[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377438 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, July 10, 2025 8:17:07 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377438 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377438

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  63990900      213303        11.6%           5.39.217.109
  61802400      206008        11.2%           31.172.80.90
  42430800      141436         7.7%         195.160.220.89
  30678000      102260         5.6%          84.238.133.38
  30466500      101555         5.5%          185.204.52.33
  24328800       81096         4.4%            132.70.19.4
  19175100       63917         3.5%           43.250.53.25
  18531900       61773         3.4%          84.238.133.19
  17338500       57795         3.1%         185.244.128.79
  17280000       57600         3.1%   2001:bf8:900:d:2::71

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                      Dst IP
--------------------------------------------------------------
  24328800       81096         4.4%               20.209.177.33
  11840400       39468         2.2%                 132.70.19.4
  10141500       33805         1.8%             128.139.225.244
   9133800       30446         1.7%               132.66.253.21
   7692600       25642         1.4%              132.74.209.204
   7231500       24105         1.3%   2001:760:422a:137::201:67
   7044300       23481         1.3%   2001:760:422a:137::201:64
   6009000       20030         1.1%             142.250.180.138
   5634600       18782         1.0%               128.139.200.5
   5035800       16786         0.9%               128.139.200.4

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
           132.70.19.4                                     443     35986880400
           132.70.19.4                                             35986880400
                                      20.209.177.33        443     35986880400
                                      20.209.177.33                35986880400
  2001:bf8:900:d:2::71       8443                                  25737478800
  2001:bf8:900:d:2::71                                             25737478800
                                    128.139.225.244                11825559600
                              443    132.74.209.204                11352722100
                                     132.74.209.204                11352722100
                              443   128.139.225.244                11010679200

Metric Info:
3M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-10 17:16:53
End Time: ongoing

First Event Seen: 2025-07-10 17:14:00
Last Event Seen: 2025-07-10 17:15:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377438/