[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #259193 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, August 7, 2026 6:50:12 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #259193 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 259193

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total                 Src IP
----------------------------------------------------------
  103336800      344456        47.2%        172.110.223.179
   11090400       36968         5.1%           159.60.33.37
    6009600       20032         2.7%           159.60.33.21
    4268100       14227         1.9%          172.217.118.4
    3873300       12911         1.8%   2001:bf8:900:d:2::71
    3663600       12212         1.7%           159.60.33.32
    3178200       10594         1.5%           16.15.183.82
    3110700       10369         1.4%          34.104.35.123
    2310600        7702         1.1%          172.217.119.4
    1834200        6114         0.8%          23.218.225.97

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total              Dst IP
------------------------------------------------------
  17100000       57000         7.8%      128.139.220.90
   4493100       14977         2.1%      132.66.244.166
   4378500       14595         2.0%      128.139.220.91
   4060800       13536         1.9%       132.74.74.134
   3817200       12724         1.7%   2610:1d8:a01:1::7
   3411300       11371         1.6%       132.65.180.31
   2772600        9242         1.3%       128.139.200.5
   1591500        5305         0.7%        192.114.5.10
   1548600        5162         0.7%       132.66.160.99
   1321200        4404         0.6%       128.139.200.4

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  172.110.223.179                                            40658457000
                               128.139.220.90                17458975200
                               128.139.220.90                17458975200
                               128.139.220.90                17458975200
     159.60.33.37                                            10635015600
     159.60.33.37                                            10635015600
     159.60.33.37                                            10635015600
     159.60.33.21                                             6823959600
     159.60.33.21                                             6823959600
     159.60.33.21                                             6823959600

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-07 03:50:05
End Time: ongoing

First Event Seen: 2026-08-07 03:47:00
Last Event Seen: 2026-08-07 03:48:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/259193/