[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #257181 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, July 24, 2026 7:35:03 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #257181 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 257181

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  42011700      140039        15.4%    194.180.48.207
  20424300       68081         7.5%   185.199.110.133
  18075300       60251         6.6%   185.199.108.133
  17590500       58635         6.4%   185.199.109.133
  16973700       56579         6.2%   185.199.111.133
   8142000       27140         3.0%      159.60.33.37
   6667800       22226         2.4%      159.60.33.21
   4650900       15503         1.7%     20.209.242.65
   4461900       14873         1.6%      159.60.33.32
   4377900       14593         1.6%     52.216.208.17

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  14811300       49371         5.4%    128.139.220.90
   7665900       25553         2.8%    128.139.220.91
   6670200       22234         2.4%     192.114.3.241
   6093000       20310         2.2%      132.69.32.71
   5211900       17373         1.9%   185.199.110.133
   4787700       15959         1.8%     132.74.74.134
   4650900       15503         1.7%       132.70.19.4
   4447800       14826         1.6%   185.199.109.133
   4098600       13662         1.5%     192.114.88.10
   4098300       13661         1.5%   128.139.225.242

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  185.199.110.133        443                                 27568798200
  185.199.110.133                                            27568798200
  185.199.108.133        443                                 24391499100
  185.199.108.133                                            24391499100
  185.199.109.133        443                                 23819894100
  185.199.109.133                                            23819894100
  185.199.111.133        443                                 22929010500
  185.199.111.133                                            22929010500
                               128.139.220.90                14780934300
                               128.139.220.90                14780887500

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-07-24 04:34:56
End Time: ongoing

First Event Seen: 2026-07-24 04:32:00
Last Event Seen: 2026-07-24 04:33:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/257181/