[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #215527 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, October 3, 2025 10:22:32 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #215527 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 215527

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  53689800      178966        37.8%          52.222.136.15
   5578500       18595         3.9%          52.222.136.65
   5083500       16945         3.6%   2001:bf8:900:d:2::71
   4108200       13694         2.9%          132.66.46.209
   3468000       11560         2.4%          192.114.3.241
   3244500       10815         2.3%           132.69.32.30
   3167400       10558         2.2%         74.118.126.212
   3056100       10187         2.2%         52.222.136.125
   2874300        9581         2.0%          17.248.173.48
   2872200        9574         2.0%         52.222.136.124

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                          Dst IP
------------------------------------------------------------------
  65202300      217341        45.9%                   132.70.60.180
   4733400       15778         3.3%                 142.250.180.170
   4115100       13717         2.9%   2001:1470:ff94:d:153:5:68:169
   3353100       11177         2.4%                    192.114.52.4
   2930400        9768         2.1%                  192.115.44.205
   2752200        9174         1.9%                   13.107.136.10
   2676900        8923         1.9%                      132.68.0.1
   2198700        7329         1.5%                   20.209.177.33
   2140200        7134         1.5%                   128.139.200.4
   2011800        6706         1.4%                   128.139.200.5

Top-10 Possible Targets by Bytes:
                Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------------
                              443     132.70.60.180                96416614200
                                      132.70.60.180                96416614200
         52.222.136.15        443                                  79393761900
         52.222.136.15                                             79393761900
         52.222.136.65        443                                   8249864400
         52.222.136.65                                              8249864400
  2001:bf8:900:d:2::71       8443                                   7624132200
  2001:bf8:900:d:2::71                                              7624132200
                                    142.250.180.170        443      6422062800
                                    142.250.180.170                 6422062800

Metric Info:
786k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-10-03 19:22:22
End Time: ongoing

First Event Seen: 2025-10-03 19:20:00
Last Event Seen: 2025-10-03 19:21:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/215527/