[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #425385 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, June 20, 2026 4:05:45 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #425385 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 425385

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  60782100      202607        25.9%           159.60.33.21
  23723700       79079        10.1%   2001:bf8:900:d:2::71
   9975300       33251         4.3%         132.73.124.216
   9258900       30863         3.9%         95.101.122.184
   6815400       22718         2.9%           159.60.33.37
   6437400       21458         2.7%         95.101.122.170
   4299600       14332         1.8%          172.217.23.74
   2934600        9782         1.3%           159.60.33.32
   1888200        6294         0.8%         23.218.225.120
   1862100        6207         0.8%         172.217.23.170

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  67598400      225328        28.8%         128.139.220.90
  14707500       49025         6.3%         132.73.124.216
  10439400       34798         4.5%         199.232.82.172
   9003900       30013         3.8%        128.139.225.242
   7804800       26016         3.3%   2602:fd0f:0:1001::20
   7697700       25659         3.3%   2602:fd0f:0:1001::18
   5772300       19241         2.5%          132.77.39.173
   5275500       17585         2.3%          132.74.74.134
   4709700       15699         2.0%          192.114.3.241
   4399800       14666         1.9%   2602:fd0f:0:1001::17

Top-10 Possible Targets by Bytes:
                Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------
                                    128.139.220.90                93936478800
                                    128.139.220.90                93936478800
                                    128.139.220.90                93936478800
          159.60.33.21                                            88061838900
          159.60.33.21                                            88061838900
          159.60.33.21                                            88061838900
  2001:bf8:900:d:2::71       8443                                 35584414200
  2001:bf8:900:d:2::71                                            35584414200
                                    132.73.124.216                21681533700
                              443   132.73.124.216                21663728400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-06-20 01:05:34
End Time: ongoing

First Event Seen: 2026-06-20 01:03:00
Last Event Seen: 2026-06-20 01:04:00

Further Details:
https://primary.nemo.geant.org/alerts/details/425385/