[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #433206 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, August 18, 2026 4:41:46 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #433206 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 433206

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  99372000      331240        27.8%         66.232.120.166
  15555900       51853         4.3%          172.217.113.4
  15502200       51674         4.3%           159.60.33.37
  12131100       40437         3.4%           159.60.33.21
   8679600       28932         2.4%          172.217.117.4
   7122000       23740         2.0%            134.70.60.1
   4164900       13883         1.2%          172.217.118.4
   3798000       12660         1.1%          172.217.114.4
   3445500       11485         1.0%         199.232.82.172
   3069900       10233         0.9%   2001:bf8:900:d:2::71

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  27634800       92116         7.7%    128.139.220.90
  14722800       49076         4.1%     132.74.56.132
  12230400       40768         3.4%     132.74.56.196
   8703900       29013         2.4%    132.66.218.115
   6156300       20521         1.7%     132.74.74.134
   5304900       17683         1.5%    128.139.220.91
   3129900       10433         0.9%     192.114.88.10
   2699400        8998         0.8%    132.67.132.144
   2658900        8863         0.7%     128.139.200.4
   2625300        8751         0.7%   128.139.225.242

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
  66.232.120.166                                            39045480600
                              128.139.220.90                29856318000
                              128.139.220.90                29855953200
                              128.139.220.90                29855928000
   172.217.113.4        443                                 22190377800
   172.217.113.4                                            22190377800
                        443    132.74.56.132                21346012800
                               132.74.56.132                21346012800
                        443    132.74.56.196                17727119400
                               132.74.56.196                17727119400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-18 01:37:44
End Time: ongoing

First Event Seen: 2026-08-18 01:35:00
Last Event Seen: 2026-08-18 01:40:00

Further Details:
https://primary.nemo.geant.org/alerts/details/433206/