[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #435021 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, August 29, 2026 12:16:46 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #435021 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 435021

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                     Src IP
-------------------------------------------------------------
  80499900      268333        21.6%               159.60.33.21
  72762000      242540        19.6%               159.60.33.32
  13859100       46197         3.7%               159.60.33.37
   9557700       31859         2.6%             142.251.27.207
   9370500       31235         2.5%            192.178.194.207
   6467400       21558         1.7%             172.217.23.187
   5737200       19124         1.5%       2001:bf8:900:d:2::71
   4966800       16556         1.3%   2a00:1450:4002:406::200e
   4829100       16097         1.3%              132.73.124.72
   3818100       12727         1.0%              132.73.124.48

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  94359900      314533        25.4%   128.139.220.90
  74772900      249243        20.1%   128.139.220.91
  44108100      147027        11.9%   199.232.82.172
  25785300       85951         6.9%   192.114.16.232
   8327100       27757         2.2%   132.65.128.143
   7010700       23369         1.9%   132.65.128.142
   6807000       22690         1.8%   132.65.128.146
   3882900       12943         1.0%   132.65.128.144
   3583200       11944         1.0%    128.139.200.5
   3565500       11885         1.0%    192.114.88.10

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               126832083600
                            128.139.220.90               126832062300
                            128.139.220.90               126832011900
  159.60.33.21                                           114446420100
  159.60.33.21                                           114446420100
  159.60.33.21                                           114446420100
  159.60.33.32                                           103882049700
  159.60.33.32                                           103882049700
  159.60.33.32                                           103882049700
                            128.139.220.91               103882049700

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-29 09:16:41
End Time: ongoing

First Event Seen: 2026-08-29 09:14:00
Last Event Seen: 2026-08-29 09:15:00

Further Details:
https://primary.nemo.geant.org/alerts/details/435021/