[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #383453 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, August 29, 2025 12:09:52 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #383453 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 383453

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  48189900      160633        16.5%    142.251.209.46
  24854700       82849         8.5%    216.58.204.142
   6819600       22732         2.3%     132.73.124.68
   6590700       21969         2.3%   149.165.224.208
   6567300       21891         2.3%   149.165.224.209
   5956200       19854         2.0%     132.73.124.72
   5591400       18638         1.9%      132.73.124.8
   5278200       17594         1.8%       132.70.19.4
   4825500       16085         1.7%   149.165.224.212
   4625700       15419         1.6%     142.251.36.10

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  41698200      138994        14.3%    142.251.209.46
  31541700      105139        10.8%   192.114.101.113
  21575400       71918         7.4%    216.58.204.142
   8794800       29316         3.0%     132.73.124.68
   7282800       24276         2.5%     132.73.124.72
   7087500       23625         2.4%      132.73.124.8
   5278200       17594         1.8%     20.209.177.33
   5251500       17505         1.8%   128.139.225.244
   4647300       15491         1.6%     132.74.74.134
   4574100       15247         1.6%     132.73.124.48

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
   142.251.209.46                                             69670040700
   142.251.209.46        443                                  69670022700
                               192.114.101.113                47295208800
   216.58.204.142        443                                  35773083600
   216.58.204.142                                             35773083600
                                 132.73.124.68                12453597000
                         443     132.73.124.68                12419302200
  149.165.224.208                                              9882510000
  149.165.224.209                                              9847366800
  149.165.224.209      24618                                   9846016800

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-29 09:09:38
End Time: ongoing

First Event Seen: 2025-08-29 09:07:00
Last Event Seen: 2025-08-29 09:08:00

Further Details:
https://primary.nemo.geant.org/alerts/details/383453/