[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #424611 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, June 13, 2026 12:05:53 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #424611 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 424611

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  92590500      308635        26.4%     159.60.33.21
  35082300      116941        10.0%     159.60.33.32
  26401800       88006         7.5%   23.218.225.121
  20295900       67653         5.8%   23.218.225.128
  15839100       52797         4.5%    23.218.225.99
   7275600       24252         2.1%   165.227.234.27
   4188000       13960         1.2%   23.218.225.122
   4129800       13766         1.2%   57.144.248.192
   3896400       12988         1.1%    23.218.225.98
   3794400       12648         1.1%   157.240.253.63

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  92591400      308638        26.4%    128.139.220.90
  35082300      116941        10.0%    128.139.220.91
  12807600       42692         3.6%     132.73.124.68
  11919300       39731         3.4%   128.139.225.242
  10123200       33744         2.9%     132.73.124.72
   7593300       25311         2.2%     132.73.124.96
   6930300       23101         2.0%      192.114.5.10
   6912300       23041         2.0%      132.73.124.8
   4688700       15629         1.3%     192.114.52.15
   4590300       15301         1.3%    132.73.124.112

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               136247144100
                            128.139.220.90               136247130900
                            128.139.220.90               136247105700
  159.60.33.21                                           136247074800
  159.60.33.21                                           136247074800
  159.60.33.21                                           136247074800
  159.60.33.32                                            47721297600
  159.60.33.32                                            47721297600
  159.60.33.32                                            47721297600
                            128.139.220.91                47721297600

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-06-13 09:05:41
End Time: ongoing

First Event Seen: 2026-06-13 09:03:00
Last Event Seen: 2026-06-13 09:04:00

Further Details:
https://primary.nemo.geant.org/alerts/details/424611/