[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377438 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, July 10, 2025 8:21:11 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377438 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377438

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  117612900      392043        13.8%     5.39.217.109
   93389100      311297        11.0%     31.172.80.90
   79770000      265900         9.4%   195.160.220.89
   50642100      168807         5.9%    84.238.133.38
   50305500      167685         5.9%    185.204.52.33
   43600800      145336         5.1%      85.17.90.43
   41384400      137948         4.9%     43.250.53.25
   36864000      122880         4.3%    84.238.133.19
   29118000       97060         3.4%      132.70.19.4
   27518400       91728         3.2%   185.244.128.79

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                      Dst IP
--------------------------------------------------------------
  29118000       97060         3.4%               20.209.177.33
  14151300       47171         1.7%                 132.70.19.4
  12048000       40160         1.4%             128.139.225.244
  10024200       33414         1.2%               132.66.253.21
   9393000       31310         1.1%              132.74.209.204
   8682000       28940         1.0%   2001:760:422a:137::201:67
   8457600       28192         1.0%   2001:760:422a:137::201:64
   6802500       22675         0.8%               128.139.200.5
   6750600       22502         0.8%             142.250.180.138
   5995800       19986         0.7%               128.139.200.4

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
           132.70.19.4                                     443     43072735500
           132.70.19.4                                             43072735500
                                      20.209.177.33        443     43072735500
                                      20.209.177.33                43072735500
  2001:bf8:900:d:2::71       8443                                  32224266000
  2001:bf8:900:d:2::71                                             32224266000
                                    128.139.225.244                13938305700
                              443    132.74.209.204                13859748000
                                     132.74.209.204                13859748000
                              443   128.139.225.244                13000189500

Metric Info:
6M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-10 17:16:53
End Time: ongoing

First Event Seen: 2025-07-10 17:14:00
Last Event Seen: 2025-07-10 17:19:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377438/