[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #391717 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, November 1, 2025 12:14:26 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #391717 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 391717

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  8989200       29964         6.0%   134.209.239.127
  6467700       21559         4.3%     132.73.124.72
  6144600       20482         4.1%      132.73.124.8
  6097200       20324         4.1%    194.180.48.220
  5163600       17212         3.5%     132.73.124.48
  4776900       15923         3.2%     132.73.124.68
  3954900       13183         2.7%       132.70.19.4
  3520800       11736         2.4%     192.114.3.241
  2865000        9550         1.9%    132.73.124.216
  2684400        8948         1.8%    132.73.124.236

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  20148000       67160        13.5%       23.41.187.5
  17779200       59264        11.9%      23.41.187.31
  12710100       42367         8.5%      23.41.187.27
   6612900       22043         4.4%   128.139.225.245
   5104500       17015         3.4%      23.41.187.30
   3954900       13183         2.7%     20.209.177.33
   3875100       12917         2.6%     128.139.200.4
   3545700       11819         2.4%     132.65.128.88
   3342600       11142         2.2%     13.107.138.10
   3337500       11125         2.2%     128.139.200.5

Top-10 Possible Targets by Bytes:
       Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                           128.139.225.245                 8130389700
                     443   128.139.225.245                 6593361900
  132.70.19.4                                     443      5788258200
  132.70.19.4                                              5788258200
                             20.209.177.33        443      5788258200
                             20.209.177.33                 5788258200
                             128.139.200.4                 5122633200
                     443     128.139.200.4                 5118887700
                             13.107.138.10                 4866512100
                             13.107.138.10        443      4866491700

Metric Info:
881k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-11-01 10:14:15
End Time: ongoing

First Event Seen: 2025-11-01 10:12:00
Last Event Seen: 2025-11-01 10:13:00

Further Details:
https://primary.nemo.geant.org/alerts/details/391717/