[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #438742 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, September 23, 2026 3:42:37 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #438742 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 438742

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  142146600      473822        26.3%     159.60.33.21
   61578000      205260        11.4%     159.60.33.32
   55398900      184663        10.2%   109.205.211.34
   32108100      107027         5.9%   23.206.251.114
   28016100       93387         5.2%    23.218.225.98
   27700200       92334         5.1%   23.206.251.113
   20025300       66751         3.7%   23.218.225.122
   14211300       47371         2.6%     159.60.33.37
   13267500       44225         2.5%   20.209.192.162
    9963900       33213         1.8%   199.232.18.172

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total           Dst IP
----------------------------------------------------
  156358200      521194        28.9%   128.139.220.90
   62124600      207082        11.5%   128.139.220.91
   19671000       65570         3.6%    132.77.35.132
   15312000       51040         2.8%    132.72.23.183
   14191500       47305         2.6%    132.73.124.68
   10072800       33576         1.9%    132.73.124.48
    9477900       31593         1.8%     132.73.124.8
    7815600       26052         1.4%   132.73.124.220
    6560400       21868         1.2%   132.73.124.216
    6527100       21757         1.2%    132.74.74.134

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                            128.139.220.90               220622269500
                            128.139.220.90               220622269500
                            128.139.220.90               220622244300
  159.60.33.21                                           208142955900
  159.60.33.21                                           208142955900
  159.60.33.21                                           208142955900
  159.60.33.32                                            87356825400
  159.60.33.32                                            87356825400
  159.60.33.32                                            87356825400
                            128.139.220.91                87356825400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-09-23 00:38:23
End Time: ongoing

First Event Seen: 2026-09-23 00:36:00
Last Event Seen: 2026-09-23 00:41:00

Further Details:
https://primary.nemo.geant.org/alerts/details/438742/