[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #221007 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, November 13, 2025 10:34:52 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #221007 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 221007

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  33171600      110572         8.0%    142.251.209.46
  18045300       60151         4.3%     132.66.253.82
  17014200       56714         4.1%      2.17.152.210
  15573000       51910         3.7%      18.161.97.31
  15259500       50865         3.7%      18.161.97.64
  14538900       48463         3.5%      18.161.97.21
  11177400       37258         2.7%     18.161.97.115
  10820400       36068         2.6%      184.25.54.62
   8511300       28371         2.0%   199.232.214.172
   8168400       27228         2.0%   199.232.210.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  56551500      188505        13.6%      132.68.38.60
  20643300       68811         5.0%     132.66.253.82
  15414300       51381         3.7%   128.139.225.245
   7211400       24038         1.7%     51.16.175.215
   7001100       23337         1.7%        132.68.0.1
   5996100       19987         1.4%   128.139.197.177
   4595400       15318         1.1%    132.77.188.218
   4374000       14580         1.1%     128.139.200.5
   3557400       11858         0.9%     128.139.221.5
   3400500       11335         0.8%     128.139.200.4

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                        443    132.68.38.60                83550414300
                               132.68.38.60                83550414300
  142.251.209.46        443                                47739624300
  142.251.209.46                                           47739624300
                        443   132.66.253.82                26809573500
                              132.66.253.82                26809573500
    2.17.152.210        443                                25421723700
    2.17.152.210                                           25421723700
   132.66.253.82                                   443     24659591400
   132.66.253.82                                           24659591400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-11-13 20:34:42
End Time: ongoing

First Event Seen: 2025-11-13 20:32:00
Last Event Seen: 2025-11-13 20:33:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/221007/