[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #379161 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 29, 2025 4:10:17 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #379161 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 379161

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  31248300      104161        12.0%      23.41.187.30
  30000000      100000        11.5%      23.41.187.27
  11336700       37789         4.4%    95.100.181.133
  11170500       37235         4.3%    95.100.181.139
   9588900       31963         3.7%     216.58.205.42
   8426400       28088         3.2%    142.251.209.42
   6883800       22946         2.6%     132.73.124.72
   6288300       20961         2.4%   142.250.180.170
   4425900       14753         1.7%    132.73.124.152
   3588900       11963         1.4%     82.77.160.177

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  16404900       54683         6.3%     23.41.187.30
  15579600       51932         6.0%     23.41.187.27
  13392000       44640         5.2%    132.73.124.72
   9857700       32859         3.8%    132.74.56.132
   8675400       28918         3.3%     128.139.35.5
   8296800       27656         3.2%   128.139.18.102
   7306200       24354         2.8%   132.73.124.152
   6931500       23105         2.7%    132.74.56.157
   6840600       22802         2.6%     132.73.124.8
   6595800       21986         2.5%    132.73.124.48

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
    23.41.187.30                                           46827667200
    23.41.187.30        443                                46826408100
    23.41.187.27                                           44943842400
    23.41.187.27        443                                44628845400
                              132.73.124.72                19728572100
                        443   132.73.124.72                19715941500
  95.100.181.133                                           16989182100
  95.100.181.133        443                                16982297700
  95.100.181.139                                           16726056900
  95.100.181.139        443                                16719436200

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-07-29 01:10:11
End Time: ongoing

First Event Seen: 2025-07-29 01:07:00
Last Event Seen: 2025-07-29 01:08:00

Further Details:
https://primary.nemo.geant.org/alerts/details/379161/