[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377460 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, July 11, 2025 1:38:22 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377460 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377460

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total                 Src IP
----------------------------------------------------------
  107042700      356809        16.6%            85.17.90.43
   88099500      293665        13.7%           31.172.80.90
   60763500      202545         9.4%           43.250.53.25
   44144400      147148         6.9%           5.39.217.109
   39796200      132654         6.2%         185.244.128.79
   28026900       93423         4.3%          185.204.52.33
   27629100       92097         4.3%          84.238.133.19
   25443900       84813         3.9%          84.238.133.38
   22976100       76587         3.6%         195.160.220.89
   11360700       37869         1.8%   2001:bf8:900:d:2::71

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                          Dst IP
------------------------------------------------------------------
  10045800       33486         1.6%                 128.139.225.244
   9362400       31208         1.5%                   20.209.177.33
   8816400       29388         1.4%                 192.114.101.113
   5987100       19957         0.9%                   162.125.69.14
   4878300       16261         0.8%                   132.74.74.134
   4657800       15526         0.7%                 142.250.180.170
   4207500       14025         0.7%                   132.74.73.110
   3924600       13082         0.6%                     132.70.19.4
   3779700       12599         0.6%   2001:1470:ff94:d:153:5:68:164
   3700800       12336         0.6%                   128.139.200.4

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
  2001:bf8:900:d:2::71       8443                                  16983580200
  2001:bf8:900:d:2::71                                             16983580200
           132.70.19.4                                     443     13789559100
           132.70.19.4                                             13789559100
                                      20.209.177.33        443     13789559100
                                      20.209.177.33                13789559100
                                    192.114.101.113                13169074800
                                    128.139.225.244                10538563500
                              443   128.139.225.244                 9339286500
           31.13.84.52        443                                   9006182700

Metric Info:
3M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-10 22:33:56
End Time: ongoing

First Event Seen: 2025-07-10 22:31:00
Last Event Seen: 2025-07-10 22:36:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377460/