[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #383453 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, August 29, 2025 12:13:55 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #383453 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 383453

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  69279900      230933        18.2%    142.251.209.46
  35308800      117696         9.3%    216.58.204.142
   9361200       31204         2.5%     132.73.124.68
   8612700       28709         2.3%     132.73.124.72
   8271600       27572         2.2%   149.165.224.209
   8191800       27306         2.2%   149.165.224.208
   7728300       25761         2.0%      132.73.124.8
   6956100       23187         1.8%     132.73.124.32
   5887200       19624         1.5%       132.70.19.4
   5706600       19022         1.5%   149.165.224.212

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  59864700      199549        15.7%    142.251.209.46
  37497900      124993         9.9%   192.114.101.113
  31692900      105643         8.3%    216.58.204.142
  12113100       40377         3.2%     132.73.124.68
  10463400       34878         2.8%     132.73.124.72
   9406200       31354         2.5%      132.73.124.8
   7020900       23403         1.8%     132.73.124.48
   6892800       22976         1.8%     132.73.124.32
   6280200       20934         1.7%   128.139.225.244
   5960700       19869         1.6%    132.73.124.152

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
  142.251.209.46                                            100216520400
  142.251.209.46        443                                 100216484400
                              192.114.101.113                56224408800
  216.58.204.142        443                                  50854773300
  216.58.204.142                                             50854773300
                                132.73.124.68                17274144600
                        443     132.73.124.68                17017931400
                                132.73.124.72                13858075500
                        443     132.73.124.72                13789901700
                                 132.73.124.8                12448911600

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-29 09:09:38
End Time: ongoing

First Event Seen: 2025-08-29 09:07:00
Last Event Seen: 2025-08-29 09:12:00

Further Details:
https://primary.nemo.geant.org/alerts/details/383453/