[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #434216 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, August 24, 2026 4:37:42 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #434216 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 434216

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total                   Src IP
----------------------------------------------------------
  8004300       26681         4.7%             159.60.33.21
  7940400       26468         4.6%             159.60.33.37
  2583300        8611         1.5%            172.217.114.4
  2382900        7943         1.4%            17.253.15.141
  2305500        7685         1.3%             159.60.33.32
  1884600        6282         1.1%            17.253.57.210
  1848900        6163         1.1%   2a00:1450:4001:c17::8a
  1697400        5658         1.0%            172.217.112.4
  1601100        5337         0.9%             44.204.80.36
  1555800        5186         0.9%           34.224.168.204

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  15945300       53151         9.3%   128.139.220.90
   4786800       15956         2.8%   132.68.176.251
   4404600       14682         2.6%    132.71.20.246
   4059600       13532         2.4%    132.74.74.134
   3855600       12852         2.2%   128.139.220.91
   2929800        9766         1.7%   132.65.128.142
   2926500        9755         1.7%   132.65.128.146
   2676600        8922         1.6%   132.65.128.144
   1751400        5838         1.0%    192.114.88.10
   1619100        5397         0.9%    128.139.200.5

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90                15428472300
                            128.139.220.90                15428451300
                            128.139.220.90                15428426100
  159.60.33.21                                             9635448900
  159.60.33.21                                             9635448900
  159.60.33.21                                             9635448900
                      443   132.68.176.251                 6858990000
                            132.68.176.251                 6858990000
                      443    132.71.20.246                 6391393500
                             132.71.20.246                 6391393500

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-24 01:37:34
End Time: ongoing

First Event Seen: 2026-08-24 01:35:00
Last Event Seen: 2026-08-24 01:36:00

Further Details:
https://primary.nemo.geant.org/alerts/details/434216/