[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #221063 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, November 14, 2025 12:18:06 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #221063 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 221063

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  141004200      470014        28.2%    199.232.82.172
   35439600      118132         7.1%   151.101.242.172
   30246600      100822         6.0%     216.58.205.46
   14650800       48836         2.9%   142.251.140.110
    7955700       26519         1.6%      132.74.20.45
    7269300       24231         1.5%     132.73.124.72
    6901200       23004         1.4%        51.17.9.57
    6825300       22751         1.4%      132.73.124.8
    5253000       17510         1.0%      109.70.74.29
    5149200       17164         1.0%     91.239.216.15

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  54983400      183278        11.0%    199.232.82.172
  23383800       77946         4.7%     132.73.124.72
  20404200       68014         4.1%      132.73.124.8
  16572300       55241         3.3%      192.114.5.10
  16365300       54551         3.3%     132.73.124.48
  13821900       46073         2.8%     132.73.124.68
  12443400       41478         2.5%     132.73.124.32
  11367000       37890         2.3%   128.139.225.245
  10359600       34532         2.1%    132.73.124.152
   9138900       30463         1.8%    132.73.124.112

Top-10 Possible Targets by Bytes:
           Src IP   Src Port          Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
   199.232.82.172                                          201311862900
   199.232.82.172        443                               194836405800
  151.101.242.172                                           50297690400
  151.101.242.172        443                                50079709500
    216.58.205.46                                           43209446100
    216.58.205.46        443                                43209362400
                               132.73.124.72                30643014600
                         443   132.73.124.72                30385053900
                                132.73.124.8                27382287900
                         443    132.73.124.8                27378936600

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-11-14 10:13:40
End Time: ongoing

First Event Seen: 2025-11-14 10:11:00
Last Event Seen: 2025-11-14 10:16:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/221063/