[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #382964 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, August 25, 2025 1:52:37 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #382964 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 382964

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total                                  Src IP
-------------------------------------------------------------------------
  4683900       15613        10.4%                           142.251.209.1
  1617000        5390         3.6%                          157.240.253.63
  1532400        5108         3.4%                          157.240.252.63
  1429500        4765         3.2%                         128.139.225.244
  1325400        4418         2.9%                          208.67.222.222
  1323000        4410         2.9%                          157.240.251.63
   817200        2724         1.8%                           98.142.246.59
   765300        2551         1.7%                           98.142.246.60
   606300        2021         1.3%   2a04:cec2:2d:2f6f:cce1:e782:c04e:1666
   596100        1987         1.3%                            157.240.0.63

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total                 Dst IP
----------------------------------------------------------
  726067800     2420226      1605.9%         132.76.150.110
    5131800       17106        11.4%           192.114.52.7
    3103200       10344         6.9%        128.139.225.244
    1488900        4963         3.3%         208.67.222.222
     969600        3232         2.1%           128.139.35.5
     781800        2606         1.7%         74.125.206.207
     684600        2282         1.5%           192.114.52.6
     612000        2040         1.4%   2001:bf8:200:fe00::7
     576900        1923         1.3%         208.67.220.220
     553200        1844         1.2%          192.114.52.13

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                              132.76.150.110               914855155500
                              132.76.150.110               522998026500
                              132.76.150.110               522998026500
                              132.76.150.110         80    391820821800
                        53    132.76.150.110               390111552900
                                192.114.52.7                 6183848400
                       443      192.114.52.7                 6178698000
  142.251.209.1        443                                   5936812200
  142.251.209.1                                              5936812200
                             128.139.225.244                 3400644300

Metric Info:
643k UDP Packets/s

Alert Type:
time_window

Alert Description:
High UDP packet rate

Start Time: 2025-08-24 22:12:38
End Time: ongoing

First Event Seen: 2025-08-24 22:10:00
Last Event Seen: 2025-08-24 22:51:00

Further Details:
https://primary.nemo.geant.org/alerts/details/382964/