[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #381170 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, August 13, 2025 5:24:40 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #381170 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 381170

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  16873200       56244         3.1%   95.101.122.138
  13834200       46114         2.6%    132.74.112.76
  11869800       39566         2.2%   23.220.255.161
  11055900       36853         2.1%   95.101.122.145
  11046000       36820         2.1%    132.73.124.48
  10869000       36230         2.0%   95.101.122.144
   8277000       27590         1.5%     132.73.124.8
   8228400       27428         1.5%    95.101.122.88
   8047200       26824         1.5%   23.220.255.188
   7856400       26188         1.5%   23.220.255.158

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  30951600      103172         5.8%    132.73.124.48
  22256700       74189         4.2%     132.73.124.8
  16265100       54217         3.0%    132.73.124.60
  15536700       51789         2.9%   216.58.204.138
  12313800       41046         2.3%    132.65.180.21
  12283200       40944         2.3%    13.107.136.10
   9655200       32184         1.8%    132.73.124.72
   9587100       31957         1.8%    132.65.180.16
   7913400       26378         1.5%    132.73.124.40
   7782900       25943         1.5%   192.114.91.232

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                               132.73.124.48                46025805000
                        443    132.73.124.48                45788663400
                                132.73.124.8                31778536800
                        443     132.73.124.8                31708225800
  95.101.122.138        443                                 24224298300
  95.101.122.138                                            24224298300
                        443    132.73.124.60                23779413900
                               132.73.124.60                23779413900
                              216.58.204.138        443     21429055500
                              216.58.204.138                21429055500

Metric Info:
2M TCP Packets/s

Alert Type:
time_window

Alert Description:
High TCP packet rate

Start Time: 2025-08-13 14:16:37
End Time: ongoing

First Event Seen: 2025-08-13 14:14:00
Last Event Seen: 2025-08-13 14:23:00

Further Details:
https://primary.nemo.geant.org/alerts/details/381170/