[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #259411 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, August 8, 2026 3:11:10 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #259411 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 259411

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  88047600      293492        38.4%   172.110.223.179
  11232900       37443         4.9%      159.60.33.21
   9210300       30701         4.0%      159.60.33.37
   5252700       17509         2.3%     172.217.117.4
   4207800       14026         1.8%     16.15.191.200
   4170000       13900         1.8%     16.182.35.184
   4036200       13454         1.8%      159.60.33.32
   3264300       10881         1.4%       31.13.84.52
   2737200        9124         1.2%    57.144.248.192
   2504700        8349         1.1%      159.60.33.33

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  20443200       68144         8.9%    128.139.220.90
   6540900       21803         2.9%    128.139.220.91
   5000100       16667         2.2%     192.114.88.10
   4566900       15223         2.0%   128.139.225.242
   4344900       14483         1.9%     132.65.180.31
   4170000       13900         1.8%     132.65.180.12
   3882900       12943         1.7%     132.74.74.134
   3552000       11840         1.6%     128.139.200.5
   2748000        9160         1.2%     128.139.200.4
   2377200        7924         1.0%     132.69.176.88

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  172.110.223.179                                            34640957400
                               128.139.220.90                21205124700
                               128.139.220.90                21205124700
                               128.139.220.90                21205124700
     159.60.33.21                                            14076663000
     159.60.33.21                                            14076663000
     159.60.33.21                                            14076663000
    172.217.117.4        443                                  7371509100
    172.217.117.4                                             7371509100
     159.60.33.37                                             7128461700

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-08 12:11:01
End Time: ongoing

First Event Seen: 2026-08-08 12:08:00
Last Event Seen: 2026-08-08 12:09:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/259411/