[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #383322 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, August 28, 2025 2:53:18 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #383322 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 383322

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  8169000       27230         4.7%      132.76.61.52
  5641500       18805         3.2%    216.58.204.129
  4458300       14861         2.5%   142.250.180.129
  4349100       14497         2.5%    157.240.252.63
  3986400       13288         2.3%      132.64.86.14
  3493200       11644         2.0%     13.107.138.10
  3132000       10440         1.8%   142.250.180.170
  3051900       10173         1.7%      132.76.61.54
  2745600        9152         1.6%    157.240.253.63
  2640300        8801         1.5%      52.84.151.48

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
  7452600       24842         4.2%   216.58.204.234
  5610300       18701         3.2%    128.139.18.77
  5076300       16921         2.9%    216.58.209.46
  4638300       15461         2.6%    13.107.138.10
  4609500       15365         2.6%    13.107.136.10
  4436400       14788         2.5%     132.68.29.79
  4431600       14772         2.5%   132.66.231.131
  4084800       13616         2.3%    128.139.200.5
  3620100       12067         2.1%   132.64.245.183
  3468600       11562         2.0%   142.251.209.10

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
    132.76.61.52                                             9788592000
    132.76.61.52                                    443      9788117400
                              216.58.204.234        443      9259057800
                              216.58.204.234                 9259057800
  216.58.204.129        443                                  7401110700
  216.58.204.129                                             7401110700
                        443    128.139.18.77                 7368505800
                               128.139.18.77                 7368505800
                        443   132.66.231.131                 6542775600
                              132.66.231.131                 6542775600

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-28 11:47:33
End Time: ongoing

First Event Seen: 2025-08-28 11:45:00
Last Event Seen: 2025-08-28 11:50:00

Further Details:
https://primary.nemo.geant.org/alerts/details/383322/