[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #436455 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, September 7, 2026 7:02:20 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #436455 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 436455

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  18264000       60880         5.8%    159.60.33.37
  17792400       59308         5.7%   172.217.115.4
  14354400       47848         4.6%    159.60.33.21
  13236900       44123         4.2%    159.60.33.33
  13203000       44010         4.2%   172.217.119.4
  13186800       43956         4.2%   172.217.114.4
  13098600       43662         4.2%   172.217.118.4
  12917400       43058         4.1%   172.217.112.4
  12054900       40183         3.8%   172.217.117.4
  10896000       36320         3.5%   172.217.113.4

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  32619000      108730        10.4%   128.139.220.90
  22008300       73361         7.0%   128.139.220.91
  19198800       63996         6.1%    132.76.221.33
  17889600       59632         5.7%    132.76.221.28
  10440600       34802         3.3%    132.76.221.29
   9855900       32853         3.1%    132.76.221.34
   9335100       31117         3.0%   132.76.220.253
   8843100       29477         2.8%   132.76.220.175
   8750400       29168         2.8%    132.76.221.24
   8547600       28492         2.7%    132.76.221.21

Top-10 Possible Targets by Bytes:
  Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------
                      128.139.220.90                35000220900
                      128.139.220.90                35000220900
                      128.139.220.90                35000220900
                443    132.76.221.33                27797264700
                       132.76.221.33                27797264700
                      128.139.220.91                26669952000
                      128.139.220.91                26669952000
                      128.139.220.91                26669952000
                443    132.76.221.28                25895984100
                       132.76.221.28                25895984100

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-07 16:02:13
End Time: ongoing

First Event Seen: 2026-09-07 15:59:00
Last Event Seen: 2026-09-07 16:00:00

Further Details:
https://primary.nemo.geant.org/alerts/details/436455/