[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #382262 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, August 20, 2025 4:11:43 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #382262 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 382262

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  33995100      113317        10.6%     2.23.231.234
  30895200      102984         9.6%     2.23.231.161
  24228300       80761         7.5%   23.220.255.140
  23392500       77975         7.3%   23.220.255.155
  19928700       66429         6.2%     184.25.54.62
  12682800       42276         3.9%    132.73.124.68
   7738200       25794         2.4%    34.104.35.123
   7506000       25020         2.3%    132.73.124.48
   7381200       24604         2.3%   132.73.124.236
   4503600       15012         1.4%    192.114.3.241

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  27980400       93268         8.7%    132.73.124.68
  17357100       57857         5.4%   132.73.124.236
  16517400       55058         5.1%    132.73.124.48
  15741000       52470         4.9%     2.23.231.234
  14816100       49387         4.6%     2.23.231.161
  10728600       35762         3.3%   23.220.255.140
   9889800       32966         3.1%     184.25.54.62
   9788100       32627         3.0%   23.220.255.155
   8958000       29860         2.8%    132.73.124.40
   8122800       27076         2.5%     132.73.124.8

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
    2.23.231.234                                           50906937000
    2.23.231.234        443                                50901423000
    2.23.231.161                                           46255596900
    2.23.231.161        443                                46250448600
                              132.73.124.68                41318841900
                        443   132.73.124.68                41200458300
  23.220.255.140        443                                36309078600
  23.220.255.140                                           36309078600
  23.220.255.155        443                                35036394300
  23.220.255.155                                           35036394300

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-20 01:11:34
End Time: ongoing

First Event Seen: 2025-08-20 01:09:00
Last Event Seen: 2025-08-20 01:10:00

Further Details:
https://primary.nemo.geant.org/alerts/details/382262/