[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #258421 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, August 1, 2026 10:21:22 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #258421 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 258421

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  292554000      975180        54.1%   172.110.223.179
   13779600       45932         2.6%     20.209.242.65
   12409200       41364         2.3%      159.60.33.37
    9930300       33101         1.8%      159.60.33.21
    9065100       30217         1.7%     20.150.76.228
    8732400       29108         1.6%       31.13.84.52
    6433200       21444         1.2%     172.217.116.4
    5857500       19525         1.1%      159.60.33.32
    4972800       16576         0.9%    57.144.248.192
    4121400       13738         0.8%       52.84.151.4

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  22340400       74468         4.1%    128.139.220.90
  14743500       49145         2.7%     132.68.39.200
  13780500       45935         2.6%       132.70.19.4
  10766700       35889         2.0%   128.139.225.242
  10108200       33694         1.9%     192.114.88.10
   9414000       31380         1.7%    128.139.220.91
   9065700       30219         1.7%        132.68.0.1
   8861700       29539         1.6%      132.76.80.87
   7631400       25438         1.4%     132.66.253.82
   6255600       20852         1.2%     132.76.105.72

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  172.110.223.179                                           115325485800
                               128.139.220.90                21950682000
                               128.139.220.90                21950637000
                               128.139.220.90                21950611800
                         443    132.68.39.200                21351249000
                                132.68.39.200                21351249000
                         443       132.68.0.1                13318595700
                                   132.68.0.1                13318595700
    20.150.76.228        443                                 13318561500
    20.150.76.228                                            13318561500

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-01 19:17:11
End Time: ongoing

First Event Seen: 2026-08-01 19:14:00
Last Event Seen: 2026-08-01 19:19:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/258421/