[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #438166 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, September 19, 2026 12:22:37 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #438166 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 438166

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  107322900      357743        27.6%     159.60.33.21
   45760800      152536        11.8%   109.205.211.34
   45599700      151999        11.7%    23.218.225.98
   39825300      132751        10.3%   23.218.225.122
   18501600       61672         4.8%   20.209.192.162
   12943500       43145         3.3%    23.218.225.99
   11083500       36945         2.9%     159.60.33.37
    9084900       30283         2.3%    20.60.251.193
    5028600       16762         1.3%     159.60.33.32
    3119700       10399         0.8%    172.217.114.4

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total           Dst IP
----------------------------------------------------
  118406700      394689        30.5%   128.139.220.90
   27588600       91962         7.1%    132.77.35.132
   10961400       36538         2.8%    132.73.124.72
   10856400       36188         2.8%    132.73.124.48
    9071700       30239         2.3%     132.73.124.8
    6143400       20478         1.6%   128.139.220.91
    5955900       19853         1.5%    132.73.124.68
    4968900       16563         1.3%    132.74.74.134
    4895700       16319         1.3%   132.73.124.112
    4128900       13763         1.1%   132.73.124.216

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               165349746300
                              128.139.220.90               165349746300
                              128.139.220.90               165349746300
    159.60.33.21                                           157560504000
    159.60.33.21                                           157560504000
    159.60.33.21                                           157560504000
   23.218.225.98                                            66801419400
   23.218.225.98        443                                 66640540200
  23.218.225.122        443                                 58637019900
  23.218.225.122                                            58637019900

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-19 09:22:30
End Time: ongoing

First Event Seen: 2026-09-19 09:20:00
Last Event Seen: 2026-09-19 09:21:00

Further Details:
https://primary.nemo.geant.org/alerts/details/438166/