[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #434154 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, August 23, 2026 8:47:50 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #434154 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 434154

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  115500900      385003        38.9%   172.110.223.179
   16048200       53494         5.4%      159.60.33.37
    9076500       30255         3.1%      159.60.33.21
    7848300       26161         2.6%      159.60.33.32
    7013100       23377         2.4%      159.60.33.33
    5244000       17480         1.8%     172.217.114.4
    4331400       14438         1.5%    57.144.248.192
    3433800       11446         1.2%    157.240.253.63
    2924100        9747         1.0%    57.144.244.192
    2732100        9107         0.9%      172.66.0.165

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  25125000       83750         8.5%    128.139.220.90
  14861400       49538         5.0%    128.139.220.91
   5311500       17705         1.8%     132.66.253.82
   5105100       17017         1.7%      192.114.5.10
   5020500       16735         1.7%     132.74.74.134
   5009400       16698         1.7%    132.65.128.142
   4734900       15783         1.6%   128.139.225.242
   4663500       15545         1.6%    132.68.176.251
   4518000       15060         1.5%     192.114.88.10
   4015500       13385         1.4%     128.139.200.4

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  172.110.223.179                                            45439564800
                               128.139.220.90                23294401800
                               128.139.220.90                23294380200
                               128.139.220.90                23294380200
                               128.139.220.91                16661936700
                               128.139.220.91                16661936700
                               128.139.220.91                16661936700
     159.60.33.37                                            12578142000
     159.60.33.37                                            12578142000
     159.60.33.37                                            12578142000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-23 17:47:41
End Time: ongoing

First Event Seen: 2026-08-23 17:45:00
Last Event Seen: 2026-08-23 17:46:00

Further Details:
https://primary.nemo.geant.org/alerts/details/434154/