[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #392780 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, November 6, 2025 11:51:36 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #392780 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 392780

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
  3534000       11780         2.8%    13.107.136.10
  2407200        8024         1.9%       3.5.27.138
  2085000        6950         1.6%   57.144.248.192
  2013300        6711         1.6%   57.144.244.192
  1935900        6453         1.5%    13.221.92.241
  1863900        6213         1.5%   157.240.253.63
  1707000        5690         1.3%    13.107.138.10
  1583400        5278         1.2%      3.90.103.72
  1578300        5261         1.2%   54.227.226.218
  1575300        5251         1.2%    34.230.71.135

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
  6680100       22267         5.2%   128.139.225.245
  4995900       16653         3.9%     128.139.200.5
  4028100       13427         3.1%     128.139.200.4
  3069300       10231         2.4%     192.114.3.241
  2926800        9756         2.3%    132.75.113.111
  1374600        4582         1.1%       132.70.19.4
  1241100        4137         1.0%     132.68.110.38
  1228200        4094         1.0%      192.114.52.4
  1223700        4079         1.0%      192.114.52.9
   921000        3070         0.7%     192.114.52.13

Top-10 Possible Targets by Bytes:
      Src IP   Src Port            Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
                          128.139.225.245                 7916847600
                    443   128.139.225.245                 7295569800
                            128.139.200.5                 6696995400
                    443     128.139.200.5                 6694939800
                            128.139.200.4                 5293353900
                    443     128.139.200.4                 5288840400
                           132.75.113.111                 4312233600
                    443    132.75.113.111                 4312215600
  3.5.27.138        443                                   3549204600
  3.5.27.138                                   54213      3549204600

Metric Info:
725k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-11-06 21:51:23
End Time: ongoing

First Event Seen: 2025-11-06 21:49:00
Last Event Seen: 2025-11-06 21:50:00

Further Details:
https://primary.nemo.geant.org/alerts/details/392780/