[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #221008 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, November 13, 2025 10:38:31 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #221008 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 221008

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  60247500      200825        12.5%      2.17.152.210
  33515700      111719         6.9%    142.251.209.46
  22581600       75272         4.7%      18.161.97.31
  21246300       70821         4.4%      18.161.97.64
  20153100       67177         4.2%     132.66.253.82
  19262100       64207         4.0%      18.161.97.21
  15819300       52731         3.3%     18.161.97.115
  11851500       39505         2.5%      184.25.54.62
  10654500       35515         2.2%   199.232.214.172
  10282800       34276         2.1%   199.232.210.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  78912000      263040        16.3%      132.68.38.60
  25107000       83690         5.2%     132.66.253.82
   8126100       27087         1.7%   128.139.225.245
   8104800       27016         1.7%        132.68.0.1
   5504100       18347         1.1%    132.77.188.218
   4946100       16487         1.0%     128.139.200.5
   4449900       14833         0.9%   199.232.214.172
   4370100       14567         0.9%   199.232.210.172
   4079100       13597         0.8%     128.139.221.5
   3945300       13151         0.8%     128.139.200.4

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                        443    132.68.38.60               116591602800
                               132.68.38.60               116591602800
    2.17.152.210        443                                90082645500
    2.17.152.210                                           90082645500
  142.251.209.46                                           48340622400
  142.251.209.46        443                                48340610400
    18.161.97.31        443                                33360969600
    18.161.97.31                                           33360969600
                        443   132.66.253.82                33026217000
                              132.66.253.82                33026217000

Metric Info:
1M ACK Packets/s

Alert Type:
time_window

Alert Description:
High ACK packet rate.

Start Time: 2025-11-13 20:34:43
End Time: ongoing

First Event Seen: 2025-11-13 20:32:00
Last Event Seen: 2025-11-13 20:36:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/221008/