[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377925 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, July 16, 2025 5:15:02 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377925 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377925

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  40466100      134887         8.4%   95.101.122.138
  30212400      100708         6.3%   95.101.122.152
  14302200       47674         3.0%    162.125.69.15
   9314400       31048         1.9%    132.73.124.72
   7544700       25149         1.6%     132.73.124.8
   6939000       23130         1.4%    34.104.35.123
   6386700       21289         1.3%     132.76.61.51
   6274200       20914         1.3%     184.25.54.62
   6191400       20638         1.3%   95.101.122.114
   5417100       18057         1.1%    95.101.122.91

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  20551800       68506         4.3%   95.101.122.138
  19541700       65139         4.0%     132.76.61.52
  15413100       51377         3.2%   95.101.122.152
  15307200       51024         3.2%     132.73.124.8
  13087500       43625         2.7%    132.73.124.72
  11393400       37978         2.4%    162.125.69.18
   9467100       31557         2.0%      132.66.79.8
   9312300       31041         1.9%    132.73.124.32
   8942100       29807         1.9%    128.139.200.5
   8695200       28984         1.8%    128.139.200.4

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
  95.101.122.138        443                                60322468500
  95.101.122.138                                           60322468500
  95.101.122.152        443                                45146142300
  95.101.122.152                                           45146142300
                               132.76.61.52                26730434100
                        443    132.76.61.52                26349543300
                               132.73.124.8                21970147500
                        443    132.73.124.8                21969873600
                              132.73.124.72                18162340200
                        443   132.73.124.72                18160542900

Metric Info:
2M ACK Packets/s

Alert Type:
time_window

Alert Description:
High ACK packet rate

Start Time: 2025-07-16 14:11:52
End Time: ongoing

First Event Seen: 2025-07-16 14:09:00
Last Event Seen: 2025-07-16 14:13:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377925/