[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #271237 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, October 23, 2026 8:35:34 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #271237 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 271237

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  20364900       67883         8.0%   185.199.109.133
  17969400       59898         7.1%   185.199.108.133
  17227800       57426         6.8%   185.199.111.133
  15475200       51584         6.1%   185.199.110.133
  10920300       36401         4.3%      159.60.33.37
   7445400       24818         2.9%     162.125.69.12
   6911400       23038         2.7%      159.60.33.32
   6788400       22628         2.7%      52.84.151.16
   6634500       22115         2.6%       52.84.151.4
   6137400       20458         2.4%      52.84.151.30

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  22275600       74252         8.8%     132.66.253.82
  16930800       56436         6.7%    128.139.220.90
   9482700       31609         3.7%    128.139.220.91
   7282800       24276         2.9%      132.68.23.45
   5732100       19107         2.3%      132.70.60.16
   4899600       16332         1.9%   185.199.109.133
   4748700       15829         1.9%     132.74.74.134
   4320300       14401         1.7%   185.199.108.133
   4309500       14365         1.7%     192.114.52.13
   3619200       12064         1.4%     128.139.200.4

Top-10 Possible Targets by Bytes:
           Src IP   Src Port          Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                         443   132.66.253.82                32319484200
                               132.66.253.82                32319484200
  185.199.109.133        443                                27467217300
  185.199.109.133                                           27467217300
  185.199.108.133        443                                24233779500
  185.199.108.133                                           24233779500
  185.199.111.133        443                                23314252500
  185.199.111.133                                           23314252500
  185.199.110.133        443                                20273556900
  185.199.110.133                                           20273556900

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-10-23 17:35:25
End Time: ongoing

First Event Seen: 2026-10-23 17:33:00
Last Event Seen: 2026-10-23 17:34:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/271237/