[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #438017 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, September 18, 2026 7:34:32 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #438017 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 438017

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  45252300      150841        15.4%    109.205.211.34
  20166000       67220         6.8%   185.199.111.133
  19318800       64396         6.6%   185.199.110.133
  17439600       58132         5.9%   185.199.109.133
  16744800       55816         5.7%      159.60.33.37
  16322100       54407         5.5%    20.209.192.162
  14799300       49331         5.0%   185.199.108.133
   9115200       30384         3.1%      159.60.33.21
   7784700       25949         2.6%     20.60.251.193
   4988700       16629         1.7%    199.232.18.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  25860600       86202         8.8%   128.139.220.90
  24106800       80356         8.2%    132.77.35.132
   5704500       19015         1.9%   128.139.220.91
   5154300       17181         1.7%     132.70.60.32
   4620600       15402         1.6%    128.139.221.5
   4597500       15325         1.6%    132.66.112.62
   3959400       13198         1.3%    132.74.74.134
   3267300       10891         1.1%    132.65.180.32
   2859300        9531         1.0%    132.65.180.15
   2519400        8398         0.9%     192.114.5.10

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                         443    132.77.35.132                35259498000
                                132.77.35.132                35259498000
                               128.139.220.90                29233823700
                               128.139.220.90                29233811700
                               128.139.220.90                29233786500
  185.199.111.133        443                                 27154005300
  185.199.111.133                                            27154005300
  185.199.110.133        443                                 26143314600
  185.199.110.133                                            26143314600
   20.209.192.162        443                                 23866615800

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-18 04:34:25
End Time: ongoing

First Event Seen: 2026-09-18 04:32:00
Last Event Seen: 2026-09-18 04:33:00

Further Details:
https://primary.nemo.geant.org/alerts/details/438017/