[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #258421 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, August 1, 2026 10:17:20 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #258421 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 258421

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  134481600      448272        44.1%   172.110.223.179
    9345300       31151         3.1%     20.209.242.65
    7594800       25316         2.5%      159.60.33.37
    7300800       24336         2.4%      159.60.33.21
    6103200       20344         2.0%     20.150.76.228
    5931000       19770         1.9%       31.13.84.52
    4920900       16403         1.6%     172.217.116.4
    4245300       14151         1.4%      159.60.33.32
    3227100       10757         1.1%    57.144.248.192
    2919300        9731         1.0%     172.217.115.4

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  14896500       49655         4.9%    128.139.220.90
  10378200       34594         3.4%     132.68.39.200
   9345300       31151         3.1%       132.70.19.4
   7082700       23609         2.3%   128.139.225.242
   6640500       22135         2.2%    128.139.220.91
   6282600       20942         2.1%     192.114.88.10
   6143700       20479         2.0%     132.66.253.82
   6103800       20346         2.0%        132.68.0.1
   5895600       19652         1.9%      132.76.80.87
   4068000       13560         1.3%     192.114.52.14

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  172.110.223.179                                            53000127300
                         443    132.68.39.200                15037256400
                                132.68.39.200                15037256400
                               128.139.220.90                14809242900
                               128.139.220.90                14809197900
                               128.139.220.90                14809172700
                         443    132.66.253.82                 9001444500
                                132.66.253.82                 9001444500
                         443       132.68.0.1                 8956459200
                                   132.68.0.1                 8956459200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-01 19:17:11
End Time: ongoing

First Event Seen: 2026-08-01 19:14:00
Last Event Seen: 2026-08-01 19:15:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/258421/