[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #436007 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, September 4, 2026 12:15:22 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #436007 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 436007

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  95129100      317097        28.7%     159.60.33.21
  26023500       86745         7.8%   23.218.225.122
  20784600       69282         6.3%   23.218.225.131
  19250400       64168         5.8%    23.218.225.98
  12387600       41292         3.7%     159.60.33.37
  10835100       36117         3.3%    23.218.225.99
  10005600       33352         3.0%     159.60.33.32
   7987800       26626         2.4%   23.218.225.115
   5180400       17268         1.6%    20.209.242.65
   5039700       16799         1.5%   23.218.225.120

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total           Dst IP
----------------------------------------------------
  107516700      358389        32.4%   128.139.220.90
   12640800       42136         3.8%    132.73.124.72
   11202900       37343         3.4%   128.139.220.91
    8576400       28588         2.6%   132.73.124.220
    8028900       26763         2.4%    132.73.124.48
    7392600       24642         2.2%     132.73.124.8
    5314800       17716         1.6%     132.66.95.51
    5180400       17268         1.6%      132.70.19.4
    4054200       13514         1.2%   132.73.124.216
    3650700       12169         1.1%    132.73.124.60

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               149390617200
                              128.139.220.90               149390617200
                              128.139.220.90               149390617200
    159.60.33.21                                           139588485900
    159.60.33.21                                           139588485900
    159.60.33.21                                           139588485900
  23.218.225.122                                            38269220400
  23.218.225.122        443                                 38267902800
  23.218.225.131        443                                 30571846200
  23.218.225.131                                            30571846200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-04 09:15:13
End Time: ongoing

First Event Seen: 2026-09-04 09:12:00
Last Event Seen: 2026-09-04 09:13:00

Further Details:
https://primary.nemo.geant.org/alerts/details/436007/