[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #438166 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, September 19, 2026 12:26:39 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #438166 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 438166

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  147475200      491584        29.3%     159.60.33.21
   61242300      204141        12.2%    23.218.225.98
   54663300      182211        10.8%   109.205.211.34
   54174600      180582        10.8%   23.218.225.122
   22195800       73986         4.4%   20.209.192.162
   21565200       71884         4.3%    23.218.225.99
   13140900       43803         2.6%     159.60.33.37
   10998000       36660         2.2%    20.60.251.193
    5943000       19810         1.2%     159.60.33.32
    3569100       11897         0.7%    172.217.112.4

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total           Dst IP
----------------------------------------------------
  160616400      535388        31.9%   128.139.220.90
   33195900      110653         6.6%    132.77.35.132
   15834900       52783         3.1%    132.73.124.72
   14576100       48587         2.9%    132.73.124.48
   12428400       41428         2.5%     132.73.124.8
    7930500       26435         1.6%    132.73.124.68
    7301100       24337         1.4%   128.139.220.91
    6783300       22611         1.3%   132.73.124.112
    5889000       19630         1.2%    132.74.74.134
    5799000       19330         1.2%    132.73.124.40

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90               226031187300
                              128.139.220.90               226031187300
                              128.139.220.90               226031187300
    159.60.33.21                                           216890583900
    159.60.33.21                                           216890583900
    159.60.33.21                                           216890583900
   23.218.225.98                                            89745896100
   23.218.225.98        443                                 89578553400
  23.218.225.122        443                                 79725623700
  23.218.225.122                                            79725623700

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-19 09:22:30
End Time: ongoing

First Event Seen: 2026-09-19 09:20:00
Last Event Seen: 2026-09-19 09:25:00

Further Details:
https://primary.nemo.geant.org/alerts/details/438166/