[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #271534 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, October 25, 2026 4:11:59 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #271534 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 271534

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  6546000       21820         8.9%   157.119.188.210
  6267900       20893         8.5%      159.60.33.32
  3760200       12534         5.1%      159.60.33.37
  3750300       12501         5.1%     172.217.116.4
  2324400        7748         3.2%      159.60.33.21
  1992000        6640         2.7%     13.140.177.81
  1311900        4373         1.8%      159.60.33.33
   963900        3213         1.3%   216.180.246.204
   910200        3034         1.2%     132.64.24.250
   896700        2989         1.2%     79.124.62.218

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
  7580100       25267        10.3%   128.139.220.91
  6546000       21820         8.9%    132.77.222.76
  6084900       20283         8.3%   128.139.220.90
  3128100       10427         4.3%    132.74.74.134
  1443300        4811         2.0%     132.68.7.253
   974700        3249         1.3%    128.139.200.5
   939000        3130         1.3%   192.114.49.250
   909900        3033         1.2%   17.248.172.236
   759600        2532         1.0%    132.71.79.153
   749400        2498         1.0%    128.139.200.4

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                               128.139.220.91                 8592744000
                               128.139.220.91                 8592732000
     159.60.33.32                                             8326433700
     159.60.33.32                                             8326433700
     159.60.33.32                                             8326433700
                               128.139.220.91                 8326433700
  157.119.188.210        443                                  7108956000
  157.119.188.210                                  54391      7108956000
  157.119.188.210                                             7108956000
                         443    132.77.222.76                 7108956000

Metric Info:
531k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-10-25 02:07:43
End Time: ongoing

First Event Seen: 2026-10-25 02:05:00
Last Event Seen: 2026-10-25 02:10:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/271534/