[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #438742 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, September 23, 2026 3:38:30 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #438742 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 438742

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  104714400      349048        25.3%     159.60.33.21
   46255800      154186        11.2%   109.205.211.34
   43902600      146342        10.6%     159.60.33.32
   20353500       67845         4.9%    23.218.225.98
   20169900       67233         4.9%   23.206.251.114
   17974800       59916         4.3%   23.206.251.113
   13362900       44543         3.2%   23.218.225.122
   12314100       41047         3.0%     159.60.33.37
   11029200       36764         2.7%   20.209.192.162
    8486700       28289         2.1%   199.232.18.172

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total           Dst IP
----------------------------------------------------
  117028800      390096        28.3%   128.139.220.90
   44267400      147558        10.7%   128.139.220.91
   16302600       54342         3.9%    132.77.35.132
   10728000       35760         2.6%    132.72.23.183
    9993000       33310         2.4%    132.73.124.68
    7612800       25376         1.8%    132.73.124.48
    5871300       19571         1.4%     132.73.124.8
    5740200       19134         1.4%   132.73.124.216
    5485500       18285         1.3%    132.74.74.134
    5212200       17374         1.3%     132.70.60.32

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               163561364100
                            128.139.220.90               163561364100
                            128.139.220.90               163561338900
  159.60.33.21                                           152585785500
  159.60.33.21                                           152585785500
  159.60.33.21                                           152585785500
  159.60.33.32                                            61987706400
  159.60.33.32                                            61987706400
  159.60.33.32                                            61987706400
                            128.139.220.91                61987706400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-23 00:38:23
End Time: ongoing

First Event Seen: 2026-09-23 00:36:00
Last Event Seen: 2026-09-23 00:37:00

Further Details:
https://primary.nemo.geant.org/alerts/details/438742/