[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377810 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, July 14, 2025 10:40:01 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377810 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377810

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  46784400      155948         8.6%     153.92.220.99
  46718400      155728         8.6%    194.163.35.142
  28735800       95786         5.3%    82.180.152.142
  28626900       95423         5.3%    185.187.241.27
  28493100       94977         5.3%    31.220.106.167
  28328100       94427         5.2%       153.92.6.11
  27777900       92593         5.1%    82.180.138.129
  27040800       90136         5.0%     217.21.84.235
  19918200       66394         3.7%   142.250.180.138
  18962100       63207         3.5%    195.179.239.29

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  281468100      938227        51.9%      192.115.64.1
   22874700       76249         4.2%     132.65.180.33
   21658200       72194         4.0%    128.139.19.218
   15357300       51191         2.8%     132.65.180.36
   14398800       47996         2.7%   128.139.225.244
   10533000       35110         1.9%     132.65.180.32
   10162800       33876         1.9%     132.65.180.37
    9828300       32761         1.8%     132.65.180.31
    8474700       28249         1.6%     132.66.253.21
    4787700       15959         0.9%   142.250.180.138

Top-10 Possible Targets by Bytes:
          Src IP   Src Port         Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                              192.115.64.1               390680683500
                              192.115.64.1               326439567900
                              192.115.64.1               326439542700
   153.92.220.99                                          68178532500
                              192.115.64.1         53     64241100000
   153.92.220.99                                          61944232500
   153.92.220.99                                          61944232500
  194.163.35.142                                          60316438500
  194.163.35.142                                          47081488500
  194.163.35.142                                          47081488500

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-14 19:39:53
End Time: ongoing

First Event Seen: 2025-07-14 19:37:00
Last Event Seen: 2025-07-14 19:38:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377810/