[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #434297 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, August 24, 2026 7:06:43 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #434297 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 434297

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  137104800      457016        34.4%   172.110.223.179
   25190700       83969         6.3%    172.217.23.187
   24699900       82333         6.2%      159.60.33.37
   12080400       40268         3.0%      159.60.33.21
   10161600       33872         2.5%      159.60.33.32
    5972100       19907         1.5%    57.144.248.192
    4565400       15218         1.1%    157.240.253.63
    4508100       15027         1.1%      159.60.33.33
    3644400       12148         0.9%     34.104.35.123
    3598200       11994         0.9%    57.144.244.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  36781200      122604         9.2%    128.139.220.90
  25405800       84686         6.4%      132.68.16.26
  14670000       48900         3.7%    128.139.220.91
  12620400       42068         3.2%      132.70.60.33
   8398200       27994         2.1%      192.114.5.10
   5907900       19693         1.5%     192.114.88.10
   5172600       17242         1.3%   128.139.225.242
   5006100       16687         1.3%    132.68.176.251
   4419000       14730         1.1%    192.114.23.221
   4403100       14677         1.1%     128.139.200.4

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  172.110.223.179                                            53935417200
                         443     132.68.16.26                36861914400
                                 132.68.16.26                36861914400
   172.217.23.187        443                                 36550843200
   172.217.23.187                                            36550843200
                               128.139.220.90                35941842900
                               128.139.220.90                35941842900
                               128.139.220.90                35941767300
     159.60.33.37                                            23200108200
     159.60.33.37                                            23200108200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2026-08-24 16:06:33
End Time: ongoing

First Event Seen: 2026-08-24 16:04:00
Last Event Seen: 2026-08-24 16:05:00

Further Details:
https://primary.nemo.geant.org/alerts/details/434297/