.220.90                 4568503200
                              128.139.220.90                 4568503200
  192.178.194.95        443                                  4515860400
  192.178.194.95                                             4515860400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-06-09 03:46:16
End Time: ongoing

First Event Seen: 2026-06-09 03:44:00
Last Event Seen: 2026-06-09 03:45:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/251328/