[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #256513 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, July 20, 2026 6:31:04 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #256513 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 256513

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  80541600      268472        37.2%        172.110.223.179
  15147300       50491         7.0%        192.178.194.207
  10211700       34039         4.7%           159.60.33.37
   7179300       23931         3.3%   2001:bf8:900:d:2::71
   5250000       17500         2.4%           159.60.33.32
   3659400       12198         1.7%           159.60.33.21
   2385600        7952         1.1%           159.60.33.33
   1855200        6184         0.9%           35.190.46.17
   1785000        5950         0.8%          13.107.136.10
   1548900        5163         0.7%         161.97.186.179

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                    Dst IP
------------------------------------------------------------
  14992500       49975         6.9%             132.68.67.168
  13871400       46238         6.4%            128.139.220.90
   7636200       25454         3.5%            128.139.220.91
   3968100       13227         1.8%             192.114.3.241
   3941100       13137         1.8%           128.139.225.242
   3429000       11430         1.6%             192.114.88.10
   3099600       10332         1.4%             128.139.200.5
   2997000        9990         1.4%             128.139.200.4
   2165400        7218         1.0%   2607:f8f0:690:3::127:16
   1866600        6222         0.9%   2607:f8f0:690:3::127:13

Top-10 Possible Targets by Bytes:
                Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------
       172.110.223.179                                            31682913900
                              443    132.68.67.168                21752942100
                                     132.68.67.168                21752942100
       192.178.194.207        443                                 21596201100
       192.178.194.207                                            21596201100
       192.178.194.207                                  50745     21573956700
                                     132.68.67.168      50745     21573956700
  2001:bf8:900:d:2::71       8443                                 10709074200
  2001:bf8:900:d:2::71                                            10709074200
                                    128.139.220.90                10011002700

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-20 03:30:57
End Time: ongoing

First Event Seen: 2026-07-20 03:28:00
Last Event Seen: 2026-07-20 03:29:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/256513/