[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #392967 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, November 8, 2025 12:14:37 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #392967 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 392967

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  8962800       29876         5.9%     132.73.124.72
  8269800       27566         5.5%     132.73.124.48
  6617700       22059         4.4%      132.73.124.8
  4734900       15783         3.1%     132.73.124.68
  3507300       11691         2.3%    132.73.124.236
  3233700       10779         2.1%       132.70.19.4
  3210000       10700         2.1%      132.69.32.30
  3135300       10451         2.1%    132.73.124.112
  2920200        9734         1.9%     132.73.124.40
  2835900        9453         1.9%   128.139.225.245

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  45398100      151327        30.0%   142.251.140.110
  23130000       77100        15.3%    216.58.204.142
   6518700       21729         4.3%      23.41.187.17
   4779000       15930         3.2%   128.139.225.245
   4047300       13491         2.7%     128.139.200.5
   3624000       12080         2.4%      23.41.187.35
   3616500       12055         2.4%   142.251.140.106
   3439200       11464         2.3%     128.139.200.4
   3233700       10779         2.1%     20.209.177.33
   2965500        9885         2.0%     162.125.69.14

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                             128.139.225.245                 5560009800
                       443   128.139.225.245                 5227377300
                               128.139.200.5                 5183074800
                       443     128.139.200.5                 5175525600
    132.70.19.4                                     443      4740702000
    132.70.19.4                                              4740702000
                               20.209.177.33        443      4740702000
                               20.209.177.33                 4740702000
  132.73.124.48                                              4683070200
  132.73.124.48                                     443      4683045600

Metric Info:
847k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-11-08 10:14:24
End Time: ongoing

First Event Seen: 2025-11-08 10:12:00
Last Event Seen: 2025-11-08 10:13:00

Further Details:
https://primary.nemo.geant.org/alerts/details/392967/