[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #432523 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, August 13, 2026 9:38:41 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #432523 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 432523

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  240253500      800845        54.3%   172.110.223.179
   22422900       74743         5.1%      159.60.33.37
   20799600       69332         4.7%      159.60.33.21
   12854100       42847         2.9%     162.125.69.14
    8618400       28728         1.9%      159.60.33.32
    4709400       15698         1.1%     13.107.136.10
    4299600       14332         1.0%    57.144.248.192
    3144600       10482         0.7%      159.60.33.33
    2704500        9015         0.6%    57.144.244.192
    2551200        8504         0.6%      16.182.69.48

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  43223100      144077         9.8%    128.139.220.90
  12906000       43020         2.9%     132.76.220.37
  11763300       39211         2.7%    128.139.220.91
   7353900       24513         1.7%   128.139.225.242
   7291500       24305         1.6%     192.114.88.10
   3694500       12315         0.8%     128.139.200.4
   3683400       12278         0.8%     132.66.36.168
   3393000       11310         0.8%     128.139.200.5
   3042900       10143         0.7%      132.68.65.31
   2866500        9555         0.6%      132.66.42.59

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  172.110.223.179                                            94506376800
                               128.139.220.90                48364677600
                               128.139.220.90                48364656000
                               128.139.220.90                48364630800
     159.60.33.21                                            27986931900
     159.60.33.21                                            27986931900
     159.60.33.21                                            27986931900
     159.60.33.37                                            20377698900
     159.60.33.37                                            20377698900
     159.60.33.37                                            20377698900

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-13 18:38:30
End Time: ongoing

First Event Seen: 2026-08-13 18:36:00
Last Event Seen: 2026-08-13 18:37:00

Further Details:
https://primary.nemo.geant.org/alerts/details/432523/