[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #433709 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, August 21, 2026 2:18:47 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #433709 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 433709

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  40403700      134679         3.8%   194.180.48.131
  11456100       38187         1.1%   104.255.152.29
  11370900       37903         1.1%   104.255.152.19
  11330400       37768         1.1%   104.255.152.18
   7689900       25633         0.7%     159.60.33.37
   6143400       20478         0.6%    20.209.242.65
   5521500       18405         0.5%    72.182.30.245
   5274600       17582         0.5%     159.60.33.21
   5179500       17265         0.5%   199.21.149.124
   4567200       15224         0.4%    60.248.245.58

Top-10 Dst IPs by Packets:
     Packets   Est. Rate   % of Total            Dst IP
------------------------------------------------------
  2821512600     9405042       264.8%      132.66.1.230
    15466200       51554         1.5%    128.139.220.90
     7474500       24915         0.7%       132.70.19.4
     5592300       18641         0.5%    128.139.220.91
     4854000       16180         0.5%     132.74.74.134
     4401900       14673         0.4%     128.139.221.5
     3930600       13102         0.4%     192.114.88.10
     3294600       10982         0.3%   128.139.225.242
     3175200       10584         0.3%     132.66.36.168
     3011700       10039         0.3%     128.139.200.4

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                              132.66.1.230               517033817400
                              132.66.1.230        899    439765853100
                              132.66.1.230         53     76374524100
                            128.139.220.90                14105228100
                            128.139.220.90                14105206500
                            128.139.220.90                14105206500
  159.60.33.21                                             7117707000
  159.60.33.21                                             7117707000
  159.60.33.21                                             7117707000
  159.60.33.37                                             6987499500

Metric Info:
10M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-20 23:18:40
End Time: ongoing

First Event Seen: 2026-08-20 23:16:00
Last Event Seen: 2026-08-20 23:17:00

Further Details:
https://primary.nemo.geant.org/alerts/details/433709/