[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #382963 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, August 25, 2025 1:16:44 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #382963 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 382963

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  18207300       60691        11.2%   2001:bf8:900:d:2::71
   9264600       30882         5.7%          132.73.124.47
   5235600       17452         3.2%        142.250.179.202
   4765800       15886         2.9%          142.251.209.1
   2849400        9498         1.8%          52.217.13.204
   2313900        7713         1.4%          132.73.124.48
   1953000        6510         1.2%        142.250.180.138
   1872900        6243         1.2%          34.104.35.123
   1684800        5616         1.0%         157.240.253.63
   1640700        5469         1.0%         157.240.252.63

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total                          Dst IP
-------------------------------------------------------------------
  734008200     2446694       450.8%                  132.76.150.110
    6503100       21677         4.0%             2001:a98:1e:ff::116
    6316200       21054         3.9%   2001:1470:ff94:d:153:5:68:163
    5889600       19632         3.6%                   132.74.74.134
    5492100       18307         3.4%                 128.139.225.244
    5374800       17916         3.3%                    192.114.52.7
    3809100       12697         2.3%             2001:a98:1e:ff::115
    3522300       11741         2.2%                   128.139.200.4
    2849400        9498         1.8%                   132.75.113.95
    2520000        8400         1.5%                  142.251.209.27

Top-10 Possible Targets by Bytes:
                Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------
                                    132.76.150.110               915815511300
                                    132.76.150.110               523091734200
                                    132.76.150.110               522998026500
                                    132.76.150.110         80    392533273200
                               53   132.76.150.110               390111691800
  2001:bf8:900:d:2::71       8443                                 27195939000
  2001:bf8:900:d:2::71                                            27195939000
         132.73.124.47                                            13188698700
         132.73.124.47                                    443     13188561000
  2001:bf8:900:d:2::71                                  47168      9725632200

Metric Info:
4M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-24 22:12:29
End Time: ongoing

First Event Seen: 2025-08-24 22:10:00
Last Event Seen: 2025-08-24 22:15:00

Further Details:
https://primary.nemo.geant.org/alerts/details/382963/