[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #251328 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, June 9, 2026 6:50:39 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #251328 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 251328

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  6111900       20373         3.4%   144.126.227.167
  6004800       20016         3.3%     138.68.131.11
  5797800       19326         3.2%      159.60.33.21
  5678700       18929         3.1%   144.126.226.237
  5480100       18267         3.0%      159.60.33.32
  5291400       17638         2.9%    192.178.194.95
  4986600       16622         2.8%    104.255.152.19
  4939500       16465         2.7%    104.255.152.29
  4930200       16434         2.7%    199.167.138.45
  4929900       16433         2.7%    199.21.149.124

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  8496900       28323         4.7%      132.76.61.53
  5798100       19327         3.2%    128.139.220.90
  5480100       18267         3.0%    128.139.220.91
  3951900       13173         2.2%   128.139.225.242
  3070800       10236         1.7%     132.74.74.134
  2102400        7008         1.2%      132.76.61.52
  1764300        5881         1.0%     128.139.200.4
  1553100        5177         0.9%     128.139.221.5
  1320000        4400         0.7%     128.139.200.5
  1301700        4339         0.7%     132.66.42.122

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                                132.76.61.53                11965486500
                        443     132.76.61.53                11828127600
                              128.139.220.90                 7094515200
    159.60.33.21                                             7094503200
    159.60.33.21                                             7094503200
    159.60.33.21                                             7094503200
                              128.139.220.90                 7094503200
                              128.139.220.90                 7094503200
  192.178.194.95        443                                  6740916300
  192.178.194.95                                             6740916300

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-06-09 03:46:16
End Time: ongoing

First Event Seen: 2026-06-09 03:44:00
Last Event Seen: 2026-06-09 03:49:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/251328/