[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #378632 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, July 23, 2025 5:17:15 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #378632 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 378632

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  43604700      145349         9.7%    23.41.187.15
  27957900       93193         6.2%    23.41.187.24
  18942900       63143         4.2%    23.41.187.22
  17176800       57256         3.8%    23.41.187.16
  15617100       52057         3.5%   162.125.69.14
  14066400       46888         3.1%    23.41.187.17
   9951600       33172         2.2%   35.226.27.221
   8983200       29944         2.0%     23.41.187.7
   6752700       22509         1.5%    132.73.124.8
   6258900       20863         1.4%   132.73.124.72

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  18898200       62994         4.2%      23.41.187.15
  17795100       59317         4.0%     132.73.124.72
  17679900       58933         3.9%      132.73.124.8
  15385500       51285         3.4%    132.72.136.217
  12981300       43271         2.9%     132.73.124.96
  11532300       38441         2.6%     132.73.124.88
  11247900       37493         2.5%   128.139.225.244
  10499400       34998         2.3%     192.114.3.241
   9629400       32098         2.1%      23.41.187.24
   9368400       31228         2.1%     132.73.124.32

Top-10 Possible Targets by Bytes:
        Src IP   Src Port          Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
  23.41.187.15                                           65162178600
  23.41.187.15        443                                65160919500
  23.41.187.24        443                                41599224000
  23.41.187.24                                           41599224000
  23.41.187.22        443                                28341191700
  23.41.187.22                                           28341191700
                             132.73.124.8                25851448200
                            132.73.124.72                25829304300
                      443    132.73.124.8                25828874700
                      443   132.73.124.72                25789311300

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-23 14:17:07
End Time: ongoing

First Event Seen: 2025-07-23 14:14:00
Last Event Seen: 2025-07-23 14:15:00

Further Details:
https://primary.nemo.geant.org/alerts/details/378632/