[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377924 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, July 16, 2025 5:12:02 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377924 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377924

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  27111600       90372         6.2%   95.101.122.138
  21130200       70434         4.8%   95.101.122.152
  11920800       39736         2.7%    162.125.69.15
   9587100       31957         2.2%   142.250.201.33
   7324500       24415         1.7%    132.73.124.72
   5738400       19128         1.3%    34.104.35.123
   5211300       17371         1.2%     132.73.124.8
   4887600       16292         1.1%     184.25.54.62
   4870800       16236         1.1%   157.240.252.63
   4809300       16031         1.1%     132.76.61.51

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  16824000       56080         3.9%      132.76.61.52
  14590800       48636         3.3%    95.101.122.138
  11299200       37664         2.6%    95.101.122.152
  10901400       36338         2.5%   128.139.225.244
  10239600       34132         2.3%      132.73.124.8
   9819900       32733         2.3%     162.125.69.18
   9586200       31954         2.2%    132.64.193.164
   9467100       31557         2.2%       132.66.79.8
   9070200       30234         2.1%     132.73.124.72
   7814100       26047         1.8%     128.139.200.5

Top-10 Possible Targets by Bytes:
          Src IP   Src Port         Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
  95.101.122.138        443                               40365610500
  95.101.122.138                                          40365610500
  95.101.122.152        443                               31563115200
  95.101.122.152                                          31563115200
                              132.76.61.52                22953726000
                        443   132.76.61.52                22573455900
   162.125.69.15        443                               14330308200
   162.125.69.15                                61477     14330308200
   162.125.69.15                                          14330308200
                              132.76.61.52      61477     14330308200

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-16 14:11:51
End Time: ongoing

First Event Seen: 2025-07-16 14:09:00
Last Event Seen: 2025-07-16 14:10:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377924/