[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377570 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 12, 2025 1:01:05 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377570 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377570

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  30038100      100127        16.5%   2001:bf8:900:d:2::71
  13868100       46227         7.6%          132.248.26.32
   8167200       27224         4.5%            31.13.84.52
   6759000       22530         3.7%        216.218.240.254
   3047700       10159         1.7%         142.251.39.106
   2599200        8664         1.4%        149.165.224.209
   2393700        7979         1.3%              3.5.129.2
   2035800        6786         1.1%          104.243.38.74
   2025300        6751         1.1%          192.114.3.241
   1900500        6335         1.0%        128.139.225.244

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total                      Dst IP
---------------------------------------------------------------
  177906000      593020        97.5%               132.72.118.41
    9673800       32246         5.3%             128.139.225.244
    6670200       22234         3.7%             192.114.101.113
    4129500       13765         2.3%               132.74.74.134
    3949500       13165         2.2%               128.139.200.5
    3807300       12691         2.1%           2001:760:4228::40
    3484800       11616         1.9%               132.76.214.73
    3364500       11215         1.8%               128.139.200.4
    3246900       10823         1.8%          2001:760:4228::215
    3010200       10034         1.7%   2001:760:4205:128::130:70

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
                                      132.72.118.41               144405112200
                                      132.72.118.41                83635551900
                                      132.72.118.41                83605536300
                                      132.72.118.41        443     58950876300
                               53     132.72.118.41                56825327700
  2001:bf8:900:d:2::71       8443                                  45013290600
  2001:bf8:900:d:2::71                                             45013290600
           31.13.84.52        443                                  10031182500
           31.13.84.52                                             10031182500
                                    192.114.101.113                 9961038000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-12 10:00:54
End Time: ongoing

First Event Seen: 2025-07-12 09:58:00
Last Event Seen: 2025-07-12 09:59:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377570/