[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #221042 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, November 14, 2025 6:05:49 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #221042 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 221042

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  49476000      164920        17.7%        132.74.3.2
  32093700      106979        11.5%        132.74.3.3
  20495400       68318         7.3%        132.74.3.4
  10337700       34459         3.7%    142.251.209.42
   8813700       29379         3.2%      132.74.20.45
   8537700       28459         3.1%   142.250.180.170
   6350100       21167         2.3%    216.58.204.138
   5887200       19624         2.1%        51.17.9.57
   5880900       19603         2.1%    199.232.82.172
   4898700       16329         1.8%     91.239.216.15

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total          Dst IP
--------------------------------------------------
  15685800       52286         5.6%      3.5.56.207
  13169700       43899         4.7%   132.74.56.157
  10578000       35260         3.8%       3.5.58.40
  10319700       34399         3.7%      3.5.58.243
   9615300       32051         3.4%     16.12.12.22
   8813400       29378         3.2%   51.16.175.215
   8640900       28803         3.1%   132.74.56.132
   8442900       28143         3.0%       3.5.57.49
   7872600       26242         2.8%      3.5.56.197
   7370100       24567         2.6%      132.74.3.2

Top-10 Possible Targets by Bytes:
      Src IP   Src Port          Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------
  132.74.3.2                                   443     71704724100
  132.74.3.2                                           71704724100
  132.74.3.3                                   443     46472221800
  132.74.3.3                                           46472221800
  132.74.3.4                                   443     29738473500
  132.74.3.4                                           29738473500
                             3.5.56.207        443     22191919200
                             3.5.56.207                22191919200
                    443   132.74.56.157                19109595900
                          132.74.56.157                19109595900

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-11-14 04:05:39
End Time: ongoing

First Event Seen: 2025-11-14 04:03:00
Last Event Seen: 2025-11-14 04:04:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/221042/