[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #251344 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, June 9, 2026 9:05:40 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #251344 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 251344

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  6111900       20373         3.9%   144.126.227.167
  6004800       20016         3.8%     138.68.131.11
  5678700       18929         3.6%   144.126.226.237
  5128800       17096         3.2%    192.178.194.95
  4986600       16622         3.1%    104.255.152.19
  4939500       16465         3.1%    104.255.152.29
  4930200       16434         3.1%    199.167.138.45
  4929900       16433         3.1%    199.21.149.124
  4890300       16301         3.1%    104.255.152.18
  4293900       14313         2.7%     108.181.3.205

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  8496900       28323         5.4%      132.76.61.53
  3070800       10236         1.9%     132.74.74.134
  2102400        7008         1.3%      132.76.61.52
  1849500        6165         1.2%   128.139.225.242
  1580700        5269         1.0%     128.139.200.4
  1553100        5177         1.0%     128.139.221.5
  1301400        4338         0.8%     132.66.42.122
  1258500        4195         0.8%      132.66.42.22
  1135200        3784         0.7%      192.114.1.65
  1133100        3777         0.7%     128.139.200.5

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                               132.76.61.53                11965486500
                        443    132.76.61.53                11828127600
  192.178.194.95        443                                 6669318900
  192.178.194.95                                            6669318900
   34.104.35.123                                            5327551800
   34.104.35.123         80                                 5102925000
                        443   132.74.74.134                 4404550500
                              132.74.74.134                 4404550500
                               132.76.61.52                 2626606200
                        443    132.76.61.52                 2618082300

Metric Info:
2M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate.

Start Time: 2026-06-09 03:46:17
End Time: ongoing

First Event Seen: 2026-06-09 03:44:00
Last Event Seen: 2026-06-09 06:03:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/251344/