[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #434365 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, August 25, 2026 3:43:45 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #434365 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 434365

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  151195800      503986        29.8%     159.60.33.21
   63836100      212787        12.6%     159.60.33.32
   38032800      126776         7.5%   23.218.225.128
   34188300      113961         6.7%    23.218.225.99
   18271800       60906         3.6%   23.218.225.115
   17770800       59236         3.5%    172.217.116.4
   17256300       57521         3.4%   23.218.225.121
   10501500       35005         2.1%     159.60.33.37
    9186300       30621         1.8%   23.218.225.122
    9052200       30174         1.8%    172.217.117.4

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total           Dst IP
----------------------------------------------------
  161697900      538993        31.9%   128.139.220.90
   65760900      219203        13.0%   128.139.220.91
   30371700      101239         6.0%   132.73.124.236
   26481300       88271         5.2%    132.74.56.157
   16815900       56053         3.3%    132.73.124.68
   13897500       46325         2.7%     132.70.60.33
   11954400       39848         2.4%    132.73.124.48
   11073300       36911         2.2%    132.73.124.94
    9159300       30531         1.8%    132.68.39.200
    5788500       19295         1.1%   132.73.124.220

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               230543602200
                            128.139.220.90               230543559300
                            128.139.220.90               230543559300
  159.60.33.21                                           222912367800
  159.60.33.21                                           222912367800
  159.60.33.21                                           222912367800
                            128.139.220.91                92684853600
                            128.139.220.91                92142387600
                            128.139.220.91                92142366300
  159.60.33.32                                            91136008200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-25 00:39:35
End Time: ongoing

First Event Seen: 2026-08-25 00:37:00
Last Event Seen: 2026-08-25 00:42:00

Further Details:
https://primary.nemo.geant.org/alerts/details/434365/