[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #434365 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, August 25, 2026 3:39:41 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #434365 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 434365

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  112852200      376174        29.2%     159.60.33.21
   44208300      147361        11.4%     159.60.33.32
   27731700       92439         7.2%   23.218.225.128
   25212300       84041         6.5%    23.218.225.99
   13230300       44101         3.4%   23.218.225.115
   13224600       44082         3.4%    172.217.116.4
    8970900       29903         2.3%    172.217.117.4
    8742000       29140         2.3%     159.60.33.37
    7969200       26564         2.1%   23.218.225.121
    6126000       20420         1.6%   23.218.225.122

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total           Dst IP
----------------------------------------------------
  121594800      405316        31.4%   128.139.220.90
   45977400      153258        11.9%   128.139.220.91
   21993300       73311         5.7%    132.74.56.157
   19707300       65691         5.1%   132.73.124.236
   13897500       46325         3.6%     132.70.60.33
   10606800       35356         2.7%    132.73.124.68
    9251400       30838         2.4%    132.73.124.48
    8046600       26822         2.1%    132.73.124.94
    7526100       25087         1.9%    132.68.39.200
    4631400       15438         1.2%    132.71.192.55

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               172257026100
                            128.139.220.90               172256983200
                            128.139.220.90               172256983200
  159.60.33.21                                           165888651600
  159.60.33.21                                           165888651600
  159.60.33.21                                           165888651600
                            128.139.220.91                64431592800
                            128.139.220.91                63889126800
                            128.139.220.91                63889105500
  159.60.33.32                                            62882747400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-25 00:39:35
End Time: ongoing

First Event Seen: 2026-08-25 00:37:00
Last Event Seen: 2026-08-25 00:38:00

Further Details:
https://primary.nemo.geant.org/alerts/details/434365/