[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #426222 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, June 26, 2026 12:16:53 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #426222 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 426222

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  86429100      288097        21.0%     159.60.33.32
  59068200      196894        14.3%     159.60.33.37
  52261500      174205        12.7%     159.60.33.21
   7476300       24921         1.8%      128.139.7.8
   6229500       20765         1.5%   57.144.248.192
   6021300       20071         1.5%   157.240.253.63
   5666400       18888         1.4%     170.114.46.1
   5345400       17818         1.3%     170.114.45.1
   5329200       17764         1.3%    132.73.124.72
   5067600       16892         1.2%   57.144.244.192

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  111330900      371103        27.0%    128.139.220.90
   86429100      288097        21.0%    128.139.220.91
   36101700      120339         8.8%    199.232.82.172
   16263300       54211         3.9%   128.139.225.242
    6709500       22365         1.6%     132.77.39.173
    4479000       14930         1.1%     128.139.200.4
    3915900       13053         1.0%      192.114.5.10
    3876300       12921         0.9%     128.139.200.5
    3516600       11722         0.9%     192.114.3.241
    3211500       10705         0.8%    192.114.91.245

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
  159.60.33.32                                           122337628800
  159.60.33.32                                           122337628800
  159.60.33.32                                           122337628800
                            128.139.220.91               122337628800
                            128.139.220.91               122337628800
                            128.139.220.91               122337628800
                            128.139.220.90                95795222100
                            128.139.220.90                95795186100
                            128.139.220.90                95795140500
  159.60.33.21                                            72844701300

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-06-26 09:16:34
End Time: ongoing

First Event Seen: 2026-06-26 09:14:00
Last Event Seen: 2026-06-26 09:15:00

Further Details:
https://primary.nemo.geant.org/alerts/details/426222/