[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #255557 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, July 12, 2026 7:30:56 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #255557 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 255557

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  115509000      385030        31.5%   172.110.223.179
   54265800      180886        14.8%     79.124.60.194
   18503400       61678         5.0%      159.60.33.37
    8256000       27520         2.3%      159.60.33.21
    6961200       23204         1.9%      159.60.33.32
    5565900       18553         1.5%    146.75.122.172
    4096800       13656         1.1%       31.13.84.52
    3574500       11915         1.0%    216.239.38.223
    3315600       11052         0.9%      64.52.19.115
    3283200       10944         0.9%   199.232.214.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  26759700       89199         7.3%    128.139.220.90
   9474900       31583         2.6%     132.77.39.173
   8525100       28417         2.3%    128.139.220.91
   5287200       17624         1.4%   128.139.225.242
   4846500       16155         1.3%     192.114.88.10
   4655700       15519         1.3%     132.74.74.134
   4268400       14228         1.2%     192.114.3.241
   4232100       14107         1.2%     128.139.200.4
   3410400       11368         0.9%     128.139.200.5
   1568400        5228         0.4%     132.74.68.199

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  172.110.223.179                                            45513516600
                               128.139.220.90                24650967000
                               128.139.220.90                24650967000
                               128.139.220.90                24650941800
     159.60.33.37                                            15330913500
     159.60.33.37                                            15330913500
     159.60.33.37                                            15330913500
                         443    132.77.39.173                13644924000
                                132.77.39.173                13644924000
     159.60.33.21                                             9320028300

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-12 04:30:47
End Time: ongoing

First Event Seen: 2026-07-12 04:28:00
Last Event Seen: 2026-07-12 04:29:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/255557/