[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #271008 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, October 22, 2026 5:08:43 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #271008 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 271008

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total                     Src IP
------------------------------------------------------------
  6427200       21424         8.0%               159.60.33.21
  6314100       21047         7.8%              13.95.121.232
  6298200       20994         7.8%              20.209.242.65
  3145200       10484         3.9%               159.60.33.37
  1935300        6451         2.4%               159.60.33.32
  1820400        6068         2.3%              162.125.69.15
  1805400        6018         2.2%             138.199.14.107
  1290000        4300         1.6%              172.217.116.4
  1114500        3715         1.4%                2.21.22.161
   994200        3314         1.2%   2a00:1450:400e:804::200e

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
  9572400       31908        11.9%   128.139.220.90
  6623700       22079         8.2%   132.70.248.247
  6298200       20994         7.8%      132.70.19.4
  2744100        9147         3.4%   128.139.220.91
  1936500        6455         2.4%    192.114.52.14
  1820400        6068         2.3%     132.66.52.64
  1201200        4004         1.5%   132.75.176.154
  1143300        3811         1.4%    128.139.200.4
  1041000        3470         1.3%   132.71.139.174
  1003200        3344         1.2%    132.74.68.134

Top-10 Possible Targets by Bytes:
         Src IP   Src Port           Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                             128.139.220.90                10644056100
                             128.139.220.90                10644056100
                             128.139.220.90                10644056100
                             132.70.248.247                 8768721600
   159.60.33.21                                             8764939500
   159.60.33.21                                             8764939500
   159.60.33.21                                             8764939500
                             132.70.248.247                 8720534400
                             132.70.248.247                 8720092800
  13.95.121.232                                             8612397600

Metric Info:
686k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-10-22 02:08:33
End Time: ongoing

First Event Seen: 2026-10-22 02:06:00
Last Event Seen: 2026-10-22 02:07:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/271008/