[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377448 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, July 10, 2025 11:22:15 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377448 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377448

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  148480200      494934        20.5%     5.39.217.109
  107752500      359175        14.9%   195.160.220.89
   77650800      258836        10.7%     31.172.80.90
   61695300      205651         8.5%     43.250.53.25
   44063100      146877         6.1%      85.17.90.43
   41917200      139724         5.8%    84.238.133.38
   36478800      121596         5.0%    84.238.133.19
   32527500      108425         4.5%   185.244.128.79
   32035800      106786         4.4%    185.204.52.33
    9104700       30349         1.3%     91.92.144.79

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  7905600       26352         1.1%   128.139.225.244
  7556100       25187         1.0%     20.209.177.33
  3598500       11995         0.5%     162.125.69.14
  3515100       11717         0.5%     132.74.74.134
  3496200       11654         0.5%     128.139.200.4
  3419400       11398         0.5%     132.75.113.79
  3129000       10430         0.4%       132.70.19.4
  2820000        9400         0.4%    192.114.91.226
  2747100        9157         0.4%     128.139.200.5
  2575500        8585         0.4%     128.139.199.5

Top-10 Possible Targets by Bytes:
        Src IP   Src Port            Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
   132.70.19.4                                     443     11126283000
   132.70.19.4                                             11126283000
                              20.209.177.33        443     11126283000
                              20.209.177.33                11126283000
                            128.139.225.244                 9009795300
  5.39.217.109                                              6533128800
                      443   128.139.225.244                 6482770500
   31.13.84.52        443                                   6386433600
   31.13.84.52                                              6386433600
                              162.125.69.14        443      5299382700

Metric Info:
4M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-10 20:22:01
End Time: ongoing

First Event Seen: 2025-07-10 20:19:00
Last Event Seen: 2025-07-10 20:20:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377448/