[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #258961 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, August 6, 2026 1:03:17 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #258961 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 258961

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  97616700      325389        35.1%   172.110.223.179
  15028200       50094         5.4%     172.217.114.4
  14982000       49940         5.4%    57.144.248.128
   8382300       27941         3.0%      159.60.33.37
   7218300       24061         2.6%     20.209.242.65
   5646900       18823         2.0%      159.60.33.33
   5094900       16983         1.8%    57.144.248.192
   4356000       14520         1.6%      159.60.33.21
   4052100       13507         1.5%     172.217.116.4
   3741000       12470         1.3%    157.240.253.63

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  17678100       58927         6.3%      132.64.86.15
  12739200       42464         4.6%    128.139.220.90
  10824300       36081         3.9%     192.114.52.14
   9981300       33271         3.6%     192.114.3.241
   8605800       28686         3.1%    128.139.220.91
   7218300       24061         2.6%       132.70.19.4
   6876900       22923         2.5%     192.114.88.10
   6395100       21317         2.3%   128.139.225.242
   3972300       13241         1.4%     132.74.74.134
   3696000       12320         1.3%     132.65.180.19

Top-10 Possible Targets by Bytes:
           Src IP   Src Port          Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
  172.110.223.179                                           38011867800
                                132.64.86.15                25280838000
                         443    132.64.86.15                25280722800
   57.144.248.128        443                                21331883700
   57.144.248.128                                           21331883700
    172.217.114.4        443                                21319379400
    172.217.114.4                                           21319379400
                               192.114.3.241                13772484600
                         443   192.114.3.241                13731383400
                               192.114.52.14                13271148900

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-05 22:03:03
End Time: ongoing

First Event Seen: 2026-08-05 22:00:00
Last Event Seen: 2026-08-05 22:01:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/258961/