[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #381168 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, August 13, 2025 5:20:43 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #381168 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 381168

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  16873200       56244         2.8%   95.101.122.138
  13834200       46114         2.3%    132.74.112.76
  12543000       41810         2.1%   216.58.204.129
  11869800       39566         2.0%   23.220.255.161
  11085300       36951         1.9%    132.73.124.48
  11019000       36730         1.9%   95.101.122.145
  10869300       36231         1.8%   95.101.122.144
   8421300       28071         1.4%     132.73.124.8
   8244000       27480         1.4%    95.101.122.88
   8064900       26883         1.4%   23.220.255.188

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  30978300      103261         5.2%     132.73.124.48
  22495200       74984         3.8%      132.73.124.8
  16277700       54259         2.7%     132.73.124.60
  15916200       53054         2.7%    216.58.204.138
  12410100       41367         2.1%    128.139.13.134
  12313800       41046         2.1%     132.65.180.21
  12292800       40976         2.1%     13.107.136.10
   9782100       32607         1.6%     132.73.124.72
   9587100       31957         1.6%     132.65.180.16
   8624100       28747         1.4%   128.139.225.244

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                               132.73.124.48                46070466300
                        443    132.73.124.48                45833324700
                                132.73.124.8                31798869900
                        443     132.73.124.8                31728558900
  95.101.122.138        443                                 24224298300
  95.101.122.138                                            24224298300
                        443    132.73.124.60                23781744000
                               132.73.124.60                23781744000
                              216.58.204.138                21494135400
                              216.58.204.138        443     21493989600

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-13 14:16:31
End Time: ongoing

First Event Seen: 2025-08-13 14:14:00
Last Event Seen: 2025-08-13 14:19:00

Further Details:
https://primary.nemo.geant.org/alerts/details/381168/