[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #220996 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, November 13, 2025 9:17:51 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #220996 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 220996

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  34464900      114883         9.9%   18.161.97.115
  33004500      110015         9.5%    18.161.97.64
  17181000       57270         4.9%   132.66.253.82
  15501300       51671         4.5%    52.84.151.13
   8678400       28928         2.5%    52.84.151.30
   6952200       23174         2.0%    52.84.151.16
   6244500       20815         1.8%    132.74.20.45
   5659200       18864         1.6%      51.17.9.57
   4624800       15416         1.3%     52.84.151.4
   4515300       15051         1.3%   91.239.216.15

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  34466100      114887         9.9%     132.68.39.134
  33006600      110022         9.5%      132.68.39.22
  21478200       71594         6.2%     132.66.253.82
  14804400       49348         4.3%   128.139.225.245
  13767300       45891         4.0%     132.66.253.21
  11556600       38522         3.3%   192.114.101.113
   6130200       20434         1.8%     51.16.175.215
   5655000       18850         1.6%   128.139.197.177
   4745100       15817         1.4%     128.139.200.4
   4530600       15102         1.3%     128.139.200.5

Top-10 Possible Targets by Bytes:
         Src IP   Src Port          Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                       443   132.68.39.134                50972726400
                             132.68.39.134                50972726400
  18.161.97.115        443                                50971133100
  18.161.97.115                                           50971133100
                       443    132.68.39.22                48806615400
                              132.68.39.22                48806615400
   18.161.97.64        443                                48803935800
   18.161.97.64                                           48803935800
                       443   132.66.253.82                28469337000
                             132.66.253.82                28469337000

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-11-13 19:17:41
End Time: ongoing

First Event Seen: 2025-11-13 19:15:00
Last Event Seen: 2025-11-13 19:16:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/220996/