[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #378774 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, July 25, 2025 12:35:27 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #378774 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 378774

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total                 Src IP
--------------------------------------------------------
  9549300       31831         2.9%   2001:bf8:900:d:2::71
  3043200       10144         0.9%         185.242.226.44
  2786400        9288         0.8%          132.73.124.48
  2383500        7945         0.7%         157.240.252.63
  2272200        7574         0.7%         101.100.160.82
  2092800        6976         0.6%          104.83.87.197
  2001600        6672         0.6%         157.240.251.63
  1903200        6344         0.6%          89.160.226.76
  1894500        6315         0.6%         157.240.253.63
  1767000        5890         0.5%        142.250.180.138

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total                       Dst IP
----------------------------------------------------------------
  778946100     2596487       236.0%                 128.139.35.5
    5400900       18003         1.6%              128.139.225.244
    3211500       10705         1.0%                128.139.200.4
    3097500       10325         0.9%                162.125.69.14
    2974200        9914         0.9%    2001:760:4205:128::130:72
    2957700        9859         0.9%               132.64.186.144
    2814300        9381         0.9%    2001:760:4205:128::130:70
    2732400        9108         0.8%               132.73.124.193
    2693100        8977         0.8%                128.139.200.5
    2377800        7926         0.7%   2001:760:4205:128::129:203

Top-10 Possible Targets by Bytes:
                Src IP   Src Port                      Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------------------------
                                                 128.139.35.5              1130709480000
                                                 128.139.35.5         53   1130708446200
  2001:bf8:900:d:2::71       8443                                            14312798100
  2001:bf8:900:d:2::71                                                       14312798100
                                              128.139.225.244                 4872103800
                                                162.125.69.14        443      4530803100
                                                162.125.69.14                 4530803100
                             8443   2001:760:4205:128::130:72                 4457208600
                                    2001:760:4205:128::130:72                 4457208600
                              443             128.139.225.244                 4386589200

Metric Info:
3M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-25 09:35:06
End Time: ongoing

First Event Seen: 2025-07-25 09:32:00
Last Event Seen: 2025-07-25 09:33:00

Further Details:
https://primary.nemo.geant.org/alerts/details/378774/