[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #246858 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, May 4, 2026 4:36:12 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #246858 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 246858

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  39249900      130833         4.8%      159.60.33.33
  29025000       96750         3.5%      159.60.33.37
  15778200       52594         1.9%    74.112.186.164
  14711700       49039         1.8%    57.144.248.192
  12083400       40278         1.5%    157.240.253.63
  10474200       34914         1.3%    57.144.244.192
   9276900       30923         1.1%   199.232.210.172
   8001300       26671         1.0%   199.232.214.172
   7728600       25762         0.9%     162.159.198.2
   6955500       23185         0.8%     185.109.23.47

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  437359500     1457865        53.2%      192.114.52.1
   39249900      130833         4.8%    128.139.220.91
   29025300       96751         3.5%    128.139.220.90
   19702200       65674         2.4%   128.139.225.242
   15778200       52594         1.9%     132.76.220.38
   13817400       46058         1.7%      132.70.60.17
   11499300       38331         1.4%      192.114.5.10
   10796700       35989         1.3%      132.70.66.12
   10697100       35657         1.3%    192.114.91.249
   10312500       34375         1.3%     128.139.200.5

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
  159.60.33.33                                            39058975200
  159.60.33.33                                            39058975200
  159.60.33.33                                            39058975200
                            128.139.220.91                39058975200
                            128.139.220.91                39058975200
                            128.139.220.91                39058975200
                            128.139.220.90                32279836200
  159.60.33.37                                            32279813400
  159.60.33.37                                            32279813400
  159.60.33.37                                            32279813400

Metric Info:
6M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-05-04 13:35:52
End Time: ongoing

First Event Seen: 2026-05-04 13:33:00
Last Event Seen: 2026-05-04 13:34:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/246858/