[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #259810 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, August 11, 2026 7:35:10 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #259810 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 259810

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  20617500       68725         8.0%   185.199.110.133
  20372100       67907         7.9%   185.199.109.133
  19571400       65238         7.6%   185.199.111.133
  17391000       57970         6.8%   185.199.108.133
  14403300       48011         5.6%      159.60.33.37
   7946400       26488         3.1%      159.60.33.21
   5139900       17133         2.0%      159.60.33.32
   4371000       14570         1.7%     16.15.214.178
   3552600       11842         1.4%       31.13.84.52
   3482100       11607         1.4%    23.218.225.120

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  22350000       74500         8.7%    128.139.220.90
   8309700       27699         3.2%    128.139.220.91
   5619300       18731         2.2%   185.199.111.133
   4929000       16430         1.9%   185.199.110.133
   4919700       16399         1.9%   185.199.109.133
   4371000       14570         1.7%     132.65.180.21
   4182300       13941         1.6%      132.70.66.11
   3651300       12171         1.4%   185.199.108.133
   3334200       11114         1.3%     192.114.3.241
   2929500        9765         1.1%    132.64.244.233

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  185.199.110.133        443                                 27899139300
  185.199.110.133                                            27899139300
  185.199.109.133        443                                 27582337200
  185.199.109.133                                            27582337200
  185.199.111.133        443                                 26585978100
  185.199.111.133                                            26585978100
  185.199.108.133        443                                 23581151100
  185.199.108.133                                            23581151100
                               128.139.220.90                23542818600
                               128.139.220.90                23542800600

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-08-11 04:35:04
End Time: ongoing

First Event Seen: 2026-08-11 04:32:00
Last Event Seen: 2026-08-11 04:33:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/259810/