[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #247307 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, May 8, 2026 12:11:09 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #247307 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 247307

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  131476800      438256        31.4%      159.60.33.33
   21733200       72444         5.2%   142.251.110.132
   10685700       35619         2.6%      159.60.33.37
    7540200       25134         1.8%     132.73.124.48
    7531800       25106         1.8%     132.73.124.72
    6116400       20388         1.5%    57.144.248.192
    5729400       19098         1.4%      132.73.124.8
    5156400       17188         1.2%     132.73.124.68
    4564200       15214         1.1%    157.240.253.63
    4322700       14409         1.0%    57.144.244.192

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  131476800      438256        31.4%    128.139.220.91
   34820700      116069         8.3%     95.100.170.58
   33224100      110747         7.9%     95.100.170.57
   21730800       72436         5.2%     132.66.193.31
   12160800       40536         2.9%   128.139.225.242
   11418900       38063         2.7%      192.114.5.10
   10685700       35619         2.6%    128.139.220.90
    7280100       24267         1.7%      132.76.61.51
    4942800       16476         1.2%     128.139.200.4
    4787400       15958         1.1%    192.114.23.221

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
     159.60.33.33                                           190843854900
     159.60.33.33                                           190843854900
     159.60.33.33                                           190843854900
                               128.139.220.91               190843854900
                               128.139.220.91               190843854900
                               128.139.220.91               190843854900
  142.251.110.132        443                                 27571190100
  142.251.110.132                                            27571190100
                         443    132.66.193.31                27568079400
                                132.66.193.31                27568079400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-05-08 09:06:51
End Time: ongoing

First Event Seen: 2026-05-08 09:04:00
Last Event Seen: 2026-05-08 09:09:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/247307/