[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #271353 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, October 24, 2026 10:33:54 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #271353 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 271353

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  83820300      279401        39.7%      159.60.33.21
  13050900       43503         6.2%      159.60.33.37
   7496400       24988         3.6%      159.60.33.32
   4663800       15546         2.2%     172.217.114.4
   2351400        7838         1.1%      159.60.33.33
   2348100        7827         1.1%    199.232.82.172
   2038200        6794         1.0%    57.144.244.192
   1713300        5711         0.8%     172.217.115.4
   1706400        5688         0.8%    57.144.248.192
   1635900        5453         0.8%   216.180.246.138

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  96871500      322905        45.9%   128.139.220.90
   9847800       32826         4.7%   128.139.220.91
   4823400       16078         2.3%    132.74.74.134
   2650500        8835         1.3%    128.139.200.5
   2112600        7042         1.0%    128.139.200.4
   1894200        6314         0.9%     192.114.52.7
   1529400        5098         0.7%     132.68.38.68
   1440000        4800         0.7%    132.74.68.134
   1291200        4304         0.6%    132.66.160.99
   1226100        4087         0.6%   199.232.82.172

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               133358844000
                            128.139.220.90               133358844000
                            128.139.220.90               133358823600
  159.60.33.21                                           122524383000
  159.60.33.21                                           122524383000
  159.60.33.21                                           122524383000
  159.60.33.37                                            10834440600
  159.60.33.37                                            10834440600
  159.60.33.37                                            10834440600
                            128.139.220.91                 9715934400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-10-24 07:33:46
End Time: ongoing

First Event Seen: 2026-10-24 07:31:00
Last Event Seen: 2026-10-24 07:32:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/271353/