[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #221063 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, November 14, 2025 12:14:04 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #221063 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 221063

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  92768100      309227        24.1%    199.232.82.172
  29491500       98305         7.7%     216.58.205.46
  27341400       91138         7.1%   151.101.242.172
  14243100       47477         3.7%   142.251.140.110
   6594600       21982         1.7%      132.74.20.45
   5770500       19235         1.5%        51.17.9.57
   4388400       14628         1.1%      109.70.74.29
   4325700       14419         1.1%     132.73.124.72
   4194300       13981         1.1%      132.73.124.8
   4161900       13873         1.1%     91.239.216.15

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  30267900      100893         7.9%    199.232.82.172
  17403000       58010         4.5%     132.73.124.72
  15230100       50767         4.0%      132.73.124.8
  14102100       47007         3.7%      192.114.5.10
  12360300       41201         3.2%     132.73.124.48
  10517100       35057         2.7%     132.73.124.68
   9451200       31504         2.5%   128.139.225.245
   8397600       27992         2.2%    132.73.124.152
   8277600       27592         2.2%     132.73.124.32
   6687300       22291         1.7%    132.73.124.112

Top-10 Possible Targets by Bytes:
           Src IP   Src Port          Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
   199.232.82.172                                          132618152700
   199.232.82.172        443                               126983810100
    216.58.205.46                                           42171297900
    216.58.205.46        443                                42171232200
  151.101.242.172                                           38972959200
  151.101.242.172        443                                38823450300
                               132.73.124.72                22345947000
                         443   132.73.124.72                22125010200
                                132.73.124.8                20350220700
                         443    132.73.124.8                20346869400

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-11-14 10:13:40
End Time: ongoing

First Event Seen: 2025-11-14 10:11:00
Last Event Seen: 2025-11-14 10:12:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/221063/