[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #383048 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, August 26, 2025 1:18:46 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #383048 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 383048

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  43919700      146399        21.7%     52.222.136.15
  11778600       39262         5.8%    52.222.136.125
   9541500       31805         4.7%     132.73.124.47
   8186700       27289         4.0%     52.222.136.65
   4043400       13478         2.0%   142.250.179.202
   3791400       12638         1.9%    52.222.136.124
   2294700        7649         1.1%     216.58.206.59
   2264400        7548         1.1%     216.58.206.91
   2253600        7512         1.1%     132.74.112.76
   2249400        7498         1.1%    157.240.252.63

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  72984300      243281        36.0%     132.70.60.180
   7108500       23695         3.5%   128.139.225.244
   5981700       19939         3.0%   192.114.101.113
   4201500       14005         2.1%     132.74.74.134
   3126300       10421         1.5%      132.64.244.4
   2622000        8740         1.3%    142.251.209.42
   2498400        8328         1.2%     128.139.200.5
   2438700        8129         1.2%     132.73.124.47
   2384400        7948         1.2%     128.139.200.4
   2295300        7651         1.1%     192.114.52.13

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                        443   132.70.60.180               107620725000
                              132.70.60.180               107620725000
   52.222.136.15        443                                64955537400
   52.222.136.15                                           64955537400
  52.222.136.125        443                                17414979000
  52.222.136.125                                           17414979000
   132.73.124.47                                           13558826400
   132.73.124.47                                   443     13558795200
   52.222.136.65        443                                12109555200
   52.222.136.65                                           12109555200

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-25 22:18:37
End Time: ongoing

First Event Seen: 2025-08-25 22:16:00
Last Event Seen: 2025-08-25 22:17:00

Further Details:
https://primary.nemo.geant.org/alerts/details/383048/