[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #436797 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, September 10, 2026 4:45:15 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #436797 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 436797

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total                    Src IP
-----------------------------------------------------------
  5999700       19999         3.6%              159.60.33.37
  5661000       18870         3.4%              159.60.33.21
  3334500       11115         2.0%      2001:bf8:900:d:2::71
  3215100       10717         1.9%             172.217.112.4
  3158100       10527         1.9%   2a00:1450:4025:1807::65
  2835900        9453         1.7%              16.15.254.83
  2676000        8920         1.6%             16.15.228.163
  2660700        8869         1.6%             16.15.223.170
  2614800        8716         1.6%             16.15.191.148
  2589900        8633         1.6%              54.231.236.9

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                Dst IP
--------------------------------------------------------
  29107500       97025        17.5%          132.70.60.10
  11661000       38870         7.0%        128.139.220.90
  10197900       33993         6.1%        132.68.108.108
   4351500       14505         2.6%         132.74.74.134
   3519900       11733         2.1%        128.139.220.91
   2849400        9498         1.7%   2607:f8f0:660:4::24
   2649900        8833         1.6%          192.114.52.7
   1929900        6433         1.2%         132.77.39.173
   1631700        5439         1.0%         128.139.200.5
   1529400        5098         0.9%         128.139.200.4

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                      443     132.70.60.10                42691488900
                              132.70.60.10                42691488900
                      443   132.68.108.108                14628244500
                            132.68.108.108                14628244500
                            128.139.220.90                10951162500
                            128.139.220.90                10951150500
                            128.139.220.90                10951150500
  159.60.33.21                                             6972622200
  159.60.33.21                                             6972622200
  159.60.33.21                                             6972622200

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-10 01:45:08
End Time: ongoing

First Event Seen: 2026-09-10 01:42:00
Last Event Seen: 2026-09-10 01:43:00

Further Details:
https://primary.nemo.geant.org/alerts/details/436797/