[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377570 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 12, 2025 1:05:06 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377570 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377570

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  72629700      242099        27.2%   2001:bf8:900:d:2::71
  18651600       62172         7.0%          132.248.26.32
  11323500       37745         4.2%        216.218.240.254
   9584700       31949         3.6%            31.13.84.52
   4049400       13498         1.5%         213.14.166.200
   4004100       13347         1.5%         142.251.39.106
   3379500       11265         1.3%          104.243.38.74
   2999700        9999         1.1%              3.5.129.2
   2676900        8923         1.0%        149.165.224.209
   2676600        8922         1.0%         213.165.91.225

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total                      Dst IP
---------------------------------------------------------------
  264776100      882587        99.2%               132.72.118.41
   11730600       39102         4.4%             128.139.225.244
    9828900       32763         3.7%             192.114.101.113
    5160900       17203         1.9%   2001:760:422a:137::201:63
    5145900       17153         1.9%   2001:760:422a:137::201:68
    5085900       16953         1.9%               132.74.74.134
    4714800       15716         1.8%               128.139.200.5
    4612800       15376         1.7%   2001:760:422a:137::201:21
    4280400       14268         1.6%   2001:760:422a:137::201:82
    4185300       13951         1.6%               132.76.214.73

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
                                      132.72.118.41               212373656700
                                      132.72.118.41               122486847300
                                      132.72.118.41               122442927600
  2001:bf8:900:d:2::71       8443                                 108850871700
  2001:bf8:900:d:2::71                                            108850871700
                                      132.72.118.41        443     87068411400
                               53     132.72.118.41                83912538600
                                    192.114.101.113                14697806400
           31.13.84.52        443                                  11781369000
           31.13.84.52                                             11781369000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-12 10:00:54
End Time: ongoing

First Event Seen: 2025-07-12 09:58:00
Last Event Seen: 2025-07-12 10:03:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377570/