[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #392887 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, November 7, 2025 5:04:45 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #392887 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 392887

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  25538100       85127        15.6%   192.114.101.113
  21756000       72520        13.3%      65.9.175.125
  14666700       48889         9.0%       65.9.175.17
  10647300       35491         6.5%       65.9.175.44
   8823600       29412         5.4%       65.9.175.95
   4915500       16385         3.0%      151.101.11.8
   3206100       10687         2.0%         3.5.1.147
   3065700       10219         1.9%       132.70.19.4
   3008100       10027         1.8%      132.69.32.30
   2766900        9223         1.7%   128.139.225.245

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  55896000      186320        34.2%     132.70.60.180
  22728600       75762        13.9%    131.154.130.70
   7865400       26218         4.8%   128.139.225.245
   4913400       16378         3.0%    132.69.176.237
   4093500       13645         2.5%     128.139.200.4
   3245100       10817         2.0%     128.139.200.5
   3207300       10691         2.0%     216.58.209.42
   3206400       10688         2.0%    132.75.113.141
   3065700       10219         1.9%     20.209.177.33
   1331700        4439         0.8%    74.125.247.128

Top-10 Possible Targets by Bytes:
        Src IP   Src Port          Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
                      443   132.70.60.180                82283717100
                            132.70.60.180                82283717100
  65.9.175.125        443                                32029914600
  65.9.175.125                                           32029914600
   65.9.175.17        443                                21589664400
   65.9.175.17                                           21589664400
   65.9.175.44        443                                15672454200
   65.9.175.44                                           15672454200
   65.9.175.95        443                                12990485700
   65.9.175.95                                           12990485700

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-11-07 15:04:29
End Time: ongoing

First Event Seen: 2025-11-07 15:02:00
Last Event Seen: 2025-11-07 15:03:00

Further Details:
https://primary.nemo.geant.org/alerts/details/392887/