[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #424690 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, June 13, 2026 10:35:52 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #424690 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 424690

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  13559400       45198         3.3%    34.180.26.235
  13387500       44625         3.3%    34.131.24.131
  13380900       44603         3.3%      34.87.54.10
  13312500       44375         3.3%     34.53.177.78
  13196400       43988         3.2%    34.151.108.94
  13166400       43888         3.2%   172.67.175.213
  13160700       43869         3.2%    35.234.212.72
  13039800       43466         3.2%   34.106.145.253
  12273900       40913         3.0%   34.144.185.129
  12221400       40738         3.0%    34.125.221.85

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  24392400       81308         6.0%   128.139.225.242
  24328800       81096         6.0%      132.70.60.32
  16145700       53819         4.0%     132.66.253.82
   8878200       29594         2.2%    128.139.220.91
   8835000       29450         2.2%     132.76.220.38
   8488200       28294         2.1%    128.139.220.90
   8437200       28124         2.1%    132.64.245.147
   5040300       16801         1.2%     128.139.200.4
   4056900       13523         1.0%     128.139.200.5
   3287400       10958         0.8%     192.114.52.12

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                        443      132.70.60.32                33931210500
                                 132.70.60.32                33931210500
                              128.139.225.242                28988013900
                        443   128.139.225.242                25766607300
                        443     132.66.253.82                23539243500
                                132.66.253.82                23539243500
  172.67.175.213        443                                  18061368600
  172.67.175.213                                             18061368600
   104.21.83.123        443                                  15869841900
   104.21.83.123                                             15869841900

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-06-13 19:35:39
End Time: ongoing

First Event Seen: 2026-06-13 19:33:00
Last Event Seen: 2026-06-13 19:34:00

Further Details:
https://primary.nemo.geant.org/alerts/details/424690/