[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #424975 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, June 16, 2026 3:39:33 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #424975 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 424975

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  88849800      296166        25.8%      159.60.33.21
  25016700       83389         7.3%    95.101.122.242
  17505600       58352         5.1%      159.60.33.32
  12026400       40088         3.5%     138.68.131.11
  11328300       37761         3.3%   144.126.226.237
  11046900       36823         3.2%    165.227.234.27
  10363800       34546         3.0%     23.218.225.34
   9001800       30006         2.6%    95.101.122.170
   8762100       29207         2.5%   144.126.227.167
   5812800       19376         1.7%    192.178.25.202

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  88872900      296243        25.8%    128.139.220.90
  17505900       58353         5.1%    128.139.220.91
  16232700       54109         4.7%     132.72.23.183
  14873700       49579         4.3%   128.139.225.242
  13255500       44185         3.9%    132.73.124.216
  11463600       38212         3.3%      132.76.61.53
   7522200       25074         2.2%    199.232.82.172
   7487400       24958         2.2%     132.74.68.184
   5706000       19020         1.7%      132.73.124.8
   4248000       14160         1.2%     132.76.220.38

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               129590354700
                              128.139.220.90               129590354700
                              128.139.220.90               129590354700
    159.60.33.21                                           129588531000
    159.60.33.21                                           129588531000
    159.60.33.21                                           129588531000
  95.101.122.242                                            36806880300
  95.101.122.242        443                                 36719077200
                               132.72.23.183                23810448600
                        443    132.72.23.183                23810311800

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-06-16 00:39:22
End Time: ongoing

First Event Seen: 2026-06-16 00:37:00
Last Event Seen: 2026-06-16 00:38:00

Further Details:
https://primary.nemo.geant.org/alerts/details/424975/