[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #383322 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, August 28, 2025 2:48:05 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #383322 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 383322

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  3660000       12200         3.4%      132.76.61.52
  3162300       10541         3.0%    216.58.204.129
  2895300        9651         2.7%    157.240.252.63
  2839800        9466         2.7%   142.250.180.129
  2819100        9397         2.7%      132.64.86.14
  2301900        7673         2.2%     13.107.138.10
  2157900        7193         2.0%   142.250.180.170
  1761600        5872         1.7%     52.98.242.226
  1742100        5807         1.6%    157.240.253.63
  1599900        5333         1.5%     34.104.35.123

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
  3475500       11585         3.3%    216.58.209.46
  3356700       11189         3.2%   216.58.204.234
  3144300       10481         3.0%    128.139.18.77
  3084000       10280         2.9%    13.107.136.10
  2828100        9427         2.7%     132.68.29.79
  2793900        9313         2.6%   132.66.231.131
  2776800        9256         2.6%    128.139.200.5
  2115000        7050         2.0%   132.64.245.183
  2054700        6849         1.9%    192.114.3.241
  2044800        6816         1.9%    128.139.200.4

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
    132.76.61.52                                             4630948200
    132.76.61.52                                    443      4630814400
                              216.58.204.234        443      4362130800
                              216.58.204.234                 4362130800
                               216.58.209.46                 4310647500
                               216.58.209.46        443      4310601900
                               13.107.136.10        443      4242313200
                               13.107.136.10                 4242313200
  216.58.204.129        443                                  4193084400
  216.58.204.129                                             4193084400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-28 11:47:33
End Time: ongoing

First Event Seen: 2025-08-28 11:45:00
Last Event Seen: 2025-08-28 11:46:00

Further Details:
https://primary.nemo.geant.org/alerts/details/383322/