[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #436101 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, September 5, 2026 12:14:22 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #436101 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 436101

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                   Src IP
-----------------------------------------------------------
  52947000      176490        24.2%             159.60.33.21
  17243400       57478         7.9%           23.218.225.122
  14201100       47337         6.5%            23.218.225.98
  10176900       33923         4.7%             159.60.33.37
   7674600       25582         3.5%             159.60.33.32
   4176000       13920         1.9%           172.67.175.213
   3074400       10248         1.4%   2a00:1450:4001:c17::64
   2346600        7822         1.1%           132.73.124.220
   2272200        7574         1.0%           57.144.248.192
   2208300        7361         1.0%             172.66.0.165

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  63124200      210414        28.9%    128.139.220.90
   9780600       32602         4.5%    128.139.220.91
   8943300       29811         4.1%     132.73.124.72
   6843600       22812         3.1%    199.232.82.172
   5876100       19587         2.7%     192.114.88.10
   5273400       17578         2.4%    132.69.201.176
   4199700       13999         1.9%      132.70.60.32
   4127400       13758         1.9%      132.73.124.8
   3012000       10040         1.4%   128.139.225.242
   2705400        9018         1.2%     128.139.200.4

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90                85094898600
                              128.139.220.90                85094898600
                              128.139.220.90                85094873400
    159.60.33.21                                            76415603400
    159.60.33.21                                            76415603400
    159.60.33.21                                            76415603400
  23.218.225.122        443                                 25326253500
  23.218.225.122                                            25326253500
   23.218.225.98                                            20824003200
   23.218.225.98        443                                 20750583900

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-05 09:14:15
End Time: ongoing

First Event Seen: 2026-09-05 09:11:00
Last Event Seen: 2026-09-05 09:12:00

Further Details:
https://primary.nemo.geant.org/alerts/details/436101/