[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #379067 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, July 28, 2025 4:17:18 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #379067 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 379067

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  82704000      275680        32.9%    89.248.163.224
  48345600      161152        19.2%    89.248.163.213
   9325800       31086         3.7%   142.250.180.170
   7033500       23445         2.8%     192.114.3.241
   5137500       17125         2.0%     132.73.124.48
   4477200       14924         1.8%    172.217.19.138
   3742500       12475         1.5%     82.77.160.177
   2681700        8939         1.1%     132.77.49.181
   2583300        8611         1.0%   142.250.179.138
   2397900        7993         1.0%       132.70.19.4

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  17067000       56890         6.8%     192.114.3.241
  10657200       35524         4.2%      128.139.35.5
   7253100       24177         2.9%     162.125.69.14
   3916200       13054         1.6%     132.74.74.134
   3244800       10816         1.3%     13.107.138.10
   2931000        9770         1.2%     162.125.69.12
   2548800        8496         1.0%   142.250.180.170
   2397900        7993         1.0%     20.209.177.33
   2238300        7461         0.9%   128.139.225.244
   2153400        7178         0.9%     132.68.49.166

Top-10 Possible Targets by Bytes:
           Src IP   Src Port          Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                               192.114.3.241                20780436600
                         443   192.114.3.241                20774865000
                                128.139.35.5                14955695700
                                128.139.35.5         53     14955370200
  142.250.180.170        443                                13346244600
  142.250.180.170                                           13346244600
                               162.125.69.14        443     10703957100
                               162.125.69.14                10703957100
    132.73.124.48                                            7493776200
    132.73.124.48                                   443      7493622000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-28 01:17:07
End Time: ongoing

First Event Seen: 2025-07-28 01:14:00
Last Event Seen: 2025-07-28 01:15:00

Further Details:
https://primary.nemo.geant.org/alerts/details/379067/