[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #438041 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, September 18, 2026 12:16:44 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #438041 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 438041

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  122267400      407558        25.5%      159.60.33.21
   47863500      159545        10.0%    23.218.225.122
   44931900      149773         9.4%    109.205.211.34
   42422400      141408         8.8%      159.60.33.32
   39201300      130671         8.2%     23.218.225.98
   19336200       64454         4.0%    20.209.192.162
   19018800       63396         4.0%     23.218.225.99
   12594300       41981         2.6%      159.60.33.37
    9402600       31342         2.0%     20.60.251.193
    4367400       14558         0.9%   199.232.210.172

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total           Dst IP
----------------------------------------------------
  134862300      449541        28.1%   128.139.220.90
   43613100      145377         9.1%   128.139.220.91
   28738800       95796         6.0%    132.77.35.132
   16405800       54686         3.4%    132.73.124.72
   14519700       48399         3.0%     132.73.124.8
    8052900       26843         1.7%    132.73.124.40
    7851300       26171         1.6%    132.73.124.60
    7837500       26125         1.6%   132.73.124.216
    7501500       25005         1.6%    132.73.124.68
    6361500       21205         1.3%   132.73.124.112

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               189381080100
                              128.139.220.90               189381059100
                              128.139.220.90               189381033900
    159.60.33.21                                           179625208500
    159.60.33.21                                           179625208500
    159.60.33.21                                           179625208500
  23.218.225.122        443                                 70567544400
  23.218.225.122                                            70567544400
    159.60.33.32                                            59652390000
    159.60.33.32                                            59652390000

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-18 09:16:32
End Time: ongoing

First Event Seen: 2026-09-18 09:14:00
Last Event Seen: 2026-09-18 09:15:00

Further Details:
https://primary.nemo.geant.org/alerts/details/438041/