[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #378522 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 22, 2025 2:48:01 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #378522 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 378522

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  43467600      144892        14.6%           23.41.187.24
  38405700      128019        12.9%           23.41.187.16
  17650500       58835         5.9%          132.73.124.68
   8698200       28994         2.9%           34.149.152.8
   6770700       22569         2.3%           23.41.187.15
   6136500       20455         2.1%           23.41.187.22
   4676100       15587         1.6%   2001:bf8:900:d:2::71
   4297800       14326         1.4%          192.114.3.241
   4166100       13887         1.4%            132.70.19.4
   4115400       13718         1.4%         216.58.204.138

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  58285500      194285        19.5%     132.73.124.68
  11703600       39012         3.9%      23.41.187.24
  10612500       35375         3.6%      34.149.152.8
  10319700       34399         3.5%      23.41.187.16
  10101900       33673         3.4%     132.73.124.96
   7887900       26293         2.6%     132.73.124.40
   7047900       23493         2.4%     132.73.124.48
   6270000       20900         2.1%   128.139.225.244
   5740500       19135         1.9%      132.73.124.8
   4667400       15558         1.6%     132.70.60.180

Top-10 Possible Targets by Bytes:
        Src IP   Src Port          Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
                            132.73.124.68                86924682300
                      443   132.73.124.68                86895292500
  23.41.187.24                                           64900083000
  23.41.187.24        443                                64612214400
  23.41.187.16        443                                57373608900
  23.41.187.16                                           57373608900
                            132.73.124.96                13775883000
                      443   132.73.124.96                13775871000
                            132.73.124.40                11413165500
  34.149.152.8        443                                10778761200

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-21 23:47:55
End Time: ongoing

First Event Seen: 2025-07-21 23:45:00
Last Event Seen: 2025-07-21 23:46:00

Further Details:
https://primary.nemo.geant.org/alerts/details/378522/