[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #383684 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, August 31, 2025 6:43:39 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #383684 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 383684

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  13400100       44667         9.1%     52.222.136.65
  12855000       42850         8.7%    52.222.136.124
  12357900       41193         8.4%     52.222.136.15
   9417600       31392         6.4%    52.222.136.125
   6248100       20827         4.2%     132.74.112.76
   5572500       18575         3.8%       132.70.19.4
   4451100       14837         3.0%     192.114.3.241
   3030000       10100         2.1%     104.83.83.214
   2936400        9788         2.0%   149.165.224.218
   2838300        9461         1.9%   142.250.180.138

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  48033300      160111        32.6%     132.70.60.180
   6781500       22605         4.6%   142.250.180.138
   5572500       18575         3.8%     20.209.177.33
   5391300       17971         3.7%     192.114.3.241
   2936400        9788         2.0%   192.114.101.113
   2696100        8987         1.8%     172.217.19.42
   2521200        8404         1.7%     132.71.89.209
   2283900        7613         1.6%       132.70.19.4
   1885200        6284         1.3%     132.74.112.76
   1868400        6228         1.3%   128.139.225.244

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                        443   132.70.60.180                71042483700
                              132.70.60.180                71042483700
   52.222.136.65        443                                19815646800
   52.222.136.65                                           19815646800
  52.222.136.124        443                                19013921400
  52.222.136.124                                           19013921400
   52.222.136.15        443                                18280427400
   52.222.136.15                                           18280427400
  52.222.136.125        443                                13928773800
  52.222.136.125                                           13928773800

Metric Info:
908k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-31 03:43:33
End Time: ongoing

First Event Seen: 2025-08-31 03:41:00
Last Event Seen: 2025-08-31 03:42:00

Further Details:
https://primary.nemo.geant.org/alerts/details/383684/