[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #271318 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, October 24, 2026 4:49:44 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #271318 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 271318

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  8551500       28505         4.7%      159.60.33.37
  4485000       14950         2.5%      159.60.33.32
  4164300       13881         2.3%      159.60.33.21
  2500800        8336         1.4%     172.217.116.4
  2410200        8034         1.3%     172.217.118.4
  2019000        6730         1.1%    199.232.82.172
  1960200        6534         1.1%     17.253.57.195
  1761600        5872         1.0%      16.15.183.24
  1614600        5382         0.9%   216.180.246.138
  1593600        5312         0.9%     79.124.62.218

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  12717000       42390         6.9%   128.139.220.90
   7568100       25227         4.1%     132.76.80.87
   5852100       19507         3.2%   128.139.220.91
   3948000       13160         2.2%    132.74.74.134
   1967100        6557         1.1%     192.114.52.9
   1966800        6556         1.1%    128.139.200.4
   1439100        4797         0.8%    128.139.200.5
   1287000        4290         0.7%    132.75.62.148
   1063800        3546         0.6%   199.232.82.172
    835800        2786         0.5%    132.71.79.153

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                      443     132.76.80.87                10797777300
                              132.76.80.87                10797777300
                            128.139.220.90                10263642000
                            128.139.220.90                10263591000
                            128.139.220.90                10263565800
  159.60.33.37                                             6200632800
  159.60.33.37                                             6200632800
  159.60.33.37                                             6200632800
                      443    132.74.74.134                 5689356000
                             132.74.74.134                 5689356000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-10-24 01:49:37
End Time: ongoing

First Event Seen: 2026-10-24 01:47:00
Last Event Seen: 2026-10-24 01:48:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/271318/