[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #432801 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, August 15, 2026 10:03:34 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #432801 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 432801

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  54848100      182827        20.6%    160.119.76.42
  48954600      163182        18.4%    160.119.76.51
  15282000       50940         5.7%     159.60.33.37
  10080900       33603         3.8%     159.60.33.21
   8454900       28183         3.2%     159.60.33.32
   7894200       26314         3.0%    20.209.242.65
   3969900       13233         1.5%   146.75.122.172
   3410400       11368         1.3%     159.60.33.33
   2607300        8691         1.0%      31.13.84.52
   2536200        8454         1.0%   57.144.248.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  25363500       84545         9.5%    128.139.220.90
  11865300       39551         4.4%    128.139.220.91
   7894200       26314         3.0%       132.70.19.4
   5427000       18090         2.0%    132.68.108.108
   4264800       14216         1.6%      132.68.65.31
   3978600       13262         1.5%   128.139.225.242
   3902100       13007         1.5%     192.114.88.10
   3125700       10419         1.2%     132.74.68.109
   2676900        8923         1.0%       192.114.7.2
   2475300        8251         0.9%     128.139.200.5

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90                26000278500
                            128.139.220.90                26000266500
                            128.139.220.90                26000241300
  159.60.33.21                                            13098699300
  159.60.33.21                                            13098699300
  159.60.33.21                                            13098699300
                            128.139.220.91                13071339600
                            128.139.220.91                13071339600
                            128.139.220.91                13071339600
  159.60.33.37                                            12901542000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-15 07:03:27
End Time: ongoing

First Event Seen: 2026-08-15 07:01:00
Last Event Seen: 2026-08-15 07:02:00

Further Details:
https://primary.nemo.geant.org/alerts/details/432801/