[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377448 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, July 10, 2025 11:26:23 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377448 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377448

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  251626200      838754        17.9%     5.39.217.109
  187860600      626202        13.3%   195.160.220.89
  142990200      476634        10.2%     31.172.80.90
  142617300      475391        10.1%     43.250.53.25
  110517000      368390         7.8%      85.17.90.43
   93390600      311302         6.6%    84.238.133.38
   87061200      290204         6.2%    84.238.133.19
   83944500      279815         6.0%    185.204.52.33
   69217800      230726         4.9%   185.244.128.79
   28332300       94441         2.0%     91.92.144.79

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  11875500       39585         0.8%   128.139.225.244
  11684700       38949         0.8%     20.209.177.33
   5466000       18220         0.4%     132.74.74.134
   5284800       17616         0.4%     162.125.69.14
   5173200       17244         0.4%     128.139.200.4
   5125500       17085         0.4%     132.75.113.79
   4766100       15887         0.3%       132.70.19.4
   4468800       14896         0.3%     128.139.200.5
   4114800       13716         0.3%    192.114.91.226
   3800700       12669         0.3%     90.147.160.68

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
           132.70.19.4                                     443     17205531000
           132.70.19.4                                             17205531000
                                      20.209.177.33        443     17205531000
                                      20.209.177.33                17205531000
                                    128.139.225.244                13584831900
          5.39.217.109                                             11071552800
                              443   128.139.225.244                10433183400
           31.13.84.52        443                                   9470157900
           31.13.84.52                                              9470157900
  2001:bf8:900:d:2::71       8443                                   8651827800

Metric Info:
6M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-10 20:22:01
End Time: ongoing

First Event Seen: 2025-07-10 20:19:00
Last Event Seen: 2025-07-10 20:24:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377448/