[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377500 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, July 11, 2025 12:04:08 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377500 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377500

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  50043300      166811        17.6%         185.187.241.27
  48044400      160148        16.9%            153.92.6.11
  33107400      110358        11.7%          89.248.163.61
   6258900       20863         2.2%            31.13.84.52
   4740600       15802         1.7%   2001:bf8:900:d:2::71
   4562100       15207         1.6%        142.250.179.170
   4242900       14143         1.5%          132.73.124.48
   4209900       14033         1.5%          54.231.163.65
   4177200       13924         1.5%               3.5.9.19
   4175700       13919         1.5%         52.217.129.241

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  98090100      326967        34.6%      192.115.64.1
   9759300       32531         3.4%   128.139.225.244
   4784700       15949         1.7%     132.75.113.79
   4672800       15576         1.6%     132.74.74.134
   4226700       14089         1.5%     128.139.200.4
   4210200       14034         1.5%     132.75.113.80
   4177200       13924         1.5%    132.75.113.141
   4158300       13861         1.5%     162.125.69.14
   3767700       12559         1.3%     128.139.200.5
   3570600       11902         1.3%    192.114.23.237

Top-10 Possible Targets by Bytes:
          Src IP   Src Port         Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                              192.115.64.1               140908542900
                              192.115.64.1               128577426600
                              192.115.64.1               128577416400
  185.187.241.27                                          74938714800
  185.187.241.27                                          73389814800
  185.187.241.27                                          73389814800
     153.92.6.11                                          65969601600
     153.92.6.11                                          55187601600
     153.92.6.11                                          55187601600
                              192.115.64.1         53     12330900000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-11 09:03:55
End Time: ongoing

First Event Seen: 2025-07-11 09:01:00
Last Event Seen: 2025-07-11 09:02:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377500/