[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #425433 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, June 20, 2026 12:15:46 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #425433 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 425433

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  87789600      292632        22.7%      159.60.33.21
  57719700      192399        14.9%      159.60.33.32
  25005300       83351         6.5%     23.218.225.99
  23363700       77879         6.0%    23.218.225.128
  11399400       37998         2.9%      159.60.33.37
   5726100       19087         1.5%   199.232.210.172
   5693100       18977         1.5%     132.73.124.72
   5574300       18581         1.4%    23.218.225.120
   4846800       16156         1.3%    57.144.248.192
   4423800       14746         1.1%   142.251.141.234

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  99189600      330632        25.6%    128.139.220.90
  57720000      192400        14.9%    128.139.220.91
  29570400       98568         7.6%    199.232.82.172
  14989200       49964         3.9%   128.139.225.242
   8704200       29014         2.2%     132.73.124.48
   6011700       20039         1.6%    132.73.124.152
   5904300       19681         1.5%     132.73.124.88
   5114700       17049         1.3%     132.74.74.134
   4200900       14003         1.1%     132.77.39.173
   3774300       12581         1.0%    132.73.124.236

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               137208058500
                            128.139.220.90               137207987100
                            128.139.220.90               137207987100
  159.60.33.21                                           127366871700
  159.60.33.21                                           127366871700
  159.60.33.21                                           127366871700
                            128.139.220.91                80389679700
  159.60.33.32                                            80389666500
  159.60.33.32                                            80389666500
  159.60.33.32                                            80389666500

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-06-20 09:15:35
End Time: ongoing

First Event Seen: 2026-06-20 09:13:00
Last Event Seen: 2026-06-20 09:14:00

Further Details:
https://primary.nemo.geant.org/alerts/details/425433/