[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #254121 CRIT: IUCC (AS378) - [Customer] [IUCC] [Email_Analysis]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at geant.org <nemo-ddos at geant.org>
Sent: Wednesday, February 28, 2024 3:01:49 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #254121 CRIT: IUCC (AS378) - [Customer] [IUCC] [Email_Analysis]

Please find the analysis details for the Alert ID: 254121

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total                               Src IP
----------------------------------------------------------------------
  8330700       27769         6.1%                          31.13.84.52
  6692700       22309         4.9%                      142.250.180.161
  6620700       22069         4.8%   2a03:2880:f207:c4:face:b00c:0:43fe
  4608600       15362         3.4%                           31.13.84.4
  4560600       15202         3.3%                          31.13.84.51
  2877900        9593         2.1%       2a03:2880:f007:8:face:b00c:0:1
  2754900        9183         2.0%                          31.13.84.15
  2700300        9001         2.0%                        163.70.147.63
  2248500        7495         1.6%                       157.240.195.63
  2000400        6668         1.5%                       157.240.221.63

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  646268100     2154227       471.9%     128.139.199.9
  408478800     1361596       298.3%    132.77.150.157
   45596700      151989        33.3%   192.114.102.100
   44017800      146726        32.1%    132.70.153.251
   43890600      146302        32.0%    147.233.249.20
    6611700       22039         4.8%     132.64.18.189
    5143500       17145         3.8%   128.139.225.245
    4317600       14392         3.2%     128.139.199.2
    4024200       13414         2.9%    132.74.123.113
    3157500       10525         2.3%    192.114.91.248

Top-10 Possible Targets by Bytes:
  Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------
                       128.139.199.9               829998378300
                      132.77.150.157               525489358200
                       128.139.199.9               475985024400
                       128.139.199.9               475985024400
                       128.139.199.9        443    354011209500
                 53    128.139.199.9               353949232500
                      132.77.150.157               302220376800
                      132.77.150.157               302220376800
                      132.77.150.157        443    223249851000
                 53   132.77.150.157               223219886700

Further Details:
https://primary.nemo.geant.org/alerts/details/254121/