[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #258336 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, August 1, 2026 1:24:14 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #258336 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 258336

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total                 Src IP
--------------------------------------------------------
  9121200       30404         4.1%          16.15.229.178
  8642100       28807         3.8%         54.231.162.113
  7994100       26647         3.6%          16.15.183.193
  7686000       25620         3.4%           52.216.217.1
  7515300       25051         3.3%           159.60.33.37
  7413600       24712         3.3%   2001:bf8:900:d:2::71
  6642300       22141         3.0%           159.60.33.21
  5367000       17890         2.4%          16.15.253.166
  5213700       17379         2.3%         54.231.229.129
  5161200       17204         2.3%           159.60.33.32

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  22507800       75026        10.0%    132.66.102.40
  14158800       47196         6.3%   128.139.220.90
  10158300       33861         4.5%   192.114.101.50
  10138500       33795         4.5%   192.114.101.49
   9772800       32576         4.3%   192.114.101.61
   9114000       30380         4.0%   192.114.101.55
   8856300       29521         3.9%   192.114.101.71
   8816400       29388         3.9%   192.114.101.68
   8295600       27652         3.7%   192.114.101.72
   7138500       23795         3.2%   128.139.220.91

Top-10 Possible Targets by Bytes:
  Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------
                443    132.66.102.40                32089565100
                       132.66.102.40                32089565100
                443   192.114.101.49                14648767200
                      192.114.101.49                14648767200
                443   192.114.101.50                14589363000
                      192.114.101.50                14589363000
                443   192.114.101.61                14019771900
                      192.114.101.61                14019771900
                443   192.114.101.55                13122166200
                      192.114.101.55                13122166200

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-01 10:24:08
End Time: ongoing

First Event Seen: 2026-08-01 10:21:00
Last Event Seen: 2026-08-01 10:22:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/258336/