[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #379156 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 29, 2025 2:53:21 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #379156 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 379156

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  93766200      312554        45.1%   2001:bf8:900:d:2::71
   6592500       21975         3.2%         132.68.129.214
   3665400       12218         1.8%          82.77.160.177
   3189900       10633         1.5%   2602:fd0f:0:1001::20
   2777100        9257         1.3%         142.251.209.10
   2386200        7954         1.1%          162.125.69.12
   2327700        7759         1.1%          52.105.179.41
   1656600        5522         0.8%        128.139.225.244
   1539600        5132         0.7%         157.240.251.63
   1431900        4773         0.7%          132.77.49.181

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total                      Dst IP
-------------------------------------------------------------
  8742600       29142         4.2%   2001:760:422a:137::201:80
  8657100       28857         4.2%                128.139.35.5
  8411700       28039         4.0%               162.125.69.12
  6401400       21338         3.1%   2001:760:422a:137::201:73
  6091800       20306         2.9%   2001:760:422a:137::201:79
  6033000       20110         2.9%   2001:760:422a:137::201:71
  5656500       18855         2.7%   2001:760:422a:137::201:21
  5294400       17648         2.5%             128.139.225.244
  4995300       16651         2.4%   2001:760:422a:137::201:23
  4756200       15854         2.3%   2001:760:422a:137::201:70

Top-10 Possible Targets by Bytes:
                Src IP   Src Port                      Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------------------------
  2001:bf8:900:d:2::71       8443                                           140465610600
  2001:bf8:900:d:2::71                                                      140465610600
                             8443   2001:760:422a:137::201:80                13084245000
                                    2001:760:422a:137::201:80                13084245000
                                                 128.139.35.5                12192697800
                                                 128.139.35.5         53     12192387600
                                                162.125.69.12        443     11579164500
                                                162.125.69.12                11579164500
        132.68.129.214                                               443      9322193700
        132.68.129.214                                                        9322193700

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-28 23:53:10
End Time: ongoing

First Event Seen: 2025-07-28 23:50:00
Last Event Seen: 2025-07-28 23:51:00

Further Details:
https://primary.nemo.geant.org/alerts/details/379156/