[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #214367 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, September 19, 2025 12:12:20 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #214367 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 214367

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  43933800      146446        18.0%         142.251.209.46
  22238100       74127         9.1%         216.58.204.142
   9819000       32730         4.0%   2001:bf8:900:d:2::71
   6383400       21278         2.6%          132.73.124.72
   5895900       19653         2.4%          132.73.124.68
   5491200       18304         2.2%           132.73.124.8
   5123100       17077         2.1%          132.73.124.32
   4037400       13458         1.7%         132.73.124.132
   3039000       10130         1.2%         132.73.124.236
   2828100        9427         1.2%            132.70.19.4

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                   Dst IP
-----------------------------------------------------------
  39817800      132726        16.3%           142.251.209.46
  20565000       68550         8.4%           216.58.204.142
   7449300       24831         3.1%            132.73.124.72
   7267500       24225         3.0%            132.73.124.68
   6378300       21261         2.6%             132.73.124.8
   4952100       16507         2.0%            132.73.124.32
   4719000       15730         1.9%           132.73.124.236
   4318500       14395         1.8%   2001:4118:900:cc00::95
   4100400       13668         1.7%           132.73.124.132
   3960900       13203         1.6%             132.76.61.52

Top-10 Possible Targets by Bytes:
                Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------------
        142.251.209.46        443                                63572823600
        142.251.209.46                                           63572823600
        216.58.204.142        443                                31855664100
        216.58.204.142                                           31855664100
  2001:bf8:900:d:2::71                                           14689202700
  2001:bf8:900:d:2::71       8443                                13195730700
                              443   132.73.124.68                10203261600
                                    132.73.124.68                10203261600
                                    132.73.124.72                 9904822500
                              443   132.73.124.72                 9903954000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-09-19 09:11:57
End Time: ongoing

First Event Seen: 2025-09-19 09:09:00
Last Event Seen: 2025-09-19 09:10:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/214367/