[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #433206 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, August 18, 2026 4:37:52 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #433206 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 433206

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  61328100      204427        23.5%   66.232.120.166
  13329000       44430         5.1%    172.217.113.4
  13152300       43841         5.0%     159.60.33.37
  10033200       33444         3.8%     159.60.33.21
   8668200       28894         3.3%    172.217.117.4
   5909400       19698         2.3%      134.70.60.1
   3765900       12553         1.4%    172.217.114.4
   2682600        8942         1.0%   199.232.82.172
   2381100        7937         0.9%     159.60.33.32
   2377500        7925         0.9%    172.217.115.4

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  23187000       77290         8.9%    128.139.220.90
  12674700       42249         4.9%     132.74.56.132
   9759300       32531         3.7%     132.74.56.196
   7263000       24210         2.8%    132.66.218.115
   5111400       17038         2.0%     132.74.74.134
   4408200       14694         1.7%    128.139.220.91
   2724300        9081         1.0%     192.114.88.10
   2278200        7594         0.9%   128.139.225.242
   2197800        7326         0.8%     128.139.200.4
   2162100        7207         0.8%    132.67.132.144

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              128.139.220.90                24948486300
                              128.139.220.90                24948121500
                              128.139.220.90                24948096300
  66.232.120.166                                            24186742200
   172.217.113.4        443                                 18994300800
   172.217.113.4                                            18994300800
                        443    132.74.56.132                18376091400
                               132.74.56.132                18376091400
                        443    132.74.56.196                14143832700
                               132.74.56.196                14143832700

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-18 01:37:44
End Time: ongoing

First Event Seen: 2026-08-18 01:35:00
Last Event Seen: 2026-08-18 01:36:00

Further Details:
https://primary.nemo.geant.org/alerts/details/433206/