[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #382963 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, August 25, 2025 1:12:39 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #382963 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 382963

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  14977200       49924        11.4%   2001:bf8:900:d:2::71
   6785700       22619         5.2%          132.73.124.47
   4987500       16625         3.8%        142.250.179.202
   4055700       13519         3.1%          142.251.209.1
   2278500        7595         1.7%          132.73.124.48
   2110200        7034         1.6%          52.217.13.204
   1789800        5966         1.4%        142.250.180.138
   1512600        5042         1.1%          52.98.242.226
   1398000        4660         1.1%        128.139.225.244
   1379400        4598         1.0%         157.240.253.63

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total                          Dst IP
-------------------------------------------------------------------
  541616100     1805387       411.6%                  132.76.150.110
    5157600       17192         3.9%             2001:a98:1e:ff::116
    5101800       17006         3.9%                   132.74.74.134
    4656300       15521         3.5%                 128.139.225.244
    4627200       15424         3.5%   2001:1470:ff94:d:153:5:68:163
    4514700       15049         3.4%                    192.114.52.7
    3809100       12697         2.9%             2001:a98:1e:ff::115
    2932500        9775         2.2%                   128.139.200.4
    2494200        8314         1.9%                  142.251.209.27
    2184300        7281         1.7%                   162.125.69.14

Top-10 Possible Targets by Bytes:
                Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------
                                    132.76.150.110               698379357900
                                    132.76.150.110               398813457600
                                    132.76.150.110               398742084300
                                    132.76.150.110         80    299411873700
                               53   132.76.150.110               299262347400
  2001:bf8:900:d:2::71       8443                                 22368559800
  2001:bf8:900:d:2::71                                            22368559800
         132.73.124.47                                             9662051100
         132.73.124.47                                    443      9661966200
  2001:bf8:900:d:2::71                                  47168      7713904200

Metric Info:
4M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-24 22:12:29
End Time: ongoing

First Event Seen: 2025-08-24 22:10:00
Last Event Seen: 2025-08-24 22:11:00

Further Details:
https://primary.nemo.geant.org/alerts/details/382963/