[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #437169 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, September 12, 2026 12:23:35 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #437169 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 437169

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  88300500      294335        26.5%     159.60.33.21
  29175900       97253         8.7%    23.218.225.98
  26371800       87906         7.9%   23.218.225.122
  16237200       54124         4.9%   57.150.167.193
  12930600       43102         3.9%     34.149.152.8
  12759000       42530         3.8%     159.60.33.32
  11049000       36830         3.3%     159.60.33.37
   9649500       32165         2.9%    20.60.251.193
   3348900       11163         1.0%    172.217.113.4
   3132000       10440         0.9%      192.114.7.2

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  99350100      331167        29.8%   128.139.220.90
  28516500       95055         8.5%    132.77.35.132
  13618800       45396         4.1%   128.139.220.91
  11595600       38652         3.5%    132.73.124.72
   9678900       32263         2.9%     132.73.124.8
   7456500       24855         2.2%   199.232.82.172
   5214600       17382         1.6%   132.73.124.112
   4297800       14326         1.3%    132.74.74.134
   3466800       11556         1.0%   132.73.124.216
   3304200       11014         1.0%      192.114.7.2

Top-10 Possible Targets by Bytes:
         Src IP   Src Port           Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                             128.139.220.90               137956814100
                             128.139.220.90               137956814100
                             128.139.220.90               137956763700
   159.60.33.21                                           129402927000
   159.60.33.21                                           129402927000
   159.60.33.21                                           129402927000
  23.218.225.98                                            42923656500
  23.218.225.98        443                                 42893108100
                       443    132.77.35.132                41715440400
                              132.77.35.132                41715440400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-12 09:23:28
End Time: ongoing

First Event Seen: 2026-09-12 09:21:00
Last Event Seen: 2026-09-12 09:22:00

Further Details:
https://primary.nemo.geant.org/alerts/details/437169/