[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #435985 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, September 4, 2026 7:34:52 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #435985 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 435985

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                    Src IP
------------------------------------------------------------
  14782800       49276         6.4%           185.199.109.133
  13583400       45278         5.9%           185.199.110.133
  13551600       45172         5.9%           185.199.111.133
  12500400       41668         5.4%           185.199.108.133
  11814000       39380         5.1%              159.60.33.37
  11392200       37974         4.9%             20.209.242.65
  10747500       35825         4.6%              159.60.33.21
   6972900       23243         3.0%               36.50.54.59
   5706300       19021         2.5%              159.60.33.32
   3979200       13264         1.7%   2a00:1450:4025:1807::8a

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  22563600       75212         9.7%    128.139.220.90
  11392200       37974         4.9%       132.70.19.4
   7311600       24372         3.2%    128.139.220.91
   3792600       12642         1.6%     132.74.74.134
   3558300       11861         1.5%   185.199.109.133
   3460200       11534         1.5%   185.199.108.133
   3161400       10538         1.4%   185.199.111.133
   2753100        9177         1.2%   185.199.110.133
   2298300        7661         1.0%   128.139.225.242
   2197200        7324         0.9%      192.114.5.10

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                               128.139.220.90                23667397200
                               128.139.220.90                23667376200
                               128.139.220.90                23667300600
  185.199.109.133        443                                 19882257000
  185.199.109.133                                            19882257000
  185.199.110.133        443                                 18323938500
  185.199.110.133                                            18323938500
  185.199.111.133        443                                 18145039200
  185.199.111.133                                            18145039200
  185.199.108.133        443                                 17055364500

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-04 04:34:45
End Time: ongoing

First Event Seen: 2026-09-04 04:32:00
Last Event Seen: 2026-09-04 04:33:00

Further Details:
https://primary.nemo.geant.org/alerts/details/435985/