[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #204238 CRIT: IUCC (AS378) - [IUCC] [Email_Analysis] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, May 3, 2025 6:14:55 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #204238 CRIT: IUCC (AS378) - [IUCC] [Email_Analysis] [Customer]

Please find the analysis details for the Alert ID: 204238

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                     Src IP
-------------------------------------------------------------
  52400700      174669        11.4%   2a00:1450:4002:415::201b
  51502500      171675        11.2%   2a00:1450:4002:414::201b
  49142400      163808        10.7%   2a00:1450:4002:411::201b
  45433800      151446         9.9%   2a00:1450:4002:416::201b
   7689000       25630         1.7%               172.66.0.218
   7057500       23525         1.5%              216.58.205.59
   5690400       18968         1.2%             216.58.204.138
   5660700       18869         1.2%             216.58.204.155
   5610900       18703         1.2%               3.164.182.30
   5392500       17975         1.2%              216.58.205.42

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  16849200       56164         3.7%    2001:bf8:900:d:1::a
  15241500       50805         3.3%   2001:bf8:900:d:1::14
  14656500       48855         3.2%   2001:bf8:900:d:1::11
  13550100       45167         3.0%         192.114.101.36
  13381500       44605         2.9%   2001:bf8:900:d:1::1d
  12774000       42580         2.8%   2001:bf8:900:d:1::1f
  12577500       41925         2.7%         192.114.101.27
  12085500       40285         2.6%   2001:bf8:900:d:1::f5
  11880600       39602         2.6%   2001:bf8:900:d:1::1a
  11799300       39331         2.6%   2001:bf8:900:d:1::2d

Top-10 Possible Targets by Bytes:
                    Src IP   Src Port                Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------------------------
  2a00:1450:4002:415::201b        443                                      66600009900
  2a00:1450:4002:415::201b                                                 66600009900
  2a00:1450:4002:414::201b        443                                      65395351800
  2a00:1450:4002:414::201b                                                 65395351800
  2a00:1450:4002:411::201b        443                                      62478934800
  2a00:1450:4002:411::201b                                                 62478934800
  2a00:1450:4002:416::201b        443                                      57681919200
  2a00:1450:4002:416::201b                                                 57681919200
                                  443   2001:bf8:900:d:1::a                21406556700
                                        2001:bf8:900:d:1::a                21406556700

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-05-03 15:10:44
End Time: ongoing

First Event Seen: 2025-05-03 15:07:00
Last Event Seen: 2025-05-03 15:13:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/204238/